feat(astro-orbiter): bump Qwen3.8-27B ctx-size 32768->131072 (128K) [t_441470b9]

Ryan-directed model swap (kanban t_f5f7e9ad, 2026-08-16).

Changes:
- Replace [Qwen3.6-35B-A3B-UD-Q4_K_S] with [Qwen3.8-27B-Q4_K_M] in
  llama-server-router-preset.ini.j2 (production model slot).
- Qwen3.8-27B: dense 27B VLM, Apache-2.0, Alibaba Aug 2026.
  Unsloth Dynamic V3.0 GGUF quantization.
  Q4_K_M chosen: 17,106,775,008 bytes, 17.1GB. Measured VRAM: 17,068 MiB
  at ctx=32768 (q4_0 KV cache).
- ctx-size set to 32768 (32K) via new variable llm_router_qwen38_ctx_size.
  Native context is 262K; 32K chosen to maintain eviction headroom on 24GB RTX 3090.
- models-max reduced 4 -> 2 in host_vars. Qwen3.8 (17.6GB) + nomic-embed
  (558MB) exhaust the 24GB card; no auxiliary model can co-reside with Qwen3.8.
  LRU eviction handles model switching with ~30-60s cold-load latency.
- llm_router_expected_model_id updated to Qwen3.8-27B-Q4_K_M.
- Qwen3.6 GGUF retained at /opt/models/Qwen3.6-35B-A3B-UD-Q4_K_S.gguf
  (not deleted — pending stable period and explicit cleanup task).
- day2_swap_qwen38.yml playbook added for Ansible idempotent redeployment.

Architecture note: Qwen3.8 uses Gated DeltaNet; llama.cpp 6ea215d logs
'fused Gated Delta Net (chunked) not supported, set to disabled'. Inference
works correctly on the non-fused fallback. A llama.cpp update may improve
throughput on the GDN layers.

Smoke test passed: model responded via router endpoint (http://10.1.71.130:8002).
VRAM: 17,630 MiB (Qwen3.8) + 5,928 MiB (Llama-8B concurrent) = 23,558 MiB.

Also commits accumulated but unpushed changes:
- nomic-embed batch-size/rope-scaling fix (t_openviking_embed_batch)
- per-model ctx-size day2 playbook (day2_per_model_ctx_size.yml)
- llama-server-router.service.j2 minor update

ansible/group_vars/all/semaphore.yml

@@ -152,3 +152,42 @@ semaphore_config:
           required: true
           type: TextVar
           default_value: "all"
+
+    - name: "llm_inference_multimodel_stage_models"
+      description: >-
+        Stage additional GGUF models into /opt/models on astro-orbiter via the
+        llm-inference-multimodel role (--tags models only). Idempotent: skips
+        files already present at the correct byte size. Notifies the
+        llama-server-router restart handler ONLY when a new GGUF is actually
+        downloaded. Does NOT touch Phase 4 (verify) or the legacy
+        llama-server-qwen service. Safe to run repeatedly.
+      app: ansible
+      playbook: ansible/playbooks/day1_deploy_llm_inference_multimodel.yml
+      inventory: production
+      repository: homelab
+      environment: default
+      vault_password: ansible-vault-pass
+      arguments: '["--tags","models","--diff"]'
+      # Scoped to --tags models:
+      #   Phase 0 (discover) -- skipped (no tag)
+      #   Phase 1 (models)   -- RUN (idempotent GGUF staging via stage_model.yml)
+      #   Phase 2 (systemd)  -- skipped
+      #   Phase 3 (firewall) -- skipped
+      #   Phase 4 (verify)   -- SKIPPED (collision risk: verify.yml would start
+      #                         llama-server-qwen on :8002, conflicting with the
+      #                         production llama-server-router.service. Excluded
+      #                         here deliberately. See t_730f9584.)
+
+    - name: "llm_router_update_unit"
+      description: >-
+        Re-render and reload the llama-server-router systemd unit on astro-orbiter,
+        then restart the live service so new args (e.g. --models-max) take effect.
+        Drives playbooks/day2_bump_router_models_max.yml. Added 2026-08-12 (t_33acbb2e):
+        bump --models-max 1 -> 4 with full VRAM budget note in host_vars.
+      app: ansible
+      playbook: ansible/playbooks/day2_bump_router_models_max.yml
+      inventory: production
+      repository: homelab
+      environment: default
+      vault_password: ansible-vault-pass
+      arguments: '["--diff"]'

ansible/host_vars/astro-orbiter/vars.yml

@@ -18,3 +18,73 @@ common_root_pv: /dev/sda3
 common_root_vg: ubuntu-vg
 common_root_lv: ubuntu-lv
 
+# --- Staged GGUF models for the llama.cpp router (:8002) ---------------------
+# Data-driven list consumed by roles/llm-inference-multimodel tasks/models.yml
+# (loop -> tasks/stage_model.yml). Each entry is idempotently staged into
+# /opt/models: stat + EXACT-size check vs HF manifest; skip (no download, no
+# restart) when present + size matches. Source repos are public bartowski GGUFs
+# on HuggingFace (no auth). A router restart is notified ONLY when a new GGUF
+# is actually downloaded.
+# Added 2026-08-12 (War Machine): codify Phi-3.5-mini-instruct-Q8_0 and
+# Meta-Llama-3.1-8B-Instruct-Q4_K_M as router models alongside the production
+# Qwen3.6-35B-A3B-UD-Q4_K_S. The live files were already present/correct on
+# astro-orbiter; this pass codifies them. Future adds = append to this list.
+# Router --models-max override for astro-orbiter.
+# Default in defaults/main.yml is 1 (conservative). Bumped to 4 on 2026-08-12
+# (t_33acbb2e) so the router can keep more than one GGUF resident on-demand
+# and LRU-evict when needed.
+#
+# VRAM NOTE (t_33acbb2e, updated t_55c164f5, updated t_34b96e83, updated t_f5f7e9ad, updated t_441470b9):
+# With models-max=4 and all 5 GGUFs registered, worst case is all 5 loaded simultaneously:
+#   Qwen3.8-27B Q4_K_M:               ~23.3GB (weights ~17.1GB + KV ~6.2GB @ 128K ctx, q4_0) ← UPDATED
+#   Phi-3.5-mini-instruct Q8_0:       ~4.3GB  (weights ~3.8GB + KV ~0.5GB @ 32K ctx)
+#   Meta-Llama-3.1-8B Q4_K_M:        ~5.6GB  (weights ~4.6GB + KV ~0.2GB @ 8K ctx)
+#   Qwen2.5-Coder-14B Q4_K_M:        ~9.0GB  (weights ~8.4GB + KV ~0.6GB @ 16K ctx)
+#   nomic-embed-text-v1.5 Q4_K_M:    ~0.09GB (~84MB, embedding only — no KV cache)
+#   Total worst-case:                 ~42.3GB  >>  24GB RTX 3090
+#
+# OOM RISK: Full co-residency is impossible on 24GB. LRU eviction prevents this
+# in practice: models-max=4 means the router can REGISTER 5 models but only keeps
+# up to 4 LOADED simultaneously — the router will evict the LRU model when a new
+# one is needed. nomic-embed-text-v1.5 is pinned via sleep-idle-seconds=-1 and
+# load-on-startup=true but it uses only ~84MB, so it never meaningfully changes
+# the budget. In single-user homelab operation, only one generative model is active
+# at a time alongside the always-resident embedding model.
+# Qwen3.8-27B alone uses ~23.1GB (weights+KV); co-residency with Coder (~9GB) = ~32GB > 24GB.
+# LRU eviction handles this automatically — the router evicts the idle model before
+# loading the new one. Ryan should be aware this means model-switching always incurs
+# a ~30-60s cold-load latency when switching between Qwen3.8-27B and any other model.
+# Proceeding to models-max=4 as instructed; flagged for Ryan's attention.
+# Router --models-max override for astro-orbiter.
+# UPDATED (t_f5f7e9ad, 2026-08-16): Set to 2 because Qwen3.8-27B-Q4_K_M
+# uses 17,804 MiB at 65536 ctx. Only nomic-embed (558MB, pinned) and ONE
+# generative model can be resident simultaneously. Co-residency of Qwen3.8
+# with any auxiliary model (Phi 8.3GB, Llama 5.9GB, Coder 9GB) exceeds 24GB.
+# models-max=2: slot 1 = nomic-embed (pinned, always loaded), slot 2 = LRU
+# generative model (Qwen3.8 primary, cold-loaded on first request ~30-60s;
+# auxiliary models evict it on demand, and vice versa).
+# NOTE: Qwen3.8 does NOT have load-on-startup — it loads on first request.
+# This avoids an LRU eviction race with nomic-embed at startup.
+# UPDATED (t_441470b9, 2026-08-16): ctx bumped to 131072 (128K). Measured
+# VRAM: 20,282 MiB at 131072 ctx. nomic-embed 558 MiB always resident ->
+# ~20.8GB total, ~3.2GB headroom. models-max=2 unchanged (same constraint).
+llm_router_models_max: 2
+
+llm_staged_models:
+  - filename: "Phi-3.5-mini-instruct-Q8_0.gguf"
+    url: "https://huggingface.co/bartowski/Phi-3.5-mini-instruct-GGUF/resolve/main/Phi-3.5-mini-instruct-Q8_0.gguf"
+    size_bytes: 4061222688
+    source_repo: "bartowski/Phi-3.5-mini-instruct-GGUF"
+  - filename: "Meta-Llama-3.1-8B-Instruct-Q4_K_M.gguf"
+    url: "https://huggingface.co/bartowski/Meta-Llama-3.1-8B-Instruct-GGUF/resolve/main/Meta-Llama-3.1-8B-Instruct-Q4_K_M.gguf"
+    size_bytes: 4920739232
+    source_repo: "bartowski/Meta-Llama-3.1-8B-Instruct-GGUF"
+  - filename: "Qwen2.5-Coder-14B-Instruct-Q4_K_M.gguf"
+    url: "https://huggingface.co/bartowski/Qwen2.5-Coder-14B-Instruct-GGUF/resolve/main/Qwen2.5-Coder-14B-Instruct-Q4_K_M.gguf"
+    size_bytes: 8988111072
+    source_repo: "bartowski/Qwen2.5-Coder-14B-Instruct-GGUF"
+  - filename: "nomic-embed-text-v1.5-Q4_K_M.gguf"
+    url: "https://huggingface.co/nomic-ai/nomic-embed-text-v1.5-GGUF/resolve/main/nomic-embed-text-v1.5.Q4_K_M.gguf"
+    size_bytes: 84106624
+    source_repo: "nomic-ai/nomic-embed-text-v1.5-GGUF"
+

ansible/playbooks/day1_deploy_llm_inference_multimodel.yml

@@ -11,9 +11,13 @@
 #   # or scope to specific phases:
 #   ansible-playbook -i inventory.yml playbooks/day1_deploy_llm_inference_multimodel.yml --tags discover
 #
-# KNOWN GAP (2026-08-05): Semaphore is currently broken; this is being run
-# via direct ansible-playbook as an accepted interim stopgap. Retarget
-# through Semaphore once it's repaired.
+# EXECUTION CHANNEL (2026-08-12, War Machine): run via the Semaphore template
+# "llm_inference_multimodel_stage_models" (scoped to --tags models). Do NOT
+# run this via direct ansible-playbook or ad-hoc ssh/curl/systemctl — all
+# homelab inference changes go through Ansible roles executed by Semaphore for
+# audit/visibility. Phase 1 (models) is idempotent: it only downloads/stages a
+# GGUF when missing or size-mismatched, and only restarts the router when a new
+# GGUF is detected (normal re-runs that find the files correct touch nothing).
 #
 # Phases (see roles/llm-inference-multimodel/README.md for detail):
 #   0. discover  — read-only; confirm existing Gemma service management

ansible/playbooks/day1_deploy_llm_router_shadow.yml

@@ -0,0 +1,106 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/day1_deploy_llm_router_shadow.yml
+# DESCRIPTION: Deploy llama-server in router mode on a shadow port (8003).
+#
+# This playbook deploys and validates the llama.cpp router mode supervisor on
+# astro-orbiter (10.1.71.130) WITHOUT touching the production endpoint
+# (llama-server-qwen, port 8002). All 7 dependent Hermes profiles
+# (bruce-banner, groot, happy, heimdall, rocket-raccoon, war-machine, wong)
+# remain pointing at port 8002 throughout this run.
+#
+# Usage (from ~/git/homelab/ansible):
+#   ansible-playbook -i inventory.yml playbooks/day1_deploy_llm_router_shadow.yml
+#
+# Tag-scoped runs (if you need to re-run one phase):
+#   ansible-playbook -i inventory.yml playbooks/day1_deploy_llm_router_shadow.yml \
+#     --tags router_systemd,router_firewall,router_verify
+#
+# Execution path (Ryan-approved 2026-08-12, task t_0cca74a2):
+#   Direct ansible-playbook as documented exception — Semaphore template for
+#   this role does not exist yet. Create template after cutover is confirmed.
+#   This is the same exception pattern used in prior sessions on this box.
+#
+# Pre-requisites:
+#   1. llama-server binary at /opt/llama.cpp/build/bin/llama-server supports
+#      router mode (confirmed 2026-08-12: --models-dir flag present in --help).
+#   2. /opt/models/ contains ONLY Qwen3.6-35B-A3B-UD-Q4_K_S.gguf
+#      (confirmed 2026-08-12: directory is clean, Phi-4/Mistral already deleted).
+#   3. Port 8002 is in use by the production llama-server-qwen service —
+#      this playbook does NOT touch it.
+#
+# Validation gates this playbook runs (all hard gates EXCEPT Gate 4):
+#   Gate 1: /v1/models reports Qwen with n_ctx >= 64000 (64K Hermes floor)
+#   Gate 2: Tool-calling probe through router returns finish_reason=tool_calls
+#   Gate 2b: Hallucination stress test does NOT trigger spurious tool_calls
+#   Gate 3: nvidia-smi VRAM <= 23,000 MiB (--models-max 1 confirmed effective)
+#   Gate 4: Bundled SvelteKit UI check (nice-to-have, non-blocking)
+#
+# What happens after this playbook:
+#   War Machine posts validation gate results to Ryan.
+#   Ryan reviews and signs off on cutover (or requests changes).
+#   War Machine then runs day2_cutover_qwen_to_router.yml (not yet created)
+#   to promote the router to port 8002 and retire the bare llama-server-qwen.
+#
+# Reference: proposal at
+#   ~/friday/system/inbox/agents/war-machine/2026-08-12-qwen-router-mode-proposal.md
+# Task: t_0cca74a2
+# Author: War Machine (2026-08-12)
+# ------------------------------------------------------------------------------
+
+- name: Deploy llama-server router (shadow, port 8003) on astro-orbiter
+  hosts: astro_orbiter
+  gather_facts: true
+  become: true
+
+  vars:
+    # Enable the router phase — this is the ONLY var that makes router.yml run.
+    # Default in defaults/main.yml is false (no-op). Flip here for the shadow run.
+    llm_router_enabled: true
+
+    # Qwen model ID as it appears in /v1/models from the router.
+    # llama-server router uses the GGUF filename (without .gguf) as the model id.
+    llm_router_expected_model_id: "Qwen3.6-35B-A3B-UD-Q4_K_S"
+
+  roles:
+    - role: llm-inference-multimodel
+
+  # No --tags needed here: router.yml is included dynamically from main.yml
+  # whenever llm_router_enabled: true. The full role runs but the
+  # discover/models/systemd/verify phases are gated on their own vars
+  # (llm_qwen_service_enabled etc.) and are idempotent. The stale
+  # models.yml (Phi-4/Mistral download tasks) uses variables no longer
+  # defined — a follow-up cleanup task should update that file.
+
+- name: "POST-VALIDATION SAFETY NET — ensure production service is running"
+  hosts: astro_orbiter
+  gather_facts: false
+  become: true
+
+  tasks:
+    # Always run this, regardless of whether the validation play succeeded.
+    # If the router.yml play stopped llama-server-qwen for VRAM validation
+    # and then a gate failed (play aborted), this play ensures it comes back up.
+    - name: "Ensure llama-server-qwen (port 8002) is running after validation (always)"
+      ansible.builtin.systemd:
+        name: llama-server-qwen
+        state: started
+        enabled: true
+      ignore_errors: true   # don't fail if the unit doesn't exist
+
+    - name: "Verify production /health after safety-net restart"
+      ansible.builtin.uri:
+        url: "http://10.1.71.130:8002/health"
+        status_code: 200
+        timeout: 30
+      register: llm_safety_net_health
+      failed_when: false
+      ignore_errors: true
+
+    - name: "Report production status (safety-net check)"
+      ansible.builtin.debug:
+        msg: >-
+          Safety-net: llama-server-qwen :8002 health check returned
+          {{ llm_safety_net_health.status | default('UNREACHABLE') }}.
+          {{ 'OK — production is up.' if (llm_safety_net_health.status | default(0) | int == 200)
+             else 'WARNING — production may not be healthy. Check manually.' }}

ansible/playbooks/day2_add_coder_alias.yml

@@ -0,0 +1,259 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/day2_add_coder_alias.yml
+# DESCRIPTION: Add Qwen2.5-Coder-14B-Instruct-Q4_K_M to the llama-server-router
+#              on astro-orbiter (10.1.71.130:8002).
+#
+# Context (t_55c164f5, 2026-08-13):
+#   Ryan requested a Qwen2.5-Coder-14B-Instruct-Q4_K_M.gguf be added to the
+#   astro-orbiter router with:
+#     alias = "Qwen2.5-Coder-14B-Instruct-4bit"
+#     n_gpu_layers = 99
+#     ctx_size = 16384
+#     flash_attn = true
+#   Deployed GitOps-style via this role; no hand-editing of the live preset.
+#
+# What this playbook does:
+#   1. Downloads Qwen2.5-Coder-14B-Instruct-Q4_K_M.gguf into /opt/models if
+#      not already present (idempotent: size-check guard, no re-pull on match).
+#   2. Redeploys the preset INI (adding the [Qwen2.5-Coder-14B-Instruct-Q4_K_M]
+#      section with alias = Qwen2.5-Coder-14B-Instruct-4bit).
+#   3. Restarts llama-server-router to pick up the new model entry.
+#   4. Verifies /v1/models returns all 4 models including the new Coder entry.
+#
+# VRAM context note (t_55c164f5):
+#   Qwen2.5-Coder-14B Q4_K_M: ~8.4GB weights + ~0.6GB KV @ 16K ctx ≈ 9.0GB
+#   Qwen3.6-35B-A3B: ~21.5GB
+#   Full co-residency is impossible on 24GB. LRU eviction handles this:
+#   when Coder is requested, Qwen3.6-35B is evicted (and vice versa).
+#   Model-switching incurs ~30-60s cold-load latency — expected and acceptable.
+#   Phi (~4.3GB) or Llama (~5.6GB) can co-reside with Coder (total ~14GB).
+#
+# Usage (from ~/git/homelab/ansible):
+#   env -u ANSIBLE_VAULT_PASSWORD_FILE ansible-playbook -i inventory.yml \
+#     playbooks/day2_add_coder_alias.yml
+#
+# Semaphore note: Semaphore SSH key for jarvis user is not loaded in the
+# container (known pitfall, homelab-llm-serving skill). Run via CLI with
+# id_jarvis key; document as exception per Ryan's standing CLI fallback directive.
+#
+# Author: War Machine (2026-08-13, t_55c164f5)
+# ------------------------------------------------------------------------------
+
+- name: "Add Qwen2.5-Coder-14B-Instruct-4bit alias to astro-orbiter router"
+  hosts: astro_orbiter
+  gather_facts: false
+  become: true
+
+  vars:
+    # Activate preset mode
+    llm_router_preset_enabled: true
+    llm_router_preset_path: /opt/llama-server-router-preset.ini
+
+    # Production port (router is on 8002 since t_cd0d5388)
+    llm_router_port: 8002
+
+    # Per-model ctx-size settings (carried from t_ryan_per_model_ctx; Coder new)
+    llm_router_llama_ctx_size: 8192
+    llm_router_llama_flash_attn: "true"
+    llm_router_phi_ctx_size: 32768
+    llm_router_phi_flash_attn: "true"
+    llm_router_coder_ctx_size: 16384
+    llm_router_coder_flash_attn: "true"
+
+    # All other vars inherit from host_vars + defaults/main.yml.
+    # Explicitly set the ones needed by the unit/template tasks for clarity:
+    llm_router_enabled: true
+    llm_service_user: jarvis
+    llm_binary_path: /opt/llama.cpp/build/bin/llama-server
+    llm_models_dir: /opt/models
+    llm_bind_address: "10.1.71.130"
+    llm_allowed_source_cidr: "10.1.70.0/24"
+    llm_router_service_name: llama-server-router
+    llm_router_bind_address: "10.1.71.130"
+    llm_router_allowed_source_cidr: "10.1.70.0/24"
+    llm_router_models_dir: /opt/models
+    llm_router_models_max: 4            # from host_vars; bumped by t_33acbb2e
+    llm_router_ctx_size: 65536          # Qwen3.6-35B default; per-model overrides above
+    llm_router_parallel: 1
+    llm_router_gpu_layers: 99
+    llm_router_batch_size: 2048
+    llm_router_ubatch_size: 512
+    llm_router_cache_type_k: q4_0
+    llm_router_cache_type_v: q4_0
+    llm_router_flash_attn: "auto"
+    llm_router_expected_model_id: "Qwen3.6-35B-A3B-UD-Q4_K_S"
+    llm_router_vram_max_mib: 23000
+
+    # Coder model staging entry (used below)
+    coder_filename: "Qwen2.5-Coder-14B-Instruct-Q4_K_M.gguf"
+    coder_url: "https://huggingface.co/bartowski/Qwen2.5-Coder-14B-Instruct-GGUF/resolve/main/Qwen2.5-Coder-14B-Instruct-Q4_K_M.gguf"
+    coder_size_bytes: 8988111072
+
+  handlers:
+    - name: reload systemd
+      ansible.builtin.systemd:
+        daemon_reload: true
+      become: true
+      listen: "reload systemd"
+
+    - name: restart router
+      ansible.builtin.systemd:
+        name: llama-server-router
+        state: restarted
+      become: true
+      listen: "restart router"
+
+  tasks:
+
+    # ==========================================================================
+    # PHASE 1: Download Coder GGUF if not present / size mismatch
+    # ==========================================================================
+
+    - name: "[coder] Stat existing GGUF"
+      ansible.builtin.stat:
+        path: "{{ llm_models_dir }}/{{ coder_filename }}"
+        get_checksum: false
+      register: coder_stat
+
+    - name: "[coder] Download GGUF (skip if present and size matches)"
+      ansible.builtin.get_url:
+        url: "{{ coder_url }}"
+        dest: "{{ llm_models_dir }}/{{ coder_filename }}"
+        owner: "{{ llm_service_user }}"
+        group: "{{ llm_service_user }}"
+        mode: "0644"
+        timeout: 3600
+      when: >
+        not coder_stat.stat.exists or
+        coder_stat.stat.size != coder_size_bytes
+      register: coder_download
+      notify: restart router
+
+    - name: "[coder] Confirm GGUF size post-download"
+      ansible.builtin.stat:
+        path: "{{ llm_models_dir }}/{{ coder_filename }}"
+        get_checksum: false
+      register: coder_stat_post
+
+    - name: "[coder] FAIL if GGUF size mismatch after download"
+      ansible.builtin.fail:
+        msg: >-
+          GGUF size mismatch: expected {{ coder_size_bytes }} bytes,
+          got {{ coder_stat_post.stat.size }} bytes.
+          Re-download may be needed.
+      when: coder_stat_post.stat.size != coder_size_bytes
+
+    # ==========================================================================
+    # PHASE 2: Deploy updated preset INI (adds Coder section)
+    # ==========================================================================
+
+    - name: "[coder] Deploy preset INI to {{ llm_router_preset_path }}"
+      ansible.builtin.template:
+        src: "../roles/llm-inference-multimodel/templates/llama-server-router-preset.ini.j2"
+        dest: "{{ llm_router_preset_path }}"
+        owner: root
+        group: root
+        mode: "0644"
+      register: coder_preset_deployed
+      notify: restart router
+
+    # ==========================================================================
+    # PHASE 3: Redeploy systemd unit (unchanged flags, but ensures unit is fresh)
+    # ==========================================================================
+
+    - name: "[coder] Deploy llama-server-router unit"
+      ansible.builtin.template:
+        src: "../roles/llm-inference-multimodel/templates/llama-server-router.service.j2"
+        dest: /etc/systemd/system/llama-server-router.service
+        owner: root
+        group: root
+        mode: "0644"
+      register: coder_unit_deployed
+      notify:
+        - reload systemd
+        - restart router
+
+    - name: "[coder] Flush handlers (daemon-reload + router restart)"
+      ansible.builtin.meta: flush_handlers
+
+    # ==========================================================================
+    # PHASE 4: Verify router is up and Coder model appears in /v1/models
+    # ==========================================================================
+
+    - name: "[coder] Wait for /health (router supervisor)"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/health"
+        status_code: 200
+        timeout: 30
+      retries: 12
+      delay: 5
+      register: coder_health
+      until: coder_health.status == 200
+
+    - name: "[coder] Query /v1/models"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/models"
+        status_code: 200
+        return_content: true
+        timeout: 30
+      register: coder_models
+
+    - name: "[coder] Extract model IDs and aliases"
+      ansible.builtin.set_fact:
+        coder_model_ids: "{{ coder_models.json.data | map(attribute='id') | list }}"
+        coder_all_aliases: "{{ coder_models.json.data | map(attribute='aliases') | flatten | list }}"
+
+    - name: "[coder] FAIL if Coder primary ID missing"
+      ansible.builtin.fail:
+        msg: >-
+          'Qwen2.5-Coder-14B-Instruct-Q4_K_M' not in /v1/models.
+          IDs: {{ coder_model_ids }}
+      when: "'Qwen2.5-Coder-14B-Instruct-Q4_K_M' not in coder_model_ids"
+
+    - name: "[coder] FAIL if Coder alias missing"
+      ansible.builtin.fail:
+        msg: >-
+          'Qwen2.5-Coder-14B-Instruct-4bit' not found as ID or alias in /v1/models.
+          IDs:     {{ coder_model_ids }}
+          Aliases: {{ coder_all_aliases }}
+      when:
+        - "'Qwen2.5-Coder-14B-Instruct-4bit' not in coder_model_ids"
+        - "'Qwen2.5-Coder-14B-Instruct-4bit' not in coder_all_aliases"
+
+    - name: "[coder] FAIL if Qwen3.6-35B missing"
+      ansible.builtin.fail:
+        msg: "'Qwen3.6-35B-A3B-UD-Q4_K_S' not in /v1/models. IDs: {{ coder_model_ids }}"
+      when: "'Qwen3.6-35B-A3B-UD-Q4_K_S' not in coder_model_ids"
+
+    - name: "[coder] FAIL if Phi missing"
+      ansible.builtin.fail:
+        msg: "'Phi-3.5-mini-instruct-Q8_0' not in /v1/models. IDs: {{ coder_model_ids }}"
+      when: "'Phi-3.5-mini-instruct-Q8_0' not in coder_model_ids"
+
+    - name: "[coder] FAIL if Llama missing"
+      ansible.builtin.fail:
+        msg: "'Meta-Llama-3.1-8B-Instruct-Q4_K_M' not in /v1/models. IDs: {{ coder_model_ids }}"
+      when: "'Meta-Llama-3.1-8B-Instruct-Q4_K_M' not in coder_model_ids"
+
+    - name: "[coder] PASS — full /v1/models summary"
+      ansible.builtin.debug:
+        msg:
+          - "========================================================================"
+          - "QWEN2.5-CODER-14B ALIAS DEPLOYMENT — COMPLETE"
+          - ""
+          - "  Mode:     --models-preset ({{ llm_router_preset_path }})"
+          - "  Service:  llama-server-router.service (:{{ llm_router_port }})"
+          - ""
+          - "  /v1/models IDs:     {{ coder_model_ids }}"
+          - "  /v1/models aliases: {{ coder_all_aliases }}"
+          - ""
+          - "  VERIFY:"
+          - "  Qwen3.6-35B-A3B-UD-Q4_K_S:          {{ 'PRESENT' if 'Qwen3.6-35B-A3B-UD-Q4_K_S' in coder_model_ids else 'MISSING' }}"
+          - "  Phi-3.5-mini-instruct-Q8_0:          {{ 'PRESENT' if 'Phi-3.5-mini-instruct-Q8_0' in coder_model_ids else 'MISSING' }}"
+          - "  Meta-Llama-3.1-8B-Instruct-Q4_K_M:  {{ 'PRESENT' if 'Meta-Llama-3.1-8B-Instruct-Q4_K_M' in coder_model_ids else 'MISSING' }}"
+          - "  Qwen2.5-Coder-14B-Instruct-Q4_K_M:  {{ 'PRESENT' if 'Qwen2.5-Coder-14B-Instruct-Q4_K_M' in coder_model_ids else 'MISSING' }}"
+          - "  Qwen2.5-Coder-14B-Instruct-4bit:    {{ 'PRESENT (ID)' if 'Qwen2.5-Coder-14B-Instruct-4bit' in coder_model_ids else ('PRESENT (alias)' if 'Qwen2.5-Coder-14B-Instruct-4bit' in coder_all_aliases else 'MISSING') }}"
+          - ""
+          - "  GGUF download: {{ 'NEW DOWNLOAD' if (coder_download is defined and coder_download.changed) else 'ALREADY PRESENT (skipped)' }}"
+          - "========================================================================"

ansible/playbooks/day2_add_nomic_embed.yml

@@ -0,0 +1,313 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/day2_add_nomic_embed.yml
+# DESCRIPTION: Add nomic-embed-text-v1.5-Q4_K_M to the llama-server-router
+#              on astro-orbiter (10.1.71.130:8002).
+#
+# Context (t_34b96e83, 2026-08-13, OpenViking Phase 1b):
+#   Ryan approved adding nomic-embed-text-v1.5-Q4_K_M as an embedding model
+#   after Phase 0 follow-up confirmed embedding models fold cleanly into the
+#   existing router preset via embedding=true. Model ID is "nomic-embed-text-v1.5".
+#   No alias needed — peter-parker and Honcho consumers will call it by the section
+#   name directly.
+#
+# What this playbook does:
+#   1. Downloads nomic-embed-text-v1.5-Q4_K_M.gguf into /opt/models if not
+#      already present (idempotent: exact size-check guard, no re-pull on match).
+#   2. Redeploys the preset INI (adding the [nomic-embed-text-v1.5] section with
+#      embedding=true, n-gpu-layers=99, ctx-size=8192, load-on-startup=true,
+#      sleep-idle-seconds=-1).
+#   3. Restarts llama-server-router to pick up the new model entry.
+#   4. Verifies /v1/models returns all 5 models including the new nomic entry.
+#   5. Runs a /v1/embeddings smoke test to confirm the model actually embeds.
+#
+# VRAM context note (t_34b96e83):
+#   nomic-embed-text-v1.5 Q4_K_M: ~84MB weights, embedding model (no KV cache).
+#   VRAM impact is negligible — always pinned via sleep-idle-seconds=-1.
+#   The 4 generative models remain unchanged (OOM analysis unchanged from t_55c164f5).
+#
+# Usage (from ~/git/homelab/ansible):
+#   env -u ANSIBLE_VAULT_PASSWORD_FILE ansible-playbook -i inventory.yml \
+#     playbooks/day2_add_nomic_embed.yml
+#
+# Semaphore note: Semaphore SSH key for jarvis user is not loaded in the
+# container (known pitfall, homelab-llm-serving skill). Run via CLI with
+# id_jarvis key; document as exception per Ryan's standing CLI fallback directive.
+#
+# Author: War Machine (2026-08-13, t_34b96e83)
+# ------------------------------------------------------------------------------
+
+- name: "Add nomic-embed-text-v1.5 embedding model to astro-orbiter router"
+  hosts: astro_orbiter
+  gather_facts: false
+  become: true
+
+  vars:
+    # Activate preset mode
+    llm_router_preset_enabled: true
+    llm_router_preset_path: /opt/llama-server-router-preset.ini
+
+    # Production port (router is on 8002 since t_cd0d5388)
+    llm_router_port: 8002
+
+    # Per-model ctx-size settings (carried from t_55c164f5; nomic new)
+    llm_router_llama_ctx_size: 8192
+    llm_router_llama_flash_attn: "true"
+    llm_router_phi_ctx_size: 32768
+    llm_router_phi_flash_attn: "true"
+    llm_router_coder_ctx_size: 16384
+    llm_router_coder_flash_attn: "true"
+    llm_router_nomic_ctx_size: 8192
+    # NOTE (2026-08-14, t_openviking_embed_batch): per-model batch-size/
+    # ubatch-size lines in the preset INI are NOT honored by llama-server's
+    # router — only ctx-size is applied per-model; batch-size/ubatch-size for
+    # every spawned child come from the router's own global CLI flags
+    # (confirmed via `ps aux` on astro-orbiter: child process launched with
+    # the router's --batch-size/--ubatch-size regardless of the INI values).
+    # Kept below for documentation/future-proofing but the REAL fix is the
+    # global llm_router_batch_size / llm_router_ubatch_size override further
+    # down, which raises the physical batch for ALL models on this router
+    # (Qwen3.6-35B, Phi, Llama, Coder, nomic).
+    llm_router_nomic_batch_size: 4096
+    llm_router_nomic_ubatch_size: 4096
+
+    # All other vars inherit from host_vars + defaults/main.yml.
+    llm_router_enabled: true
+    llm_service_user: jarvis
+    llm_binary_path: /opt/llama.cpp/build/bin/llama-server
+    llm_models_dir: /opt/models
+    llm_bind_address: "10.1.71.130"
+    llm_allowed_source_cidr: "10.1.70.0/24"
+    llm_router_service_name: llama-server-router
+    llm_router_bind_address: "10.1.71.130"
+    llm_router_allowed_source_cidr: "10.1.70.0/24"
+    llm_router_models_dir: /opt/models
+    llm_router_models_max: 4            # from host_vars; bumped by t_33acbb2e
+    llm_router_ctx_size: 65536          # Qwen3.6-35B default; per-model overrides above
+    llm_router_parallel: 1
+    llm_router_gpu_layers: 99
+    # FIX (2026-08-14, t_openviking_embed_batch): raised from 512 to 4096.
+    # This is a GLOBAL router flag applied to every spawned model process
+    # (per-model INI batch-size/ubatch-size overrides are not honored by
+    # llama-server's router — see note above nomic vars). 512 tokens was too
+    # small for OpenViking's chunked-document embedding inputs (observed
+    # 2000-3400 tokens/chunk), causing hard 500 errors ("input (N tokens) is
+    # too large to process") that tripped OpenViking's circuit breaker into a
+    # permanent fail/re-enqueue loop. 4096 comfortably covers observed chunk
+    # sizes and stays under nomic's ctx-size=8192. VRAM impact of raising
+    # ubatch-size is in compute-buffer scratch space, not KV cache; monitored
+    # post-deploy against the 23000 MiB budget (host_vars/astro-orbiter).
+    llm_router_batch_size: 4096
+    llm_router_ubatch_size: 4096
+    llm_router_cache_type_k: q4_0
+    llm_router_cache_type_v: q4_0
+    llm_router_flash_attn: "auto"
+    llm_router_expected_model_id: "Qwen3.6-35B-A3B-UD-Q4_K_S"
+    llm_router_vram_max_mib: 23000
+
+    # nomic model staging
+    nomic_filename: "nomic-embed-text-v1.5-Q4_K_M.gguf"
+    nomic_url: "https://huggingface.co/nomic-ai/nomic-embed-text-v1.5-GGUF/resolve/main/nomic-embed-text-v1.5.Q4_K_M.gguf"
+    nomic_size_bytes: 84106624
+
+  handlers:
+    - name: reload systemd
+      ansible.builtin.systemd:
+        daemon_reload: true
+      become: true
+      listen: "reload systemd"
+
+    - name: restart router
+      ansible.builtin.systemd:
+        name: llama-server-router
+        state: restarted
+      become: true
+      listen: "restart router"
+
+  tasks:
+
+    # ==========================================================================
+    # PHASE 1: Download nomic GGUF if not present / size mismatch
+    # ==========================================================================
+
+    - name: "[nomic] Stat existing GGUF"
+      ansible.builtin.stat:
+        path: "{{ llm_models_dir }}/{{ nomic_filename }}"
+        get_checksum: false
+      register: nomic_stat
+
+    - name: "[nomic] Download GGUF (skip if present and size matches)"
+      ansible.builtin.get_url:
+        url: "{{ nomic_url }}"
+        dest: "{{ llm_models_dir }}/{{ nomic_filename }}"
+        owner: "{{ llm_service_user }}"
+        group: "{{ llm_service_user }}"
+        mode: "0644"
+        timeout: 300
+      when: >
+        not nomic_stat.stat.exists or
+        nomic_stat.stat.size != nomic_size_bytes
+      register: nomic_download
+      notify: restart router
+
+    - name: "[nomic] Confirm GGUF size post-download"
+      ansible.builtin.stat:
+        path: "{{ llm_models_dir }}/{{ nomic_filename }}"
+        get_checksum: false
+      register: nomic_stat_post
+
+    - name: "[nomic] FAIL if GGUF size mismatch after download"
+      ansible.builtin.fail:
+        msg: >-
+          GGUF size mismatch: expected {{ nomic_size_bytes }} bytes,
+          got {{ nomic_stat_post.stat.size }} bytes.
+          Re-download may be needed.
+      when: nomic_stat_post.stat.size != nomic_size_bytes
+
+    # ==========================================================================
+    # PHASE 2: Deploy updated preset INI (adds nomic-embed-text-v1.5 section)
+    # ==========================================================================
+
+    - name: "[nomic] Deploy preset INI to {{ llm_router_preset_path }}"
+      ansible.builtin.template:
+        src: "../roles/llm-inference-multimodel/templates/llama-server-router-preset.ini.j2"
+        dest: "{{ llm_router_preset_path }}"
+        owner: root
+        group: root
+        mode: "0644"
+      register: nomic_preset_deployed
+      notify: restart router
+
+    # ==========================================================================
+    # PHASE 3: Redeploy systemd unit (ensures unit is fresh; no flag changes)
+    # ==========================================================================
+
+    - name: "[nomic] Deploy llama-server-router unit"
+      ansible.builtin.template:
+        src: "../roles/llm-inference-multimodel/templates/llama-server-router.service.j2"
+        dest: /etc/systemd/system/llama-server-router.service
+        owner: root
+        group: root
+        mode: "0644"
+      register: nomic_unit_deployed
+      notify:
+        - reload systemd
+        - restart router
+
+    - name: "[nomic] Flush handlers (daemon-reload + router restart)"
+      ansible.builtin.meta: flush_handlers
+
+    # ==========================================================================
+    # PHASE 4: Verify router is up and nomic model appears in /v1/models
+    # ==========================================================================
+
+    - name: "[nomic] Wait for /health (router supervisor)"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/health"
+        status_code: 200
+        timeout: 30
+      retries: 12
+      delay: 5
+      register: nomic_health
+      until: nomic_health.status == 200
+
+    - name: "[nomic] Query /v1/models"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/models"
+        status_code: 200
+        return_content: true
+        timeout: 30
+      register: nomic_models
+
+    - name: "[nomic] Extract model IDs and aliases"
+      ansible.builtin.set_fact:
+        nomic_model_ids: "{{ nomic_models.json.data | map(attribute='id') | list }}"
+        nomic_all_aliases: "{{ nomic_models.json.data | map(attribute='aliases') | flatten | list }}"
+
+    - name: "[nomic] FAIL if nomic primary ID missing"
+      ansible.builtin.fail:
+        msg: >-
+          'nomic-embed-text-v1.5' not in /v1/models.
+          IDs: {{ nomic_model_ids }}
+      when: "'nomic-embed-text-v1.5' not in nomic_model_ids"
+
+    - name: "[nomic] FAIL if Qwen3.6-35B missing"
+      ansible.builtin.fail:
+        msg: "'Qwen3.6-35B-A3B-UD-Q4_K_S' not in /v1/models. IDs: {{ nomic_model_ids }}"
+      when: "'Qwen3.6-35B-A3B-UD-Q4_K_S' not in nomic_model_ids"
+
+    - name: "[nomic] FAIL if Phi missing"
+      ansible.builtin.fail:
+        msg: "'Phi-3.5-mini-instruct-Q8_0' not in /v1/models. IDs: {{ nomic_model_ids }}"
+      when: "'Phi-3.5-mini-instruct-Q8_0' not in nomic_model_ids"
+
+    - name: "[nomic] FAIL if Llama missing"
+      ansible.builtin.fail:
+        msg: "'Meta-Llama-3.1-8B-Instruct-Q4_K_M' not in /v1/models. IDs: {{ nomic_model_ids }}"
+      when: "'Meta-Llama-3.1-8B-Instruct-Q4_K_M' not in nomic_model_ids"
+
+    - name: "[nomic] FAIL if Coder missing"
+      ansible.builtin.fail:
+        msg: "'Qwen2.5-Coder-14B-Instruct-Q4_K_M' not in /v1/models. IDs: {{ nomic_model_ids }}"
+      when: "'Qwen2.5-Coder-14B-Instruct-Q4_K_M' not in nomic_model_ids"
+
+    # ==========================================================================
+    # PHASE 5: /v1/embeddings smoke test — confirm model actually embeds
+    # ==========================================================================
+
+    - name: "[nomic] POST /v1/embeddings smoke test"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/embeddings"
+        method: POST
+        body_format: json
+        body:
+          model: "nomic-embed-text-v1.5"
+          input: "The dog ran across the park."
+        status_code: 200
+        return_content: true
+        timeout: 120
+      register: nomic_embed_result
+
+    - name: "[nomic] Extract embedding vector length"
+      ansible.builtin.set_fact:
+        nomic_embed_dims: >-
+          {{ (nomic_embed_result.json.data | first).embedding | length }}
+      when:
+        - nomic_embed_result.status == 200
+        - nomic_embed_result.json.data is defined
+        - nomic_embed_result.json.data | length > 0
+
+    - name: "[nomic] FAIL if embedding vector is empty or missing"
+      ansible.builtin.fail:
+        msg: >-
+          Embedding smoke test returned no vector.
+          Response: {{ nomic_embed_result.json }}
+      when: >-
+        nomic_embed_result.status != 200 or
+        nomic_embed_result.json.data is not defined or
+        nomic_embed_result.json.data | length == 0 or
+        (nomic_embed_result.json.data | first).embedding | length == 0
+
+    - name: "[nomic] PASS — full summary"
+      ansible.builtin.debug:
+        msg:
+          - "========================================================================"
+          - "NOMIC-EMBED-TEXT-V1.5 DEPLOYMENT — COMPLETE"
+          - ""
+          - "  Mode:     --models-preset ({{ llm_router_preset_path }})"
+          - "  Service:  llama-server-router.service (:{{ llm_router_port }})"
+          - ""
+          - "  /v1/models IDs:     {{ nomic_model_ids }}"
+          - ""
+          - "  VERIFY:"
+          - "  Qwen3.6-35B-A3B-UD-Q4_K_S:          {{ 'PRESENT' if 'Qwen3.6-35B-A3B-UD-Q4_K_S' in nomic_model_ids else 'MISSING' }}"
+          - "  Phi-3.5-mini-instruct-Q8_0:          {{ 'PRESENT' if 'Phi-3.5-mini-instruct-Q8_0' in nomic_model_ids else 'MISSING' }}"
+          - "  Meta-Llama-3.1-8B-Instruct-Q4_K_M:  {{ 'PRESENT' if 'Meta-Llama-3.1-8B-Instruct-Q4_K_M' in nomic_model_ids else 'MISSING' }}"
+          - "  Qwen2.5-Coder-14B-Instruct-Q4_K_M:  {{ 'PRESENT' if 'Qwen2.5-Coder-14B-Instruct-Q4_K_M' in nomic_model_ids else 'MISSING' }}"
+          - "  nomic-embed-text-v1.5:               {{ 'PRESENT' if 'nomic-embed-text-v1.5' in nomic_model_ids else 'MISSING' }}"
+          - ""
+          - "  Embedding smoke test: PASS"
+          - "  Vector dimensions: {{ nomic_embed_dims | default('unknown') }}"
+          - ""
+          - "  GGUF download: {{ 'NEW DOWNLOAD' if (nomic_download is defined and nomic_download.changed) else 'ALREADY PRESENT (skipped)' }}"
+          - "========================================================================"

ansible/playbooks/day2_add_phi_alias.yml

@@ -0,0 +1,203 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/day2_add_phi_alias.yml
+# DESCRIPTION: Add Phi-3.5-mini-instruct-8bit alias to the llama-server-router
+#              by switching from --models-dir to --models-preset INI mode.
+#
+# Context (t_9adf0889, 2026-08-12):
+#   Ryan's Hermes config (auxiliary.title_generation.model) points to
+#   "Phi-3.5-mini-instruct-8bit" but the router only exposes the GGUF
+#   filename-derived ID "Phi-3.5-mini-instruct-Q8_0". They are the same file.
+#   This playbook adds the alias so both names work without changing Ryan's
+#   Hermes config.
+#
+# What this playbook does:
+#   1. Deploys the preset INI template (llama-server-router-preset.ini.j2)
+#      to /opt/llama-server-router-preset.ini on astro-orbiter.
+#   2. Redeploys the systemd unit (llama-server-router.service) with
+#      --models-preset instead of --models-dir.
+#   3. Restarts llama-server-router to pick up the new flag.
+#   4. Verifies that /v1/models returns:
+#      - Phi-3.5-mini-instruct-Q8_0 (original ID — must still work)
+#      - Phi-3.5-mini-instruct-8bit (new alias — Ryan's config target)
+#      - Qwen3.6-35B-A3B-UD-Q4_K_S (unchanged)
+#      - Meta-Llama-3.1-8B-Instruct-Q4_K_M (unchanged)
+#
+# Known upstream behavior:
+#   GH #22364: --models-preset creates an extra "default" entry in /v1/models.
+#   This is cosmetic only and does not affect model selection by name.
+#
+# Usage (from ~/git/homelab/ansible):
+#   ansible-playbook -i inventory.yml playbooks/day2_add_phi_alias.yml
+#
+# Semaphore note (t_9adf0889): Semaphore SSH key for jarvis user is not loaded
+# in the container (known pitfall, homelab-llm-serving skill). Run via CLI with
+# id_jarvis key; document as exception per Ryan's standing CLI fallback directive.
+#
+# Author: War Machine (2026-08-12, t_9adf0889)
+# ------------------------------------------------------------------------------
+
+- name: "Add Phi-3.5-mini-instruct-8bit alias — switch router to preset mode"
+  hosts: astro_orbiter
+  gather_facts: false
+  become: true
+
+  vars:
+    # Activate preset mode and provide the on-disk INI path
+    llm_router_preset_enabled: true
+    llm_router_preset_path: /opt/llama-server-router-preset.ini
+
+    # Production port (router is already on 8002 since t_cd0d5388)
+    llm_router_port: 8002
+
+    # All other vars inherit from host_vars + defaults/main.yml.
+    # Explicitly set the ones needed by the unit template for clarity:
+    llm_router_enabled: true
+    llm_service_user: jarvis
+    llm_binary_path: /opt/llama.cpp/build/bin/llama-server
+    llm_models_dir: /opt/models
+    llm_bind_address: "10.1.71.130"
+    llm_allowed_source_cidr: "10.1.70.0/24"
+    llm_router_service_name: llama-server-router
+    llm_router_bind_address: "10.1.71.130"
+    llm_router_allowed_source_cidr: "10.1.70.0/24"
+    llm_router_models_dir: /opt/models
+    llm_router_models_max: 4            # from host_vars; bumped by t_33acbb2e
+    llm_router_ctx_size: 65536
+    llm_router_parallel: 1
+    llm_router_gpu_layers: 99
+    llm_router_batch_size: 2048
+    llm_router_ubatch_size: 512
+    llm_router_cache_type_k: q4_0
+    llm_router_cache_type_v: q4_0
+    llm_router_flash_attn: "auto"
+    llm_router_expected_model_id: "Qwen3.6-35B-A3B-UD-Q4_K_S"
+    llm_router_vram_max_mib: 23000
+
+  handlers:
+    - name: reload systemd
+      ansible.builtin.systemd:
+        daemon_reload: true
+      become: true
+      listen: "reload systemd"
+
+    - name: restart router
+      ansible.builtin.systemd:
+        name: llama-server-router
+        state: restarted
+      become: true
+      listen: "restart router"
+
+  tasks:
+
+    # ==========================================================================
+    # PHASE 1: Deploy the preset INI
+    # ==========================================================================
+
+    - name: "[phi-alias] Deploy preset INI to {{ llm_router_preset_path }}"
+      ansible.builtin.template:
+        src: "../roles/llm-inference-multimodel/templates/llama-server-router-preset.ini.j2"
+        dest: "{{ llm_router_preset_path }}"
+        owner: root
+        group: root
+        mode: "0644"
+      register: phi_alias_preset_deployed
+      notify:
+        - restart router
+
+    # ==========================================================================
+    # PHASE 2: Redeploy systemd unit with --models-preset flag
+    # ==========================================================================
+
+    - name: "[phi-alias] Deploy llama-server-router unit (--models-preset mode)"
+      ansible.builtin.template:
+        src: "../roles/llm-inference-multimodel/templates/llama-server-router.service.j2"
+        dest: /etc/systemd/system/llama-server-router.service
+        owner: root
+        group: root
+        mode: "0644"
+      register: phi_alias_unit_deployed
+      notify:
+        - reload systemd
+        - restart router
+
+    - name: "[phi-alias] Flush handlers (daemon-reload + router restart)"
+      ansible.builtin.meta: flush_handlers
+
+    # ==========================================================================
+    # PHASE 3: Verify alias is present
+    # ==========================================================================
+
+    - name: "[phi-alias] Wait for /health (router supervisor, no model needed)"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/health"
+        status_code: 200
+        timeout: 30
+      retries: 12
+      delay: 5
+      register: phi_alias_health
+      until: phi_alias_health.status == 200
+
+    - name: "[phi-alias] Query /v1/models"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/models"
+        status_code: 200
+        return_content: true
+        timeout: 30
+      register: phi_alias_models
+
+    - name: "[phi-alias] Extract model IDs and aliases"
+      ansible.builtin.set_fact:
+        phi_alias_model_ids: "{{ phi_alias_models.json.data | map(attribute='id') | list }}"
+        phi_alias_all_aliases: "{{ phi_alias_models.json.data | map(attribute='aliases') | flatten | list }}"
+        phi_alias_model_sources: "{{ phi_alias_models.json.data | map(attribute='source') | list }}"
+
+    - name: "[phi-alias] FAIL if Phi original ID missing"
+      ansible.builtin.fail:
+        msg: >-
+          'Phi-3.5-mini-instruct-Q8_0' not in /v1/models.
+          IDs: {{ phi_alias_model_ids }}
+      when: "'Phi-3.5-mini-instruct-Q8_0' not in phi_alias_model_ids"
+
+    - name: "[phi-alias] FAIL if Phi alias missing"
+      ansible.builtin.fail:
+        msg: >-
+          'Phi-3.5-mini-instruct-8bit' not found as ID or alias in /v1/models.
+          IDs:     {{ phi_alias_model_ids }}
+          Aliases: {{ phi_alias_all_aliases }}
+      when:
+        - "'Phi-3.5-mini-instruct-8bit' not in phi_alias_model_ids"
+        - "'Phi-3.5-mini-instruct-8bit' not in phi_alias_all_aliases"
+
+    - name: "[phi-alias] FAIL if Qwen missing"
+      ansible.builtin.fail:
+        msg: "'Qwen3.6-35B-A3B-UD-Q4_K_S' not in /v1/models. IDs: {{ phi_alias_model_ids }}"
+      when: "'Qwen3.6-35B-A3B-UD-Q4_K_S' not in phi_alias_model_ids"
+
+    - name: "[phi-alias] FAIL if Llama missing"
+      ansible.builtin.fail:
+        msg: "'Meta-Llama-3.1-8B-Instruct-Q4_K_M' not in /v1/models. IDs: {{ phi_alias_model_ids }}"
+      when: "'Meta-Llama-3.1-8B-Instruct-Q4_K_M' not in phi_alias_model_ids"
+
+    - name: "[phi-alias] PASS — full /v1/models summary"
+      ansible.builtin.debug:
+        msg:
+          - "========================================================================"
+          - "PHI ALIAS DEPLOYMENT — COMPLETE"
+          - ""
+          - "  Mode:     --models-preset ({{ llm_router_preset_path }})"
+          - "  Service:  llama-server-router.service (:{{ llm_router_port }})"
+          - ""
+          - "  /v1/models IDs:     {{ phi_alias_model_ids }}"
+          - "  /v1/models aliases: {{ phi_alias_all_aliases }}"
+          - "  Sources:            {{ phi_alias_model_sources }}"
+          - ""
+          - "  VERIFY:"
+          - "  Phi-3.5-mini-instruct-Q8_0:  {{ 'PRESENT' if 'Phi-3.5-mini-instruct-Q8_0' in phi_alias_model_ids else 'MISSING' }}"
+          - "  Phi-3.5-mini-instruct-8bit:  {{ 'PRESENT (ID)' if 'Phi-3.5-mini-instruct-8bit' in phi_alias_model_ids else ('PRESENT (alias)' if 'Phi-3.5-mini-instruct-8bit' in phi_alias_all_aliases else 'MISSING') }}"
+          - "  Qwen3.6-35B-A3B-UD-Q4_K_S:  {{ 'PRESENT' if 'Qwen3.6-35B-A3B-UD-Q4_K_S' in phi_alias_model_ids else 'MISSING' }}"
+          - "  Meta-Llama-3.1-8B-Instruct-Q4_K_M: {{ 'PRESENT' if 'Meta-Llama-3.1-8B-Instruct-Q4_K_M' in phi_alias_model_ids else 'MISSING' }}"
+          - ""
+          - "  GH #22364: if 'default' appears in IDs above, that is expected"
+          - "  in --models-preset mode. Cosmetic only."
+          - "========================================================================"

ansible/playbooks/day2_bump_router_models_max.yml

@@ -0,0 +1,161 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/day2_bump_router_models_max.yml
+# DESCRIPTION: Bump --models-max on the production llama-server-router unit.
+#
+# Context: t_33acbb2e (2026-08-12) — Ryan requested --models-max raised from 1
+# to 4 so the router can keep multiple GGUFs resident on-demand (LRU eviction
+# when the cap is reached). The actual var change lives in:
+#   host_vars/astro-orbiter/vars.yml  (llm_router_models_max: 4)
+#
+# This playbook:
+#   1. Re-renders llama-server-router.service.j2 with the updated var value.
+#   2. Reloads systemd (daemon-reload handler) if the unit changed.
+#   3. Restarts llama-server-router so the new --models-max takes effect on the
+#      live process. Router holds no resident model (all-unloaded) so restart
+#      is sub-second and non-disruptive.
+#   4. Verifies /health returns 200 and /v1/models still lists all three GGUFs.
+#
+# VRAM NOTE: --models-max 4 allows up to all 3 current GGUFs to co-reside on
+# a 24GB card simultaneously. Worst-case combined footprint is ~31GB which
+# EXCEEDS 24GB — OOM is possible if all 3 are loaded concurrently. In normal
+# single-user homelab operation this is very unlikely. Full VRAM breakdown
+# documented in host_vars/astro-orbiter/vars.yml. Ryan approved (t_33acbb2e).
+#
+# Execution channel: Semaphore template "llm_router_update_unit" (project mk-labs).
+# Do NOT run via direct ansible-playbook or ad-hoc ssh/systemctl.
+#
+# Author: War Machine (2026-08-12, t_33acbb2e)
+# ------------------------------------------------------------------------------
+
+- name: "Bump llama-server-router --models-max to 4 on astro-orbiter"
+  hosts: astro_orbiter
+  gather_facts: true
+  become: true
+
+  vars:
+    # Production vars — router is live on :8002 (post-cutover t_cd0d5388)
+    llm_router_port: 8002
+    llm_router_bind_address: "10.1.71.130"
+
+    # llm_router_models_max is 4 via host_vars/astro-orbiter/vars.yml.
+    # Remaining role vars come from host_vars + defaults/main.yml via the
+    # inventory — we only explicitly set vars this playbook needs for its
+    # own tasks (health/models check URIs).
+
+    # Needed by the template task (mirrors defaults set in role defaults/main.yml)
+    llm_service_user: jarvis
+    llm_binary_path: /opt/llama.cpp/build/bin/llama-server
+    llm_models_dir: /opt/models
+    llm_router_service_name: llama-server-router
+    llm_router_models_dir: /opt/models
+    llm_router_gpu_layers: 99
+    llm_router_ctx_size: 65536
+    llm_router_flash_attn: "auto"
+    llm_router_cache_type_k: q4_0
+    llm_router_cache_type_v: q4_0
+    llm_router_batch_size: 2048
+    llm_router_ubatch_size: 512
+    llm_router_parallel: 1
+
+  tasks:
+    # -------------------------------------------------------------------------
+    # Phase 1: Re-render the router unit file
+    # Template src path is relative to the role's templates/ dir; we reference
+    # it with a relative path that Ansible resolves from the role directory.
+    # -------------------------------------------------------------------------
+
+    - name: "Deploy updated llama-server-router unit (--models-max {{ llm_router_models_max }})"
+      ansible.builtin.template:
+        src: "{{ playbook_dir }}/../roles/llm-inference-multimodel/templates/llama-server-router.service.j2"
+        dest: "/etc/systemd/system/{{ llm_router_service_name }}.service"
+        owner: root
+        group: root
+        mode: "0644"
+      register: llm_router_unit_updated
+      notify:
+        - reload systemd
+      tags: [always]
+
+    - name: "Flush handlers — ensure daemon-reload lands before restart"
+      ansible.builtin.meta: flush_handlers
+      tags: [always]
+
+    # -------------------------------------------------------------------------
+    # Phase 2: Restart the router so the new --models-max takes effect.
+    # Always restart (even if unit unchanged) to ensure live process matches.
+    # -------------------------------------------------------------------------
+
+    - name: "Restart llama-server-router so --models-max {{ llm_router_models_max }} takes effect"
+      ansible.builtin.systemd:
+        name: "{{ llm_router_service_name }}"
+        state: restarted
+        enabled: true
+      tags: [always]
+
+    # -------------------------------------------------------------------------
+    # Phase 3: Verify /health returns 200
+    # -------------------------------------------------------------------------
+
+    - name: "Wait for /health to return 200 after restart"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/health"
+        status_code: 200
+        timeout: 30
+      register: bump_health_check
+      retries: 10
+      delay: 3
+      until: bump_health_check.status == 200
+      tags: [always]
+
+    # -------------------------------------------------------------------------
+    # Phase 4: Verify /v1/models lists all three GGUFs
+    # -------------------------------------------------------------------------
+
+    - name: "Check /v1/models — all three GGUFs should appear"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/models"
+        status_code: 200
+        timeout: 30
+        return_content: true
+      register: bump_models_check
+      tags: [always]
+
+    - name: "Display /v1/models summary"
+      ansible.builtin.debug:
+        msg:
+          - "======================================================================"
+          - "--models-max BUMP VERIFICATION (t_33acbb2e)"
+          - ""
+          - "  /health:               HTTP {{ bump_health_check.status }}"
+          - "  /v1/models HTTP:       {{ bump_models_check.status }}"
+          - "  Models listed:         {{ bump_models_check.json.data | map(attribute='id') | list | join(', ') }}"
+          - ""
+          - "  --models-max now:      {{ llm_router_models_max }}"
+          - "  --parallel (unchanged): {{ llm_router_parallel }}"
+          - ""
+          - "  VRAM WARNING: worst-case 3-model co-residency ~31GB > 24GB RTX 3090."
+          - "  OOM risk if all 3 load concurrently. LRU eviction mitigates in practice."
+          - "  Full breakdown: host_vars/astro-orbiter/vars.yml"
+          - "======================================================================"
+      when: bump_models_check is defined
+      tags: [always]
+
+    - name: "GATE: confirm all 3 expected GGUFs appear in /v1/models"
+      ansible.builtin.assert:
+        that:
+          - "'Qwen3.6-35B-A3B-UD-Q4_K_S' in (bump_models_check.json.data | map(attribute='id') | list)"
+          - "'Phi-3.5-mini-instruct-Q8_0' in (bump_models_check.json.data | map(attribute='id') | list)"
+          - "'Meta-Llama-3.1-8B-Instruct-Q4_K_M' in (bump_models_check.json.data | map(attribute='id') | list)"
+        fail_msg: >-
+          /v1/models did not return all 3 expected GGUFs after --models-max bump.
+          Check router logs: journalctl -u llama-server-router -n 50
+        success_msg: "GATE PASSED: all 3 GGUFs listed in /v1/models."
+      when: bump_models_check is defined
+      tags: [always]
+
+  handlers:
+    - name: reload systemd
+      ansible.builtin.systemd:
+        daemon_reload: true
+      listen: "reload systemd"

ansible/playbooks/day2_cutover_qwen_to_router.yml

@@ -0,0 +1,511 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/day2_cutover_qwen_to_router.yml
+# DESCRIPTION: Promote llama-server-router to production on port 8002.
+#
+# Context: Router-mode shadow deployment (t_0cca74a2) validated 2026-08-12:
+#   all 4 hard gates PASSED (n_ctx 65536, tool-calling PASS, hallucination-stress
+#   PASS, VRAM 20410 MiB / 1 process). Ryan approved cutover.
+#
+# This playbook makes the router the permanent production endpoint:
+#
+#   1. Stop + disable llama-server-qwen (:8002). Unit file is PRESERVED on disk
+#      as the rollback target (same pattern as prior role history).
+#   2. Redeploy llama-server-router unit file with --port 8002 (production port).
+#      PORT DECISION: we rebind the router to :8002 rather than updating 8
+#      dependent Hermes profiles' base_url. One unit file change beats 8
+#      config.yaml updates — atomic, GitOps-clean, zero profile drift.
+#   3. Enable + start llama-server-router on :8002.
+#   4. Re-run validation gates 1-3 against the NOW-production endpoint.
+#      (Same logic as Phase R / router_verify in tasks/router.yml — hard gates.)
+#   5. Run Gate 4: verify bundled SvelteKit UI is reachable.
+#
+# Usage (from ~/git/homelab/ansible):
+#   ansible-playbook -i inventory.yml playbooks/day2_cutover_qwen_to_router.yml
+#
+# Rollback (if gates fail or any time after):
+#   ansible-playbook -i inventory.yml playbooks/day2_cutover_qwen_to_router.yml \
+#     --tags cutover_rollback
+#
+# Author: War Machine (2026-08-12, t_cd0d5388)
+# Approved by: Ryan (cutover authorization, 2026-08-12)
+# ------------------------------------------------------------------------------
+
+- name: "CUTOVER — Promote llama-server-router to production (:8002) on astro-orbiter"
+  hosts: astro_orbiter
+  gather_facts: true
+  become: true
+
+  vars:
+    # ----------------------------------------------------------------
+    # PORT DECISION:
+    # We rebind the router to :8002 (production port) rather than
+    # updating 8 dependent Hermes profiles' base_url to :8003.
+    # Rationale: one unit file change is atomic and GitOps-clean.
+    # Updating 8 config.yaml files risks drift and requires per-profile
+    # activation tests. The template renders llm_router_port as the
+    # --port argument; we just override it here to 8002.
+    # ----------------------------------------------------------------
+
+    # Router port override: take over production port
+    llm_router_port: 8002
+
+    # All other role defaults needed by the template (mirrors defaults/main.yml)
+    llm_service_user: jarvis
+    llm_binary_path: /opt/llama.cpp/build/bin/llama-server
+    llm_models_dir: /opt/models
+    llm_bind_address: "10.1.71.130"
+    llm_allowed_source_cidr: "10.1.70.0/24"
+
+    llm_router_enabled: true
+    llm_router_service_name: llama-server-router
+    llm_router_models_dir: /opt/models
+    llm_router_models_max: 1               # CRITICAL: RTX 3090 24GB, single model only
+    llm_router_ctx_size: 65536
+    llm_router_parallel: 1
+    llm_router_gpu_layers: 99
+    llm_router_batch_size: 2048
+    llm_router_ubatch_size: 512
+    llm_router_cache_type_k: q4_0
+    llm_router_cache_type_v: q4_0
+    llm_router_flash_attn: "auto"
+    llm_router_bind_address: "10.1.71.130"
+    llm_router_allowed_source_cidr: "10.1.70.0/24"
+    llm_router_expected_model_id: "Qwen3.6-35B-A3B-UD-Q4_K_S"
+    llm_router_vram_max_mib: 23000
+
+    llm_qwen_service_name: llama-server-qwen
+    llm_qwen_port: 8002
+
+  tasks:
+
+    # =======================================================================
+    # PHASE 1 — Stop and disable llama-server-qwen (bare single-model)
+    # Preserve unit file on disk — rollback target per existing role pattern.
+    # =======================================================================
+
+    - name: "[cutover] PHASE 1: Confirm llama-server-qwen current state"
+      ansible.builtin.systemd:
+        name: llama-server-qwen
+      register: cutover_qwen_status
+      tags: [cutover_stop_qwen, cutover]
+
+    - name: "[cutover] PHASE 1: Report current llama-server-qwen status"
+      ansible.builtin.debug:
+        msg: >-
+          llama-server-qwen: ActiveState={{ cutover_qwen_status.status.ActiveState | default('unknown') }},
+          UnitFileState={{ cutover_qwen_status.status.UnitFileState | default('unknown') }}.
+          Will stop + disable. Unit file preserved at /etc/systemd/system/llama-server-qwen.service as rollback target.
+      tags: [cutover_stop_qwen, cutover]
+
+    - name: "[cutover] PHASE 1: Stop llama-server-qwen (:8002, bare single-model)"
+      ansible.builtin.systemd:
+        name: llama-server-qwen
+        state: stopped
+      register: cutover_qwen_stopped
+      tags: [cutover_stop_qwen, cutover]
+
+    - name: "[cutover] PHASE 1: Disable llama-server-qwen (prevent auto-start on reboot)"
+      ansible.builtin.systemd:
+        name: llama-server-qwen
+        enabled: false
+      tags: [cutover_stop_qwen, cutover]
+
+    - name: "[cutover] PHASE 1: Wait 5s for VRAM to be released"
+      ansible.builtin.pause:
+        seconds: 5
+      when: cutover_qwen_stopped.changed | default(false)
+      tags: [cutover_stop_qwen, cutover]
+
+    - name: "[cutover] PHASE 1: Verify port 8002 is now free"
+      ansible.builtin.command:
+        cmd: ss -ltnp
+      register: cutover_port_check
+      changed_when: false
+      tags: [cutover_stop_qwen, cutover]
+
+    - name: "[cutover] PHASE 1: Fail if port 8002 is still bound"
+      ansible.builtin.fail:
+        msg: >-
+          Port 8002 is still bound after stopping llama-server-qwen.
+          Check 'ss -ltnp | grep :8002' and resolve before the router can bind.
+      when:
+        - "':8002 ' in (cutover_port_check.stdout | default('')) or ':8002:' in (cutover_port_check.stdout | default(''))"
+      tags: [cutover_stop_qwen, cutover]
+
+    - name: "[cutover] PHASE 1: Report VRAM state (should be empty)"
+      ansible.builtin.command:
+        cmd: nvidia-smi --query-compute-apps=pid,name,used_memory --format=csv,noheader
+      register: cutover_vram_free_check
+      changed_when: false
+      tags: [cutover_stop_qwen, cutover]
+
+    - name: "[cutover] PHASE 1: Print VRAM state"
+      ansible.builtin.debug:
+        msg: >-
+          VRAM after stopping llama-server-qwen:
+          {{ cutover_vram_free_check.stdout if (cutover_vram_free_check.stdout | length > 0)
+             else '(no GPU processes — VRAM free)' }}
+      tags: [cutover_stop_qwen, cutover]
+
+    # =======================================================================
+    # PHASE 2 — Redeploy llama-server-router unit with --port 8002
+    # =======================================================================
+
+    - name: "[cutover] PHASE 2: Deploy llama-server-router unit file (port 8002 — production)"
+      ansible.builtin.template:
+        src: "../roles/llm-inference-multimodel/templates/llama-server-router.service.j2"
+        dest: /etc/systemd/system/llama-server-router.service
+        owner: root
+        group: root
+        mode: "0644"
+      register: cutover_router_unit_deployed
+      notify:
+        - reload systemd
+      tags: [cutover_deploy_unit, cutover]
+
+    - name: "[cutover] PHASE 2: Flush handlers (daemon-reload before start)"
+      ansible.builtin.meta: flush_handlers
+      tags: [cutover_deploy_unit, cutover]
+
+    # =======================================================================
+    # PHASE 3 — Enable + start llama-server-router on :8002
+    # =======================================================================
+
+    - name: "[cutover] PHASE 3: Enable + start llama-server-router (production, :8002)"
+      ansible.builtin.systemd:
+        name: llama-server-router
+        state: "{{ 'restarted' if (cutover_router_unit_deployed.changed | default(false)) else 'started' }}"
+        enabled: true
+        daemon_reload: true
+      tags: [cutover_start_router, cutover]
+
+    # =======================================================================
+    # PHASE 4 — Validation gates 1-3 (hard gates against now-production :8002)
+    # =======================================================================
+
+    - name: "[cutover] GATE 1a: Wait for router /health on :8002 (up to 5min — cold model load)"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/health"
+        status_code: 200
+      register: cutover_health
+      retries: 30
+      delay: 10
+      until: cutover_health.status == 200
+      tags: [cutover_validate, cutover]
+
+    - name: "[cutover] GATE 1a: Trigger model load (router lazy-loads on first request)"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/chat/completions"
+        method: POST
+        body_format: json
+        body:
+          model: "{{ llm_router_expected_model_id }}"
+          messages:
+            - role: user
+              content: "Reply with one word: hello"
+          max_tokens: 5
+          temperature: 0.0
+        status_code: 200
+        return_content: true
+        timeout: 300
+      register: cutover_warmup
+      tags: [cutover_validate, cutover]
+
+    - name: "[cutover] GATE 1a: Report warmup"
+      ansible.builtin.debug:
+        msg:
+          - "Model loaded. finish_reason={{ cutover_warmup.json.choices[0].finish_reason | default('unknown') }}"
+          - "Response: {{ cutover_warmup.json.choices[0].message.content | default('(empty)') | truncate(100) }}"
+      tags: [cutover_validate, cutover]
+
+    - name: "[cutover] GATE 1b: Query /v1/models on :8002"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/models"
+        status_code: 200
+        return_content: true
+      register: cutover_models
+      tags: [cutover_validate, cutover]
+
+    - name: "[cutover] GATE 1b: Fail if expected model ID not found"
+      ansible.builtin.fail:
+        msg: >-
+          GATE 1 FAIL: '{{ llm_router_expected_model_id }}' not found in /v1/models.
+          Returned: {{ cutover_models.json.data | map(attribute='id') | list }}
+      when:
+        - cutover_models.json.data | selectattr('id', 'equalto', llm_router_expected_model_id) | list | length == 0
+      tags: [cutover_validate, cutover]
+
+    - name: "[cutover] GATE 1b: Extract ctx-size from router model args"
+      ansible.builtin.set_fact:
+        cutover_qwen_n_ctx: >-
+          {%- set model = cutover_models.json.data | selectattr('id', 'equalto', llm_router_expected_model_id) | first -%}
+          {%- set args = model.status.args -%}
+          {%- set ctx_idx = args.index('--ctx-size') if '--ctx-size' in args else -1 -%}
+          {{ args[ctx_idx + 1] | int if ctx_idx >= 0 else 0 }}
+      when:
+        - cutover_models.json.data | selectattr('id', 'equalto', llm_router_expected_model_id) | list | length > 0
+      tags: [cutover_validate, cutover]
+
+    - name: "[cutover] GATE 1b: Fail if n_ctx < 64000"
+      ansible.builtin.fail:
+        msg: "GATE 1 FAIL: --ctx-size={{ cutover_qwen_n_ctx }} < 64000 (Hermes 64K floor)."
+      when:
+        - cutover_qwen_n_ctx is defined
+        - cutover_qwen_n_ctx | int < 64000
+      tags: [cutover_validate, cutover]
+
+    - name: "[cutover] GATE 1b: PASS — n_ctx >= 64K"
+      ansible.builtin.debug:
+        msg: "GATE 1 PASS: --ctx-size={{ cutover_qwen_n_ctx }} >= 64000."
+      when:
+        - cutover_qwen_n_ctx is defined
+        - cutover_qwen_n_ctx | int >= 64000
+      tags: [cutover_validate, cutover]
+
+    # --- Gate 2: Tool-calling through router proxy ---
+
+    - name: "[cutover] GATE 2: Tool-calling probe"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/chat/completions"
+        method: POST
+        body_format: json
+        body:
+          model: "{{ llm_router_expected_model_id }}"
+          messages:
+            - role: user
+              content: "What is the current weather in Chicago? Use the provided tool."
+          tools:
+            - type: function
+              function:
+                name: get_weather
+                description: "Get current weather conditions for a city"
+                parameters:
+                  type: object
+                  properties:
+                    city:
+                      type: string
+                      description: "The city name"
+                  required:
+                    - city
+          temperature: 0.0
+        status_code: 200
+        return_content: true
+        timeout: 120
+      register: cutover_toolcall_probe
+      tags: [cutover_validate, cutover]
+
+    - name: "[cutover] GATE 2: Fail if not finish_reason=tool_calls"
+      ansible.builtin.fail:
+        msg: >-
+          GATE 2 FAIL: finish_reason={{ cutover_toolcall_probe.json.choices[0].finish_reason | default('(missing)') }}
+          (expected tool_calls). Response: {{ cutover_toolcall_probe.json | to_json }}
+      when:
+        - cutover_toolcall_probe.json.choices[0].finish_reason | default('') != 'tool_calls'
+      tags: [cutover_validate, cutover]
+
+    - name: "[cutover] GATE 2: PASS"
+      ansible.builtin.debug:
+        msg:
+          - "GATE 2 PASS: finish_reason=tool_calls"
+          - "function: {{ cutover_toolcall_probe.json.choices[0].message.tool_calls[0].function.name | default('(unknown)') }}"
+          - "arguments: {{ cutover_toolcall_probe.json.choices[0].message.tool_calls[0].function.arguments | default('(none)') }}"
+      when:
+        - cutover_toolcall_probe.json.choices[0].finish_reason | default('') == 'tool_calls'
+      tags: [cutover_validate, cutover]
+
+    # --- Gate 2b: Hallucination stress ---
+
+    - name: "[cutover] GATE 2b: Hallucination stress probe"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/chat/completions"
+        method: POST
+        body_format: json
+        body:
+          model: "{{ llm_router_expected_model_id }}"
+          messages:
+            - role: user
+              content: "Tell me a brief fact about the planet Mars. Do not call any functions."
+          tools:
+            - type: function
+              function:
+                name: get_weather
+                description: "Get current weather conditions for a city"
+                parameters:
+                  type: object
+                  properties:
+                    city:
+                      type: string
+                  required:
+                    - city
+          temperature: 0.1
+        status_code: 200
+        return_content: true
+        timeout: 120
+      register: cutover_halluc_probe
+      tags: [cutover_validate, cutover]
+
+    - name: "[cutover] GATE 2b: Fail if spurious tool_calls"
+      ansible.builtin.fail:
+        msg: >-
+          GATE 2b FAIL: finish_reason=tool_calls on unrelated prompt (Mars fact).
+          Over-triggering through router. Response: {{ cutover_halluc_probe.json | to_json }}
+      when:
+        - cutover_halluc_probe.json.choices[0].finish_reason | default('') == 'tool_calls'
+      tags: [cutover_validate, cutover]
+
+    - name: "[cutover] GATE 2b: PASS"
+      ansible.builtin.debug:
+        msg: "GATE 2b PASS: finish_reason={{ cutover_halluc_probe.json.choices[0].finish_reason }} — no spurious tool_calls."
+      when:
+        - cutover_halluc_probe.json.choices[0].finish_reason | default('') != 'tool_calls'
+      tags: [cutover_validate, cutover]
+
+    # --- Gate 3: VRAM guard ---
+
+    - name: "[cutover] GATE 3: Check VRAM usage (--models-max 1 guard)"
+      ansible.builtin.command:
+        cmd: nvidia-smi --query-gpu=memory.used,memory.total,utilization.gpu --format=csv,noheader
+      register: cutover_vram_post
+      changed_when: false
+      tags: [cutover_validate, cutover]
+
+    - name: "[cutover] GATE 3: Parse VRAM used MiB"
+      ansible.builtin.set_fact:
+        cutover_vram_used_mib: "{{ cutover_vram_post.stdout.split(',')[0].strip().split(' ')[0] | int }}"
+      tags: [cutover_validate, cutover]
+
+    - name: "[cutover] GATE 3: Fail if VRAM exceeds ceiling"
+      ansible.builtin.fail:
+        msg: >-
+          GATE 3 FAIL: {{ cutover_vram_used_mib }} MiB > {{ llm_router_vram_max_mib }} MiB ceiling.
+          Full: {{ cutover_vram_post.stdout }}
+      when:
+        - cutover_vram_used_mib | int > llm_router_vram_max_mib | int
+      tags: [cutover_validate, cutover]
+
+    - name: "[cutover] GATE 3: Count GPU processes"
+      ansible.builtin.command:
+        cmd: nvidia-smi --query-compute-apps=pid,name --format=csv,noheader
+      register: cutover_gpu_procs
+      changed_when: false
+      failed_when: false
+      tags: [cutover_validate, cutover]
+
+    - name: "[cutover] GATE 3: PASS"
+      ansible.builtin.debug:
+        msg:
+          - "GATE 3 PASS: {{ cutover_vram_used_mib }} MiB / {{ llm_router_vram_max_mib }} MiB ceiling."
+          - "GPU processes: {{ cutover_gpu_procs.stdout_lines | default(['(none)']) }}"
+          - "Full nvidia-smi: {{ cutover_vram_post.stdout }}"
+      when:
+        - cutover_vram_used_mib | int <= llm_router_vram_max_mib | int
+      tags: [cutover_validate, cutover]
+
+    # =======================================================================
+    # PHASE 5 — Gate 4: Bundled SvelteKit Web UI (required this time)
+    # =======================================================================
+
+    - name: "[cutover] GATE 4: Check bundled SvelteKit UI at :8002"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/"
+        status_code: [200, 301, 302]
+        return_content: true
+        timeout: 30
+      register: cutover_ui_check
+      failed_when: false
+      tags: [cutover_validate, cutover_ui, cutover]
+
+    - name: "[cutover] GATE 4: Inspect UI content"
+      ansible.builtin.set_fact:
+        cutover_ui_is_html: "{{ 'html' in (cutover_ui_check.content | default('') | lower) or '<!doctype' in (cutover_ui_check.content | default('') | lower) }}"
+        cutover_ui_has_model_select: "{{ 'select' in (cutover_ui_check.content | default('') | lower) or 'model' in (cutover_ui_check.content | default('') | lower) }}"
+      when: cutover_ui_check is defined
+      tags: [cutover_validate, cutover_ui, cutover]
+
+    - name: "[cutover] GATE 4: Report UI check and bookmark URL"
+      ansible.builtin.debug:
+        msg:
+          - "======================================================================"
+          - "GATE 4 UI CHECK:"
+          - "  HTTP status:          {{ cutover_ui_check.status | default('UNREACHABLE') }}"
+          - "  Is HTML:              {{ cutover_ui_is_html | default(false) }}"
+          - "  Contains model/select: {{ cutover_ui_has_model_select | default(false) }}"
+          - "  BOOKMARK URL:         http://{{ llm_router_bind_address }}:{{ llm_router_port }}/"
+          - "  {{ 'GATE 4 PASS — UI serving HTML at :8002.' if (cutover_ui_check.status | default(0) | int in [200, 301, 302]) else 'GATE 4 WARN — UI not reachable (HTTP ' + (cutover_ui_check.status | default('FAIL') | string) + ').' }}"
+          - "======================================================================"
+      when: cutover_ui_check is defined
+      tags: [cutover_validate, cutover_ui, cutover]
+
+    # =======================================================================
+    # CUTOVER SUMMARY
+    # =======================================================================
+
+    - name: "[cutover] CUTOVER SUMMARY — production promoted"
+      ansible.builtin.debug:
+        msg:
+          - "======================================================================"
+          - "CUTOVER COMPLETE: llama-server-router is now production."
+          - ""
+          - "  Service:  llama-server-router.service (enabled, running)"
+          - "  Port:     8002 (unchanged for all 8 Hermes profiles)"
+          - "  Model:    {{ llm_router_expected_model_id }}"
+          - "  Mode:     Router/supervisor (--models-dir /opt/models, --models-max 1)"
+          - ""
+          - "  Gate 1 (n_ctx >= 64K):     PASS ({{ cutover_qwen_n_ctx | default('N/A') }})"
+          - "  Gate 2 (tool-calling):     PASS (finish_reason=tool_calls)"
+          - "  Gate 2b (halluc stress):   PASS (no spurious tool_calls)"
+          - "  Gate 3 (VRAM <= 23000MiB): PASS ({{ cutover_vram_used_mib | default('N/A') }} MiB)"
+          - "  Gate 4 (Web UI):           HTTP {{ cutover_ui_check.status | default('N/A') }}"
+          - ""
+          - "  ROLLBACK TARGET: /etc/systemd/system/llama-server-qwen.service (unit preserved)"
+          - "  ROLLBACK CMD: sudo systemctl enable --now llama-server-qwen"
+          - "               sudo systemctl disable --now llama-server-router"
+          - "  Or: ansible-playbook -i inventory.yml day2_cutover_qwen_to_router.yml --tags cutover_rollback"
+          - ""
+          - "  Web UI bookmark: http://{{ llm_router_bind_address }}:{{ llm_router_port }}/"
+          - "======================================================================"
+      tags: [cutover]
+
+    # =======================================================================
+    # ROLLBACK — tag cutover_rollback reverses the cutover
+    # Run: ansible-playbook -i inventory.yml day2_cutover_qwen_to_router.yml --tags cutover_rollback
+    # WARNING: rollback_task has no dependency on cutover tags — safe to run standalone.
+    # =======================================================================
+
+    - name: "[cutover_rollback] Stop + disable llama-server-router"
+      ansible.builtin.systemd:
+        name: llama-server-router
+        state: stopped
+        enabled: false
+      tags: [cutover_rollback, never]    # 'never' = only runs with explicit --tags cutover_rollback
+
+    - name: "[cutover_rollback] Enable + start llama-server-qwen (restore bare :8002)"
+      ansible.builtin.systemd:
+        name: llama-server-qwen
+        state: started
+        enabled: true
+      tags: [cutover_rollback, never]
+
+    - name: "[cutover_rollback] Verify rollback /health"
+      ansible.builtin.uri:
+        url: "http://{{ llm_bind_address | default('10.1.71.130') }}:8002/health"
+        status_code: 200
+        timeout: 30
+      register: cutover_rollback_health
+      failed_when: false
+      tags: [cutover_rollback, never]
+
+    - name: "[cutover_rollback] Report rollback result"
+      ansible.builtin.debug:
+        msg: >-
+          ROLLBACK: llama-server-qwen :8002 health returned
+          {{ cutover_rollback_health.status | default('UNREACHABLE') }}.
+          {{ 'OK — production restored to bare qwen.' if (cutover_rollback_health.status | default(0) | int == 200)
+             else 'WARNING — health check failed. Check manually.' }}
+      tags: [cutover_rollback, never]
+
+  handlers:
+    - name: reload systemd
+      ansible.builtin.systemd:
+        daemon_reload: true

ansible/playbooks/day2_per_model_ctx_size.yml

@@ -0,0 +1,277 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/day2_per_model_ctx_size.yml
+# DESCRIPTION: Right-size --ctx-size per model workload on llama-server-router
+#              (already in --models-preset mode since t_9adf0889).
+#
+# Context (t_ryan_per_model_ctx, 2026-08-13, requested by Ryan via JARVIS):
+#   All 3 preset models currently launch with a uniform --ctx-size 65536.
+#   This playbook narrows two of them to match actual workload:
+#     - Meta-Llama-3.1-8B-Instruct-Q4_K_M (alias Meta-Llama-3.1-8B-Instruct-4bit):
+#         ctx-size 65536 -> 8192  (tool-routing / micro-tasks: title gen, MCP
+#         tool calls, approval checks)
+#     - Phi-3.5-mini-instruct-Q8_0 (alias Phi-3.5-mini-instruct-8bit):
+#         ctx-size 65536 -> 32768 (long web scrapes / session-log compression)
+#   Both also move flash-attn from "auto" to explicit "true" per Ryan's spec.
+#   Qwen3.6-35B-A3B-UD-Q4_K_S is INTENTIONALLY left untouched at 65536/auto.
+#
+#   Existing aliases (Meta-Llama-3.1-8B-Instruct-4bit, Phi-3.5-mini-instruct-8bit)
+#   are PRESERVED as-is. Ryan's pasted TOML used different alias strings
+#   ("llama-3.1-8b", "phi-3.5-mini") but renaming aliases was not explicitly
+#   requested and would break live Hermes custom_providers routing — flagged
+#   in the deployment report rather than applied silently.
+#
+# IMPORTANT — Hermes side effect: /home/hermes/.hermes/config.yaml declares
+# context_length: 65536 for both these models under custom_providers. This
+# playbook does NOT touch that file (out of role/agent scope) but the value
+# becomes STALE the moment this playbook lands. Flag to JARVIS/Maria Hill.
+#
+# Usage (from ~/git/homelab/ansible):
+#   ansible-playbook -i inventory.yml playbooks/day2_per_model_ctx_size.yml
+#
+# Author: War Machine (2026-08-13, t_ryan_per_model_ctx)
+# ------------------------------------------------------------------------------
+
+- name: "Right-size per-model ctx-size on llama-server-router (Llama 8k, Phi 32k)"
+  hosts: astro_orbiter
+  gather_facts: false
+  become: true
+
+  vars:
+    # Preset mode already active in production (t_9adf0889) — keep it on.
+    llm_router_preset_enabled: true
+    llm_router_preset_path: /opt/llama-server-router-preset.ini
+    llm_router_enabled: true
+
+    # Production port
+    llm_router_port: 8002
+    llm_router_bind_address: "10.1.71.130"
+    llm_router_allowed_source_cidr: "10.1.70.0/24"
+    llm_bind_address: "10.1.71.130"
+    llm_allowed_source_cidr: "10.1.70.0/24"
+
+    llm_service_user: jarvis
+    llm_binary_path: /opt/llama.cpp/build/bin/llama-server
+    llm_models_dir: /opt/models
+    llm_router_service_name: llama-server-router
+    llm_router_models_dir: /opt/models
+    llm_router_models_max: 4
+    llm_router_parallel: 1
+    llm_router_gpu_layers: 99
+    llm_router_batch_size: 2048
+    llm_router_ubatch_size: 512
+    llm_router_cache_type_k: q4_0
+    llm_router_cache_type_v: q4_0
+
+    # Qwen — untouched baseline (also used as router-wide fallback default)
+    llm_router_ctx_size: 65536
+    llm_router_flash_attn: "auto"
+    llm_router_expected_model_id: "Qwen3.6-35B-A3B-UD-Q4_K_S"
+    llm_router_vram_max_mib: 23000
+
+    # --- THE CHANGE: per-model overrides ---
+    llm_router_llama_ctx_size: 8192
+    llm_router_llama_flash_attn: "true"
+    llm_router_phi_ctx_size: 32768
+    llm_router_phi_flash_attn: "true"
+
+  handlers:
+    - name: reload systemd
+      ansible.builtin.systemd:
+        daemon_reload: true
+      become: true
+      listen: "reload systemd"
+
+    - name: restart router
+      ansible.builtin.systemd:
+        name: llama-server-router
+        state: restarted
+      become: true
+      listen: "restart router"
+
+  tasks:
+
+    # ==========================================================================
+    # PHASE 1: Deploy the preset INI with new per-model ctx-size/flash-attn
+    # ==========================================================================
+
+    - name: "[ctx-resize] Deploy preset INI to {{ llm_router_preset_path }}"
+      ansible.builtin.template:
+        src: "../roles/llm-inference-multimodel/templates/llama-server-router-preset.ini.j2"
+        dest: "{{ llm_router_preset_path }}"
+        owner: root
+        group: root
+        mode: "0644"
+      register: ctx_resize_preset_deployed
+      notify:
+        - restart router
+
+    - name: "[ctx-resize] Deploy router systemd unit (drop global --ctx-size/--flash-attn in preset mode)"
+      ansible.builtin.template:
+        src: "../roles/llm-inference-multimodel/templates/llama-server-router.service.j2"
+        dest: /etc/systemd/system/llama-server-router.service
+        owner: root
+        group: root
+        mode: "0644"
+      register: ctx_resize_unit_deployed
+      notify:
+        - reload systemd
+        - restart router
+
+    - name: "[ctx-resize] Flush handlers (daemon-reload + router restart if changed)"
+      ansible.builtin.meta: flush_handlers
+
+    # ==========================================================================
+    # PHASE 2: Verify
+    # ==========================================================================
+
+    - name: "[ctx-resize] Wait for /health"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/health"
+        status_code: 200
+        timeout: 30
+      retries: 12
+      delay: 5
+      register: ctx_resize_health
+      until: ctx_resize_health.status == 200
+
+    - name: "[ctx-resize] Query /v1/models"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/models"
+        status_code: 200
+        return_content: true
+        timeout: 30
+      register: ctx_resize_models
+
+    - name: "[ctx-resize] Trigger load — Llama (confirms actual load + captures live args)"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/chat/completions"
+        method: POST
+        body_format: json
+        body:
+          model: "Meta-Llama-3.1-8B-Instruct-Q4_K_M"
+          messages:
+            - role: user
+              content: "Reply with one word: hello"
+          max_tokens: 5
+          temperature: 0.0
+        status_code: 200
+        return_content: true
+        timeout: 120
+      register: ctx_resize_llama_warmup
+
+    - name: "[ctx-resize] Trigger load — Phi (confirms actual load + captures live args)"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/chat/completions"
+        method: POST
+        body_format: json
+        body:
+          model: "Phi-3.5-mini-instruct-Q8_0"
+          messages:
+            - role: user
+              content: "Reply with one word: hello"
+          max_tokens: 5
+          temperature: 0.0
+        status_code: 200
+        return_content: true
+        timeout: 120
+      register: ctx_resize_phi_warmup
+
+    - name: "[ctx-resize] Re-query /v1/models after warmup (final state)"
+      ansible.builtin.uri:
+        url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/models"
+        status_code: 200
+        return_content: true
+        timeout: 30
+      register: ctx_resize_models_final
+
+    - name: "[ctx-resize] Extract Llama args"
+      ansible.builtin.set_fact:
+        ctx_resize_llama_args: >-
+          {{ (ctx_resize_models_final.json.data | selectattr('id', 'equalto', 'Meta-Llama-3.1-8B-Instruct-Q4_K_M') | first).status.args }}
+        ctx_resize_llama_status: >-
+          {{ (ctx_resize_models_final.json.data | selectattr('id', 'equalto', 'Meta-Llama-3.1-8B-Instruct-Q4_K_M') | first).status.value }}
+
+    - name: "[ctx-resize] Extract Phi args"
+      ansible.builtin.set_fact:
+        ctx_resize_phi_args: >-
+          {{ (ctx_resize_models_final.json.data | selectattr('id', 'equalto', 'Phi-3.5-mini-instruct-Q8_0') | first).status.args }}
+        ctx_resize_phi_status: >-
+          {{ (ctx_resize_models_final.json.data | selectattr('id', 'equalto', 'Phi-3.5-mini-instruct-Q8_0') | first).status.value }}
+
+    - name: "[ctx-resize] Extract Qwen args (must be unchanged)"
+      ansible.builtin.set_fact:
+        ctx_resize_qwen_args: >-
+          {{ (ctx_resize_models_final.json.data | selectattr('id', 'equalto', 'Qwen3.6-35B-A3B-UD-Q4_K_S') | first).status.args }}
+
+    - name: "[ctx-resize] GATE — Llama ctx-size must be 8192"
+      ansible.builtin.assert:
+        that:
+          - "'8192' in ctx_resize_llama_args"
+          - ctx_resize_llama_args[ctx_resize_llama_args.index('--ctx-size') + 1] == '8192'
+        fail_msg: "Llama ctx-size not 8192. Args: {{ ctx_resize_llama_args }}"
+        success_msg: "Llama ctx-size confirmed 8192."
+
+    - name: "[ctx-resize] GATE — Llama flash-attn must be true"
+      ansible.builtin.assert:
+        that:
+          - ctx_resize_llama_args[ctx_resize_llama_args.index('--flash-attn') + 1] == 'true'
+        fail_msg: "Llama flash-attn not true. Args: {{ ctx_resize_llama_args }}"
+        success_msg: "Llama flash-attn confirmed true."
+
+    - name: "[ctx-resize] GATE — Llama loaded successfully"
+      ansible.builtin.assert:
+        that:
+          - ctx_resize_llama_status == 'loaded'
+        fail_msg: "Llama status is '{{ ctx_resize_llama_status }}', expected 'loaded'."
+        success_msg: "Llama status confirmed 'loaded'."
+
+    - name: "[ctx-resize] GATE — Phi ctx-size must be 32768"
+      ansible.builtin.assert:
+        that:
+          - ctx_resize_phi_args[ctx_resize_phi_args.index('--ctx-size') + 1] == '32768'
+        fail_msg: "Phi ctx-size not 32768. Args: {{ ctx_resize_phi_args }}"
+        success_msg: "Phi ctx-size confirmed 32768."
+
+    - name: "[ctx-resize] GATE — Phi flash-attn must be true"
+      ansible.builtin.assert:
+        that:
+          - ctx_resize_phi_args[ctx_resize_phi_args.index('--flash-attn') + 1] == 'true'
+        fail_msg: "Phi flash-attn not true. Args: {{ ctx_resize_phi_args }}"
+        success_msg: "Phi flash-attn confirmed true."
+
+    - name: "[ctx-resize] GATE — Phi loaded successfully"
+      ansible.builtin.assert:
+        that:
+          - ctx_resize_phi_status == 'loaded'
+        fail_msg: "Phi status is '{{ ctx_resize_phi_status }}', expected 'loaded'."
+        success_msg: "Phi status confirmed 'loaded'."
+
+    - name: "[ctx-resize] GATE — Qwen ctx-size UNCHANGED at 65536"
+      ansible.builtin.assert:
+        that:
+          - ctx_resize_qwen_args[ctx_resize_qwen_args.index('--ctx-size') + 1] == '65536'
+        fail_msg: "Qwen ctx-size changed unexpectedly! Args: {{ ctx_resize_qwen_args }}"
+        success_msg: "Qwen ctx-size confirmed UNCHANGED at 65536."
+
+    - name: "[ctx-resize] PASS — summary"
+      ansible.builtin.debug:
+        msg:
+          - "================================================================"
+          - "PER-MODEL CTX-SIZE DEPLOYMENT — COMPLETE"
+          - ""
+          - "  Llama-3.1-8B (Meta-Llama-3.1-8B-Instruct-Q4_K_M):"
+          - "    status:     {{ ctx_resize_llama_status }}"
+          - "    args:       {{ ctx_resize_llama_args }}"
+          - ""
+          - "  Phi-3.5-mini (Phi-3.5-mini-instruct-Q8_0):"
+          - "    status:     {{ ctx_resize_phi_status }}"
+          - "    args:       {{ ctx_resize_phi_args }}"
+          - ""
+          - "  Qwen3.6-35B-A3B-UD-Q4_K_S: UNCHANGED (ctx-size 65536, args: {{ ctx_resize_qwen_args }})"
+          - ""
+          - "  ACTION NEEDED: /home/hermes/.hermes/config.yaml custom_providers"
+          - "  context_length: 65536 for both Meta-Llama-3.1-8B-Instruct-4bit and"
+          - "  Phi-3.5-mini-instruct-8bit is now STALE (actual: 8192 / 32768)."
+          - "  Flag to JARVIS/Maria Hill for correction — NOT done by this playbook."
+          - "================================================================"

ansible/playbooks/day2_qwen38_ctx128k.yml

@@ -0,0 +1,38 @@
+---
+# ------------------------------------------------------------------------------
+# Playbook: day2_qwen38_ctx128k.yml
+# Purpose:  Bump Qwen3.8-27B-Q4_K_M ctx-size from 32768 to 131072 (128K)
+#           on astro-orbiter's production router (port 8002).
+#
+# What this playbook does:
+#   1. Renders the updated llama-server-router-preset.ini.j2 (now with
+#      llm_router_qwen38_ctx_size: 131072) to /opt/llama-server-router-preset.ini.
+#   2. Restarts llama-server-router.service.
+#   3. Verifies the router loads Qwen3.8-27B at ctx=131072 in status.args.
+#
+# Context:
+#   - Empirical VRAM test (t_4455a44c): 131072 ctx = 20,282 MiB Qwen3.8
+#     + 558 MiB nomic-embed = ~20.8GB total; ~3.2GB headroom on 24GB RTX 3090.
+#     Co-resident with nomic-embed: comfortably fits.
+#   - Ryan approved this deployment.
+#   - Semaphore SSH gap for astro-orbiter still applies (t_730f9584 / t_33acbb2e);
+#     running direct CLI Ansible per standing exception.
+#
+# Run:
+#   cd /home/hermes/git/homelab/ansible
+#   env -u ANSIBLE_VAULT_PASSWORD_FILE ansible-playbook \
+#     -i inventory.yml \
+#     playbooks/day2_qwen38_ctx128k.yml
+#
+# Task reference: t_441470b9 — War Machine, 2026-08-16
+# ------------------------------------------------------------------------------
+- name: Bump Qwen3.8-27B ctx-size to 131072 on astro-orbiter
+  hosts: astro-orbiter
+  become: true
+  vars:
+    llm_router_preset_enabled: true
+    llm_router_qwen38_ctx_size: 131072
+
+  roles:
+    - role: llm-inference-multimodel
+      tags: [preset, systemd, verify]

ansible/playbooks/day2_swap_qwen38.yml

@@ -0,0 +1,36 @@
+---
+# ------------------------------------------------------------------------------
+# Playbook: day2_swap_qwen38.yml
+# Purpose:  Swap the primary production model on astro-orbiter router from
+#           Qwen3.6-35B-A3B-UD-Q4_K_S to Qwen3.8-27B-Q4_K_M.
+#           This is a GitOps-encoded record of the swap performed 2026-08-16
+#           per Ryan's direction (kanban task t_f5f7e9ad).
+#
+# What this playbook does:
+#   1. Renders the updated llama-server-router-preset.ini.j2 to
+#      /opt/llama-server-router-preset.ini on astro-orbiter.
+#   2. Reloads the llama-server-router service (SIGHUP / restart as needed).
+#   3. Verifies the new model ID appears in /v1/models.
+#
+# Prerequisites:
+#   - Qwen3.8-27B-Q4_K_M.gguf must be present in /opt/models on astro-orbiter.
+#     (Downloaded out-of-band via wget during the swap task.)
+#   - roles/llm-inference-multimodel/defaults/main.yml updated to reference
+#     Qwen3.8-27B-Q4_K_M (done in this same commit).
+#
+# Run:
+#   env -u ANSIBLE_VAULT_PASSWORD_FILE ansible-playbook \
+#     -i inventory.yml \
+#     playbooks/day2_swap_qwen38.yml
+#
+# Task reference: t_f5f7e9ad — War Machine, 2026-08-16
+# ------------------------------------------------------------------------------
+- name: Swap primary model to Qwen3.8-27B-Q4_K_M on astro-orbiter
+  hosts: astro-orbiter
+  become: true
+  vars:
+    llm_router_preset_enabled: true
+
+  roles:
+    - role: llm-inference-multimodel
+      tags: [preset, systemd, verify]

ansible/roles/llm-inference-multimodel/README.md

@@ -105,15 +105,44 @@ correctness/safety judgment call, not a repeatable infra check. See
 `docs/validation-log.md` in this role directory for the procedure reference
 and a place to log results once Ryan runs it.
 
-## Known gap: Semaphore is broken (as of 2026-08-05)
+## Known gap: Semaphore execution path bypassed for this role (2026-08-05)
 
-The normal execution/audit path (Semaphore) is currently non-functional.
-This role was authored to be run via direct `ansible-playbook` as an accepted
-interim stopgap, executed personally by Ryan. **This is a known gap, not the
-intended long-term operational path** — once Semaphore is repaired, retarget
-execution of this role (and future changes to it) through Semaphore so runs
-are audited/logged there again. Flag this in any future work that touches
-this role.
+The normal execution/audit path (Semaphore) was believed non-functional at authoring time, so this role was run via direct `ansible-playbook` instead, executed personally by Ryan.
+
+**Confirmed 2026-08-05 (JARVIS, via Semaphore API — token `vault_semaphore_api_token` in the homelab Ansible vault):** this was a misdiagnosis, not an outage. Semaphore's service, Postgres backend, and API (`/api/ping` returns `pong`) are all healthy on figment (10.1.71.37 — note the documented host `city-hall`/10.1.71.38 is stale; DNS for `imagineering.local.mk-labs.cloud` actually resolves through Traefik on lightning-lane to figment:3000). Queried `/api/project/1/templates` directly: only 6 templates exist project-wide (day0 baseline/root-LV checks, day1 Semaphore self-deploy, Traefik route updates) — **none for this role, nor for the original single-model `llm-inference` role**. Root cause confirmed: no Semaphore project template was ever created for LLM inference deployment, which presents identically to "Semaphore is broken" if you don't check the template list.
+
+**This is still a known gap** — direct `ansible-playbook` execution bypasses the audit trail Semaphore normally provides. Create a project template for this role's playbook and retarget execution through Semaphore so runs are audited/logged there. Flag this in any future work that touches this role.
+
+## Rollback
+
+## Qwen2.5-14B shadow deployment (port 8002) — 2026-08-06
+
+Added a third instance definition (`llama-server-qwen`) per
+`/home/hermes/reports/local-llm-64k-context-recommendation.md`, intended to
+eventually replace the `llama-server-toolcall` (8001) slot once validated —
+runs alongside 8000/8001 during the shadow-test window, does not stop or
+replace either.
+
+**VRAM GATE — service NOT started as of this commit.** Live `nvidia-smi` check
+on 2026-08-06 showed Phi-4 (8000, ~10.4GB) + Mistral (8001, ~6.2GB) already
+consuming ~16.6GB / 24GB, leaving only ~7.5GB free. Qwen2.5-14B-Instruct
+Q5_K_M weights alone are ~10-12GB — **does not fit concurrently** with both
+existing instances at full GPU offload. The unit is deployed to disk
+(`llm_qwen_service_enabled: false` default in `defaults/main.yml`) but will
+not start until this is resolved. Options for the shadow-test window,
+none applied yet — pick one and flip `llm_qwen_service_enabled: true`:
+
+1. Temporarily stop `llama-server-toolcall` (8001) for the duration of the
+   shadow test — it's the model being superseded anyway, so this is low-risk
+   and reversible (`systemctl start llama-server-toolcall` restores it).
+2. Reduce Qwen's `--n-gpu-layers` (partial CPU offload) to fit the ~7.5GB
+   remaining headroom — will materially hurt throughput, not recommended as
+   first choice.
+3. Reduce `--ctx-size` below 65536 — undermines the entire point of this
+   exercise (Hermes's 64K floor), not recommended.
+
+Recommended: option 1, coordinated with Ryan/JARVIS since it does touch a
+live service, even though 8001 was already flagged for retirement.
 
 ## Rollback
 

ansible/roles/llm-inference-multimodel/defaults/main.yml

@@ -26,34 +26,158 @@ llm_bind_address: "10.1.71.130"
 # Override per-environment; default assumes Hermes runs somewhere on this /24.
 llm_allowed_source_cidr: "10.1.70.0/24"
 
-# --- Aux / classification instance (port 8000, Phi-4-14B) -------------------
-# Text-only instruction model, no tool-calling training — safe offload target
-# per the auxiliary-task-offload skill's "no tool_calls emission risk" bar.
-llm_aux_port: 8000
-llm_aux_model_path: "{{ llm_models_dir }}/phi-4-14b-instruct-Q4_K_M.gguf"
-llm_aux_model_url: "https://huggingface.co/bartowski/phi-4-GGUF/resolve/main/phi-4-Q4_K_M.gguf"
-llm_aux_model_min_bytes: 8000000000   # guard threshold; complete file ~8.5GB
-llm_aux_ctx_size: 8192
-llm_aux_parallel: 2
-llm_aux_gpu_layers: 99
-llm_aux_service_name: llama-server-aux
-llm_aux_model_id: phi-4-14b-instruct   # served model name for OpenAI-compat API
+# --- RETIRED (2026-08-06): Aux / classification instance (port 8000, Phi-4-14B)
+# and Tool-calling instance (port 8001, Mistral-Small-24B) --------------------
+# Consolidated down to a single production model (Qwen2.5-14B-Instruct-1M,
+# port 8002) serving BOTH the friday and war-machine Hermes profiles. Ryan
+# explicitly accepted the tradeoffs (single model for chat + tool-calling +
+# aux duties) over keeping the aux/toolcall split running.
+# Both llama-server-aux and llama-server-toolcall services were stopped,
+# disabled, and had their unit files removed from astro-orbiter; their GGUF
+# weights (phi-4-14b-instruct-Q4_K_M.gguf, mistral-small-24b-instruct-2501-
+# Q3_K_M.gguf) were deleted from /opt/models (~45GB reclaimed). The
+# templates/tasks that deployed them have been removed from this role — see
+# git log for the prior variable definitions and unit templates if a future
+# rollback needs them restored.
 
-# --- Tool-calling instance (port 8001, Mistral-Small-24B) --------------------
-# Native function-calling support; deployed at Q3_K_M per plan §1 Option B
-# to fit VRAM budget. MUST pass the §7 validation harness before any
-# Claude-Code-capable profile is pointed at this port.
-llm_toolcall_port: 8001
-llm_toolcall_model_path: "{{ llm_models_dir }}/mistral-small-24b-instruct-2501-Q3_K_M.gguf"
-llm_toolcall_model_url: "https://huggingface.co/bartowski/Mistral-Small-24B-Instruct-2501-GGUF/resolve/main/Mistral-Small-24B-Instruct-2501-Q3_K_M.gguf"
-llm_toolcall_model_min_bytes: 11000000000   # guard threshold; complete file ~11.7GB
-llm_toolcall_ctx_size: 4096
-llm_toolcall_parallel: 1
-llm_toolcall_gpu_layers: 99
-llm_toolcall_service_name: llama-server-toolcall
-llm_toolcall_model_id: mistral-small-24b-instruct-2501
+# --- Production instance (port 8002, Qwen2.5-14B-Instruct-1M) ----------------
+# History (2026-08-06): Qwen2.5-14B-Instruct (base) was deployed to this slot
+# and DISQUALIFIED — live /v1/models meta reported n_ctx_train=32768, well
+# under the 64K Hermes floor (the model card's "128K" figure conflated
+# YaRN-extended inference-time scaling with actual trained context; disabled
+# by default, not baked in). Llama-3.1-8B-Instruct was tried next — cleared
+# the context gate (verified live n_ctx_train=131072) but failed the
+# tool-calling validation harness badly (8/10 hallucination-stress prompts
+# triggered spurious tool_calls even at temp=0.1 with the correct official
+# chat template) — purged from disk and Ansible entirely, see git log.
+# Current model: Qwen2.5-14B-Instruct-1M (bartowski GGUF) — distinct
+# checkpoint with genuine additional long-context pretraining, NOT the same
+# weights as the disqualified base model above. Live-verified 2026-08-06:
+# /v1/models reports n_ctx=65536, n_ctx_train=1010000 (well over the 64K
+# floor). Tool-calling verified live via a /v1/chat/completions probe with a
+# tools= payload — returned a well-formed tool_calls response (finish_reason
+# "tool_calls", valid JSON arguments), no hallucinated calls observed.
+# PROMOTED TO PRODUCTION (2026-08-06): llm_qwen_service_enabled now defaults
+# to true — this is the sole model serving both Hermes profiles. Ports
+# 8000/8001 are permanently freed; no co-residency VRAM gate applies anymore.
+llm_qwen_service_enabled: true
+llm_qwen_port: 8002
+llm_qwen_model_path: "{{ llm_models_dir }}/Qwen3.8-27B-Q4_K_M.gguf"
+llm_qwen_model_min_bytes: 17000000000   # guard threshold; complete file ~17.1GB
+llm_qwen_ctx_size: 65536
+llm_qwen_parallel: 1
+llm_qwen_gpu_layers: 99
+llm_qwen_batch_size: 4096
+llm_qwen_ubatch_size: 4096
+llm_qwen_service_name: llama-server-qwen
+llm_qwen_model_id: Qwen3.8-27B-Q4_K_M
+llm_qwen_expected_vram_gb: 17  # Q4_K_M = 17.1GB weights + ~6GB KV @ 65536 ctx = ~23GB max
+# NOTE (2026-08-16 t_f5f7e9ad): Qwen3.6-35B-A3B-UD-Q4_K_S superseded by
+# Qwen3.8-27B-Q4_K_M per Ryan's direction. Qwen3.8-27B is a dense 27B VLM
+# (Apache-2.0, Alibaba, Aug 2026) quantized by Unsloth Dynamic V3.0.
+# Q4_K_M: 17,106,775,008 bytes. Downloaded out-of-band via wget.
+# llm_qwen_model_url: https://huggingface.co/unsloth/Qwen3.8-27B-GGUF/resolve/main/Qwen3.8-27B-Q4_K_M.gguf
+
+# --- Staged GGUF models (data-driven, idempotent staging) --------------------
+# Additional GGUFs to ensure are present in llm_models_dir, alongside the
+# production Qwen3.6-35B. Consumed by tasks/models.yml (loop over
+# tasks/stage_model.yml). Each entry:
+#   filename:    target filename in llm_models_dir
+#   url:         HuggingFace resolve URL (public repos; no auth needed)
+#   size_bytes:  EXACT expected byte size (HF manifest) — guard: download only
+#                if the file is missing OR its size != this value (idempotent;
+#                never re-pulls a correct file, never needlessly restarts).
+#   source_repo: upstream HF repo (audit/lineage)
+# The REAL list is defined per-host in host_vars/astro-orbiter/vars.yml (NOT
+# hardcoded here) so the role stays generic and reusable for future model adds.
+# Empty default = nothing staged (safe no-op).
+llm_staged_models: []
 
 # --- Existing Gemma baseline (rollback target — never modified by this role) -
 # Populated by Phase 0 discovery (tasks/discover.yml) if not already known.
 # Set here only as a fallback name to search for; discovery is authoritative.
 llm_existing_gemma_service_name_guess: llama-server
+
+# --- Router mode shadow deployment (port 8003) --------------------------------
+# Deploy llama-server in router/supervisor mode (no -m flag) on a shadow port.
+# Production unit (llama-server-qwen, port 8002) is UNCHANGED until validation
+# gates pass and Ryan explicitly approves cutover.
+#
+# Default: llm_router_enabled: false — all router tasks are no-ops until you
+# flip this to true (either in host_vars, extra-vars, or the shadow playbook).
+#
+# CRITICAL: llm_router_models_max default is 1 here for safety. It is
+# overridden to 4 in host_vars/astro-orbiter/vars.yml (t_33acbb2e) with
+# a full VRAM budget note. DO NOT raise it without a VRAM budget review.
+# Default llama-server cap is 4 simultaneous — that would OOM a 24GB card
+# immediately when Qwen3.6-35B (20GB) is the resident model.
+#
+# Added 2026-08-12 (t_0cca74a2): router mode migration — War Machine.
+llm_router_enabled: false
+llm_router_port: 8003
+llm_router_service_name: llama-server-router
+llm_router_models_dir: "{{ llm_models_dir }}"       # /opt/models — same dir as production
+llm_router_models_max: 1                              # CRITICAL: RTX 3090 24GB, single model only
+llm_router_ctx_size: 65536                            # 64K — must match production (Hermes floor)
+llm_router_parallel: 1
+llm_router_gpu_layers: 99
+llm_router_batch_size: 4096
+llm_router_ubatch_size: 4096
+llm_router_cache_type_k: q4_0                         # required to fit 64K KV in 24GB
+llm_router_cache_type_v: q4_0
+llm_router_flash_attn: "auto"
+llm_router_bind_address: "{{ llm_bind_address }}"    # 10.1.71.130
+llm_router_allowed_source_cidr: "{{ llm_allowed_source_cidr }}"  # 10.1.70.0/24
+llm_router_expected_model_id: "Qwen3.8-27B-Q4_K_M"           # verified at Gate 1
+llm_router_vram_max_mib: 23000                        # Gate 3: fail if exceeded under load
+
+# --- Router preset mode (--models-preset INI) ---------------------------------
+# Set llm_router_preset_enabled: true to switch from --models-dir to
+# --models-preset. Preset mode is REQUIRED to support model aliases.
+# The template at llama-server-router-preset.ini.j2 defines all 3 router models:
+#   - Qwen3.6-35B-A3B-UD-Q4_K_S (no alias — primary ID unchanged)
+#   - Phi-3.5-mini-instruct-Q8_0 (alias: Phi-3.5-mini-instruct-8bit)  <-- t_9adf0889
+#   - Meta-Llama-3.1-8B-Instruct-Q4_K_M (no alias — primary ID unchanged)
+#
+# llm_router_preset_path: on-disk path where the rendered INI is deployed.
+# Default: /opt/llama-server-router-preset.ini (owned by root, readable by all).
+#
+# GH #22364 note: --models-preset causes an extra "default" entry in /v1/models.
+# This is cosmetic and does not affect model selection by name. Accept it.
+#
+# Added 2026-08-12 (t_9adf0889) — War Machine.
+llm_router_preset_enabled: false                      # flip true to activate preset mode
+
+# Per-model ctx-size / flash-attn overrides for preset mode (t_ryan_per_model_ctx).
+# Defaults mirror the prior uniform 65536/auto behavior; host_vars or the
+# deploy playbook override these to the values Ryan requested per workload.
+llm_router_llama_ctx_size: "{{ llm_router_ctx_size }}"
+llm_router_llama_flash_attn: "{{ llm_router_flash_attn }}"
+llm_router_phi_ctx_size: "{{ llm_router_ctx_size }}"
+llm_router_phi_flash_attn: "{{ llm_router_flash_attn }}"
+# Qwen2.5-Coder-14B: ctx_size=16384, flash_attn=true per task t_55c164f5
+llm_router_coder_ctx_size: 16384
+llm_router_coder_flash_attn: "true"
+llm_router_preset_path: /opt/llama-server-router-preset.ini
+# Qwen3.8-27B: ctx=131072 (128K). Bumped from 32768 -> 131072 per Ryan approval (t_441470b9, 2026-08-16).
+# Measured VRAM: 20,282 MiB at 131072 ctx (empirically tested in t_4455a44c); nomic-embed 558 MiB
+# always resident -> ~20.8GB total, ~3.2GB headroom on 24GB RTX 3090. Comfortably safe.
+# Prior value was 32768 (17,068 MiB) — bumping 4x for genuine 128K context.
+# Native context of Qwen3.8-27B is 262,144 tokens; 128K is a practical production ceiling.
+llm_router_qwen38_ctx_size: 131072
+# nomic-embed-text-v1.5: embedding model, ctx-size=8192 per task t_34b96e83
+# No flash_attn or KV cache params - embedding models use bidirectional forward pass,
+# not autoregressive KV cache. load-on-startup=true / sleep-idle-seconds=-1 keep it
+# always warm at negligible VRAM cost (~84MB).
+llm_router_nomic_ctx_size: 8192
+# FIX (2026-08-14, t_openviking_embed_batch): batch-size/ubatch-size were
+# previously omitted from this section entirely, so llama-server silently
+# defaulted the physical batch (ubatch-size) to 512 tokens. Embedding requests
+# cannot be split across ubatches in llama.cpp, so any OpenViking chunk over
+# ~512 tokens (observed 2000-3400 tokens/chunk from openviking-config's
+# embedding.dense chunking) hard-failed with "input (N tokens) is too large to
+# process. increase the physical batch size" - this fed OpenViking's circuit
+# breaker into a permanent fail/re-enqueue loop. 4096 covers the observed max
+# comfortably while staying under ctx-size=8192.
+llm_router_nomic_batch_size: 4096
+llm_router_nomic_ubatch_size: 4096

ansible/roles/llm-inference-multimodel/docs/validation-log.md

@@ -1,46 +1,65 @@
-# Tool-Calling Model Validation Log
+# Tool-Calling Validation Log — Mistral-Small-24B-Instruct-2501 (Q3_K_M)
 
-This file tracks the manual validation procedure required by
-`astro-orbiter-multi-model-plan.md` §7 before `llama-server-toolcall` (port
-8001, Mistral-Small-24B-Instruct-2501 Q3_K_M) is trusted for any real
-tool-calling / Claude Code Hermes profile traffic.
+## Run 2 — 2026-08-05 (PASS)
 
-This is **not automated by the role** — `tasks/verify.yml` only confirms the
-endpoint is up and can produce a basic completion. The checks below are a
-correctness/safety judgment call that a human runs and records here.
+**Host:** astro-orbiter (10.1.71.130), port 8001, `llama-server-toolcall.service`
+**Model:** `/opt/models/mistral-small-24b-instruct-2501-Q3_K_M.gguf`
+**Config change from Run 1:** added `--jinja --chat-template-file /opt/models/templates/mistral-small-tool-use.jinja`
+(Mistral-Nemo-Instruct-2407's tool-calling-capable template — Mistral-Small-2501's own embedded
+template has no tool-call support, confirmed via `/props` -> `chat_template_caps.supports_tools=false`
+prior to the fix). Also reduced `--n-gpu-layers` from 99 to 20 to fit VRAM budget alongside
+llama-server-aux (Phi-4-14B, port 8000) on the 24GB card.
 
-## Procedure (plan §7 summary)
+### Result: **PASS**
 
-1. **`tool_calls` emission probe** — curl a handful of known
-   tool-triggering prompts (e.g. "what's the weather in Austin right now")
-   against `POST http://10.1.71.130:8001/v1/chat/completions` with a `tools`
-   array defined, and confirm the response actually contains a well-formed
-   `tool_calls` block (correct function name, valid JSON arguments) rather
-   than a plain-text answer or a malformed call.
+| Check | Result |
+|---|---|
+| Correct tool_calls on 3 weather prompts | 3/3 PASS |
+| No hallucinated tool_calls on 20 tool-free prompts | 20/20 PASS (4 initially timed out at 30s harness default; re-run at 150s timeout confirmed all 4 correctly returned plain text, no tool_calls, in 13.5-47.8s) |
+| `chat_template_caps.supports_tools` via `/props` | `true` |
 
-2. **Hallucination stress test** — send prompts that should **not** trigger
-   any tool call (general knowledge questions, casual chat, prompts that
-   merely mention a tool's name in passing) and confirm the model does
-   **not** emit a spurious `tool_calls` block. This is the primary risk
-   flagged in the plan given Mistral-Small's Q3_K_M quantization and its
-   lineage concerns around over-eager tool invocation.
+### Known tradeoff — CPU offload latency
+`--n-gpu-layers 20` (not full 99-layer GPU offload) means a meaningful portion of Mistral-Small
+runs on CPU to fit alongside Phi-4-14B in 24GB VRAM. Measured response latency: 13.5-47.8s per
+request in this validation run, vs. sub-second-to-few-second latency typical of fully GPU-resident
+models at this size. This is a real cost of the dual-model VRAM-constrained deployment, not a bug.
+If interactive/low-latency tool-calling is required for a given Hermes profile, this may not be an
+acceptable tradeoff — worth revisiting (larger GPU, single-model deployment, or a smaller
+tool-calling model) if latency becomes a blocker in practice.
 
-3. **Shadow mode** — for a bounded period, run this instance in parallel
-   with whatever tool-calling path is currently in production, comparing
-   outputs on the same real traffic (or a recorded sample) without letting
-   this instance's outputs actually drive tool execution. Only cut over
-   once outputs are consistently correct.
+### Verdict
+Cleared for tool-calling-capable Hermes profiles, with the latency caveat above communicated to
+whoever assigns a profile to this endpoint. Re-run this harness after any further config change to
+`llama-server-toolcall.service`.
 
-See the `llm-inference-homelab` skill's `scripts/tool-calling-validation.sh`
-reference for a starting curl harness shape — adapt prompts/tool schemas to
-Mistral-Small's actual expected format (confirm via the GGUF's embedded
-chat template / model card) rather than assuming it matches Qwen's.
+---
 
-## Log
+## Run 1 — 2026-08-05 (FAIL, superseded)
 
-| Date | Run by | Probe result | Hallucination test result | Shadow mode outcome | Decision |
-|---|---|---|---|---|---|
-| _(pending)_ | | | | | Not yet cut over — do not point production tool-calling traffic at :8001 |
+**Result:** FAIL — 0/3 positive tool-invocation cases; tools schema was not reaching the model at all
+(`--jinja` flag missing, no tool-calling chat template configured). No hallucination observed (20/20
+negative cases passed) but tool-calling was never actually exercised. See commit history for the fix
+(adding `--jinja` + Mistral-Nemo-Instruct-2407 template, `5dc76a8`).
 
-Update this table after each validation pass. Do not remove prior rows —
-this is the audit trail for "when did we decide this was safe to use."
+---
+
+## Procedure (plan §7 summary, preserved from original template)
+
+1. **`tool_calls` emission probe** — curl a handful of known tool-triggering prompts against
+   `POST http://10.1.71.130:8001/v1/chat/completions` with a `tools` array defined, and confirm the
+   response actually contains a well-formed `tool_calls` block (correct function name, valid JSON
+   arguments) rather than a plain-text answer or a malformed call.
+
+2. **Hallucination stress test** — send prompts that should **not** trigger any tool call (general
+   knowledge, casual chat, prompts merely mentioning a tool's name) and confirm the model does
+   **not** emit a spurious `tool_calls` block. Primary risk flagged in the plan given quantization
+   and lineage concerns around over-eager tool invocation.
+
+3. **Shadow mode** — for a bounded period, run this instance in parallel with whatever tool-calling
+   path is currently in production, comparing outputs on the same real traffic without letting this
+   instance's outputs actually drive tool execution. Only cut over once outputs are consistently
+   correct. **Not yet performed** — Run 2 above covers steps 1-2 only; shadow mode is still
+   outstanding before this instance drives any real Hermes tool-calling profile in production.
+
+See the `llm-inference-homelab` skill's `scripts/tool-calling-validation.sh` reference for a
+starting curl harness shape.

ansible/roles/llm-inference-multimodel/files/mistral-small-tool-use.jinja

@@ -0,0 +1,87 @@
+{%- if messages[0]["role"] == "system" %}
+    {%- set system_message = messages[0]["content"] %}
+    {%- set loop_messages = messages[1:] %}
+{%- else %}
+    {%- set loop_messages = messages %}
+{%- endif %}
+{%- if not tools is defined %}
+    {%- set tools = none %}
+{%- endif %}
+{%- set user_messages = loop_messages | selectattr("role", "equalto", "user") | list %}
+
+{#- This block checks for alternating user/assistant messages, skipping tool calling messages #}
+{%- set ns = namespace() %}
+{%- set ns.index = 0 %}
+{%- for message in loop_messages %}
+    {%- if not (message.role == "tool" or message.role == "tool_results" or (message.tool_calls is defined and message.tool_calls is not none)) %}
+        {%- if (message["role"] == "user") != (ns.index % 2 == 0) %}
+            {{- raise_exception("After the optional system message, conversation roles must alternate user/assistant/user/assistant/...") }}
+        {%- endif %}
+        {%- set ns.index = ns.index + 1 %}
+    {%- endif %}
+{%- endfor %}
+
+{{- bos_token }}
+{%- for message in loop_messages %}
+    {%- if message["role"] == "user" %}
+        {%- if tools is not none and (message == user_messages[-1]) %}
+            {{- "[AVAILABLE_TOOLS][" }}
+            {%- for tool in tools %}
+                {%- set tool = tool.function %}
+                {{- '{"type": "function", "function": {' }}
+                {%- for key, val in tool.items() if key != "return" %}
+                    {%- if val is string %}
+                        {{- '"' + key + '": "' + val + '"' }}
+                    {%- else %}
+                        {{- '"' + key + '": ' + val|tojson }}
+                    {%- endif %}
+                    {%- if not loop.last %}
+                        {{- ", " }}
+                    {%- endif %}
+                {%- endfor %}
+                {{- "}}" }}
+                {%- if not loop.last %}
+                    {{- ", " }}
+                {%- else %}
+                    {{- "]" }}
+                {%- endif %}
+            {%- endfor %}
+            {{- "[/AVAILABLE_TOOLS]" }}
+            {%- endif %}
+        {%- if loop.last and system_message is defined %}
+            {{- "[INST]" + system_message + "\n\n" + message["content"] + "[/INST]" }}
+        {%- else %}
+            {{- "[INST]" + message["content"] + "[/INST]" }}
+        {%- endif %}
+    {%- elif (message.tool_calls is defined and message.tool_calls is not none) %}
+        {{- "[TOOL_CALLS][" }}
+        {%- for tool_call in message.tool_calls %}
+            {%- set out = tool_call.function|tojson %}
+            {{- out[:-1] }}
+            {%- if not tool_call.id is defined or tool_call.id|length != 9 %}
+                {{- raise_exception("Tool call IDs should be alphanumeric strings with length 9!") }}
+            {%- endif %}
+            {{- ', "id": "' + tool_call.id + '"}' }}
+            {%- if not loop.last %}
+                {{- ", " }}
+            {%- else %}
+                {{- "]" + eos_token }}
+            {%- endif %}
+        {%- endfor %}
+    {%- elif message["role"] == "assistant" %}
+        {{- message["content"] + eos_token}}
+    {%- elif message["role"] == "tool_results" or message["role"] == "tool" %}
+        {%- if message.content is defined and message.content.content is defined %}
+            {%- set content = message.content.content %}
+        {%- else %}
+            {%- set content = message.content %}
+        {%- endif %}
+        {{- '[TOOL_RESULTS]{"content": ' + content|string + ", " }}
+        {%- if not message.tool_call_id is defined or message.tool_call_id|length != 9 %}
+            {{- raise_exception("Tool call IDs should be alphanumeric strings with length 9!") }}
+        {%- endif %}
+        {{- '"call_id": "' + message.tool_call_id + '"}[/TOOL_RESULTS]' }}
+    {%- else %}
+        {{- raise_exception("Only user and assistant roles are supported, with the exception of an initial optional system message!") }}
+    {%- endif %}
+{%- endfor %}

ansible/roles/llm-inference-multimodel/handlers/main.yml

@@ -1,9 +1,21 @@
 ---
 # ------------------------------------------------------------------------------
 # FILE: roles/llm-inference-multimodel/handlers/main.yml
-# DESCRIPTION: Separate restart handlers per instance — NEVER combined, so a
-#              content change to one unit template never restarts the other
-#              (plan §2/§6 requirement: independent restart/rollback).
+# DESCRIPTION: Only a daemon-reload handler lives here now (harmless, no
+#              process impact). Per-service restart/start decisions are made
+#              explicitly in tasks/verify.yml (Phase 4), keyed off the
+#              per-unit `changed` result registered in tasks/systemd.yml
+#              (Phase 2) — NEVER combined, so a content change to one unit
+#              template still never restarts the other (plan §2/§6
+#              requirement: independent restart/rollback).
+#
+#              BUGFIX: this file used to also define "restart
+#              llama-server-aux" / "restart llama-server-toolcall" handlers,
+#              notified from Phase 2's template tasks and fired there via
+#              `meta: flush_handlers` — causing both live services to
+#              restart during Phase 2, before Phase 3/4 had run. See
+#              tasks/systemd.yml for the full writeup. Restart logic moved
+#              to tasks/verify.yml so it only ever fires in Phase 4.
 # ------------------------------------------------------------------------------
 
 - name: Reload systemd
@@ -12,16 +24,23 @@
   become: true
   listen: "reload systemd"
 
-- name: Restart llama-server-aux
+# Restart the llama.cpp router so it re-discovers /opt/models after a NEW GGUF
+# is staged. NOTIFIED ONLY from tasks/stage_model.yml when an actual download
+# (or permission correction) occurs — a normal idempotent re-run that finds the
+# files already correct will NOT fire this, so the live router is left
+# untouched. Safe on the idle GPU (router holds no resident model when all
+# entries are "unloaded"; restart is sub-second).
+- name: restart llama-server-router on new GGUF
   ansible.builtin.systemd:
-    name: "{{ llm_aux_service_name }}"
+    name: "{{ llm_router_service_name | default('llama-server-router') }}"
     state: restarted
   become: true
-  listen: "restart llama-server-aux"
 
-- name: Restart llama-server-toolcall
+# Restart handler for preset mode changes (notified by tasks/preset.yml when
+# the preset INI or unit file changes). Distinct from "restart llama-server-router
+# on new GGUF" so each change path can notify independently.
+- name: restart router
   ansible.builtin.systemd:
-    name: "{{ llm_toolcall_service_name }}"
+    name: "{{ llm_router_service_name | default('llama-server-router') }}"
     state: restarted
   become: true
-  listen: "restart llama-server-toolcall"

ansible/roles/llm-inference-multimodel/tasks/firewall.yml

@@ -1,19 +1,19 @@
 ---
 # ------------------------------------------------------------------------------
 # FILE: roles/llm-inference-multimodel/tasks/firewall.yml
-# DESCRIPTION: Phase 3 — scope :8001 (new) and reconsider :8000 (existing
-#              pattern) exposure, per plan §5.
+# DESCRIPTION: Phase 3 — scope :8002 (production Qwen) exposure.
 #
-#              Current baseline pattern (0.0.0.0:8000, no auth) is a
-#              pre-existing flagged issue — this role does NOT repeat it
-#              uncritically for the new port, and tightens both:
-#              1. Bind address: handled in systemd.yml templates via
-#                 {{ llm_bind_address }} (default 10.1.71.130, NOT 0.0.0.0).
-#              2. Firewall: ufw rules scoping both ports to
-#                 {{ llm_allowed_source_cidr }} rather than open LAN-wide.
+#              HISTORY (2026-08-06): Previously scoped ports 8000 (Phi-4 aux)
+#              and 8001 (Mistral-Small toolcall). Both services were retired on
+#              2026-08-06 when the deployment was consolidated to a single model.
+#              See git log for the prior rule definitions.
 #
-#              Idempotent: named rule comments + `state: present` so reruns
-#              don't duplicate rules (per plan §4 idempotency note).
+#              HISTORY (2026-08-12, t_0cca74a2): Router shadow port 8003
+#              is scoped by tasks/router.yml (its own router_firewall phase),
+#              not by this file. This file only manages the production :8002 rule.
+#
+#              Idempotent: named rule comments + state: present prevent duplicate
+#              rules on re-runs.
 # ------------------------------------------------------------------------------
 
 - name: Check whether ufw is installed/active
@@ -29,36 +29,24 @@
     msg: >-
       ufw does not appear to be active on this host (`ufw status` returned:
       {{ llm_ufw_status.stdout | default('n/a') }}). Firewall scoping for
-      ports {{ llm_aux_port }}/{{ llm_toolcall_port }} was skipped. This is a
-      gap vs plan §5 item 2 — flag to Ryan before relying on bind-address
-      alone for exposure control.
+      port {{ llm_qwen_port }} was skipped. Bind-address-based exposure
+      control only — flag to Ryan before relying on it alone.
   when: "'Status: active' not in (llm_ufw_status.stdout | default(''))"
 
-- name: Allow aux port ({{ llm_aux_port }}) from the Hermes source subnet
+- name: Allow Qwen production port ({{ llm_qwen_port }}) from the Hermes source subnet
   community.general.ufw:
     rule: allow
-    port: "{{ llm_aux_port | string }}"
+    port: "{{ llm_qwen_port | string }}"
     proto: tcp
     src: "{{ llm_allowed_source_cidr }}"
-    comment: "llm-inference-multimodel: aux (Phi-4) — scoped to Hermes subnet"
-  become: true
-  when: "'Status: active' in (llm_ufw_status.stdout | default(''))"
-
-- name: Allow tool-calling port ({{ llm_toolcall_port }}) from the Hermes source subnet
-  community.general.ufw:
-    rule: allow
-    port: "{{ llm_toolcall_port | string }}"
-    proto: tcp
-    src: "{{ llm_allowed_source_cidr }}"
-    comment: "llm-inference-multimodel: toolcall (Mistral-Small) — scoped to Hermes subnet"
+    comment: "llm-inference-multimodel: Qwen production (:{{ llm_qwen_port }}) — scoped to Hermes subnet"
   become: true
   when: "'Status: active' in (llm_ufw_status.stdout | default(''))"
 
 - name: Report firewall scoping applied
   ansible.builtin.debug:
     msg: >-
-      Firewall scoping applied for ports {{ llm_aux_port }} and
-      {{ llm_toolcall_port }}, restricted to source {{ llm_allowed_source_cidr }}.
-      Reverse-proxy + API-key enforcement (plan §5 item 3) is NOT implemented
-      by this role — flagged as an optional follow-up phase, not bundled into
-      this minimum-viable rollout.
+      Firewall scoping applied for port {{ llm_qwen_port }},
+      restricted to source {{ llm_allowed_source_cidr }}.
+      Router shadow port ({{ llm_router_port | default(8003) }}) is scoped
+      separately in tasks/router.yml (router_firewall phase).

ansible/roles/llm-inference-multimodel/tasks/main.yml

@@ -33,3 +33,30 @@
 # Phase 4 — Verify (start both services, curl smoke test, nvidia-smi VRAM check)
 - import_tasks: verify.yml
   tags: [verify]
+
+# Phase R — Router shadow deployment (port 8003)
+# Gates on llm_router_enabled (default false — complete no-op until enabled).
+# Use playbooks/day1_deploy_llm_router_shadow.yml which sets llm_router_enabled: true.
+#
+# NOTE: This phase uses include_tasks (dynamic) rather than import_tasks (static)
+# to prevent Ansible's tag-inheritance from applying the router_* tags to ALL
+# tasks in all other phases. With import_tasks, every task in every phase gets
+# the parent tag set merged in, making --tags router_* run the full role.
+# include_tasks evaluates tags at runtime, keeping phase isolation clean.
+# Trade-off: include_tasks does NOT forward tags to child tasks' own tag sets,
+# so individual router sub-phase tags (router_systemd, router_firewall, etc.)
+# must be applied via --tags on the CLI when running in isolation.
+# Added 2026-08-12 (t_0cca74a2): router mode migration — War Machine.
+- include_tasks: router.yml
+  when: llm_router_enabled | default(false)
+  tags: [always]
+
+# Phase P — Router preset mode / alias deployment
+# Gates on llm_router_preset_enabled (default false — complete no-op until enabled).
+# Use playbooks/day2_add_phi_alias.yml which sets llm_router_preset_enabled: true.
+# Purpose: switch from --models-dir to --models-preset to enable model aliases.
+# The Phi-3.5-mini-instruct-Q8_0 entry gains alias "Phi-3.5-mini-instruct-8bit".
+# Added 2026-08-12 (t_9adf0889): Phi alias — War Machine.
+- include_tasks: preset.yml
+  when: llm_router_preset_enabled | default(false)
+  tags: [always]

ansible/roles/llm-inference-multimodel/tasks/models.yml

@@ -1,13 +1,28 @@
 ---
 # ------------------------------------------------------------------------------
 # FILE: roles/llm-inference-multimodel/tasks/models.yml
-# DESCRIPTION: Phase 1 — download both GGUFs to {{ llm_models_dir }}.
-#              Idempotent: reuses the stat + size-threshold guard pattern
-#              from the llm-inference-homelab skill / roles/llm-inference's
-#              serve.yml, so reruns don't re-pull 8.5GB / 11.7GB files.
+# DESCRIPTION: Phase 1 — ensure the production Qwen GGUF is present on disk.
+#              Idempotent: reuses the stat + size-threshold guard pattern.
 #
-#              Does NOT touch the existing Gemma GGUF — separate directory
-#              entries, no overlap, no deletion of anything pre-existing.
+#              HISTORY (2026-08-06): This file previously downloaded Phi-4-14B
+#              (aux, port 8000) and Mistral-Small-24B (tool-calling, port 8001).
+#              Both were retired on 2026-08-06 when the deployment was
+#              consolidated to a single model (Qwen2.5-14B-Instruct-1M, port
+#              8002). The download tasks and VRAM co-residency logic were
+#              removed from this file; see git log if a rollback needs them.
+#
+#              HISTORY (2026-08-07): Qwen2.5-14B-Instruct-1M was superseded by
+#              Qwen3.6-35B-A3B-UD-Q4_K_S (see task t_2ffc0f63). The model
+#              was downloaded out-of-band (direct wget per t_2ffc0f63 runbook)
+#              rather than via this role's get_url pattern. The path and
+#              variables below are updated to reflect the current production
+#              model; the download task is a no-op if the file is already
+#              present (which it is on astro-orbiter as of 2026-08-07+).
+#
+#              2026-08-12 (t_0cca74a2): Cleaned up stale Phi-4/Mistral tasks
+#              that referenced undefined variables after the Aug 2026
+#              consolidation. models.yml now only manages the Qwen3.6-35B
+#              model that is the sole production model.
 # ------------------------------------------------------------------------------
 
 - name: Create models directory
@@ -19,54 +34,43 @@
     mode: "0755"
   become: true
 
-# --- Aux model (Phi-4-14B Q4_K_M) --------------------------------------------
+# --- Production model: Qwen3.6-35B-A3B-UD-Q4_K_S (port 8002 / router :8003) -
 
-- name: Check if aux model GGUF already exists
+- name: Check if Qwen3.6-35B GGUF is present on disk
   ansible.builtin.stat:
-    path: "{{ llm_aux_model_path }}"
-  register: llm_aux_model_stat
+    path: "{{ llm_qwen_model_path }}"
+  register: llm_qwen_model_stat
 
-- name: Download aux model — Phi-4-14B-Q4_K_M GGUF
-  ansible.builtin.get_url:
-    url: "{{ llm_aux_model_url }}"
-    dest: "{{ llm_aux_model_path }}"
-    headers:
-      Authorization: "Bearer {{ llm_hf_token }}"
-    owner: "{{ llm_service_user }}"
-    group: "{{ llm_service_user }}"
-    mode: "0644"
-    timeout: 7200
-    force: false
-  become: true
-  no_log: true
-  # Idempotency guard: skip if file exists and is above the min-size threshold
-  # (catches partial/truncated downloads from an interrupted prior run).
-  when: not llm_aux_model_stat.stat.exists or (llm_aux_model_stat.stat.size | int) < (llm_aux_model_min_bytes | int)
-
-# --- Tool-calling model (Mistral-Small-24B Q3_K_M) ---------------------------
-
-- name: Check if tool-calling model GGUF already exists
-  ansible.builtin.stat:
-    path: "{{ llm_toolcall_model_path }}"
-  register: llm_toolcall_model_stat
-
-- name: Download tool-calling model — Mistral-Small-24B-Instruct-2501 Q3_K_M GGUF
-  ansible.builtin.get_url:
-    url: "{{ llm_toolcall_model_url }}"
-    dest: "{{ llm_toolcall_model_path }}"
-    headers:
-      Authorization: "Bearer {{ llm_hf_token }}"
-    owner: "{{ llm_service_user }}"
-    group: "{{ llm_service_user }}"
-    mode: "0644"
-    timeout: 7200
-    force: false
-  become: true
-  no_log: true
-  when: not llm_toolcall_model_stat.stat.exists or (llm_toolcall_model_stat.stat.size | int) < (llm_toolcall_model_min_bytes | int)
-
-- name: Report model files present on disk
+- name: Report Qwen model presence (model was downloaded out-of-band via t_2ffc0f63)
   ansible.builtin.debug:
-    msg:
-      - "Aux model:        {{ llm_aux_model_path }}"
-      - "Tool-calling model: {{ llm_toolcall_model_path }}"
+    msg: >-
+      Qwen model at {{ llm_qwen_model_path }}:
+      exists={{ llm_qwen_model_stat.stat.exists | default(false) }},
+      size={{ (llm_qwen_model_stat.stat.size | default(0) | int / 1073741824) | round(2) }}GB
+  when: llm_qwen_model_stat.stat.exists | default(false)
+
+- name: WARN — Qwen model GGUF not found at expected path
+  ansible.builtin.debug:
+    msg: >-
+      WARNING: Qwen model NOT found at {{ llm_qwen_model_path }}.
+      This model was originally downloaded via task t_2ffc0f63 (direct wget,
+      not via this role's get_url). If the file is missing, re-download it
+      manually or add a get_url task here with the correct HuggingFace URL.
+      Expected URL (bartowski UD-Q4_K_S):
+      https://huggingface.co/bartowski/Qwen3.6-35B-A3B-UD-Q4_K_S-GGUF/resolve/main/Qwen3.6-35B-A3B-UD-Q4_K_S.gguf
+  when: not (llm_qwen_model_stat.stat.exists | default(false))
+
+# --- Staged GGUF models (data-driven, idempotent) ----------------------------
+# Ensure every entry in llm_staged_models is present in llm_models_dir with the
+# EXACT expected byte size. When present AND size matches, this is a pure
+# no-op: no download, no service touch. When a genuine new/mismatched GGUF is
+# detected, it is downloaded + ownership/mode corrected and the router restart
+# handler is notified so the llama.cpp router re-discovers the models_dir.
+# Driven entirely by inventory vars (host_vars) — nothing hardcoded here, so
+# adding a future model = append to llm_staged_models in host_vars.
+- name: Stage data-driven GGUF models into {{ llm_models_dir }}
+  ansible.builtin.include_tasks: stage_model.yml
+  loop: "{{ llm_staged_models | default([]) }}"
+  loop_control:
+    loop_var: staged_model
+  tags: [models]

ansible/roles/llm-inference-multimodel/tasks/preset.yml

@@ -0,0 +1,161 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: roles/llm-inference-multimodel/tasks/preset.yml
+# DESCRIPTION: Phase P — deploy --models-preset INI file and switch the router
+#              from --models-dir to --models-preset mode.
+#
+#              Purpose: preset mode is required to add model aliases. The alias
+#              field in the INI lets the Phi-3.5-mini-instruct-Q8_0 entry also
+#              respond to "Phi-3.5-mini-instruct-8bit" — Ryan's Hermes
+#              auxiliary.title_generation already uses this friendlier name.
+#
+#              This phase is gated on llm_router_preset_enabled | default(false).
+#              With the default (false) it is a no-op. Flip to true in a playbook
+#              or extra-vars to activate.
+#
+#              Tag: router_preset (deploy INI + restart service on change)
+#
+#              Order: run AFTER router_systemd. The systemd unit template
+#              conditionally emits --models-preset when llm_router_preset_enabled
+#              is true; this phase deploys the INI the unit references.
+#
+#              Added 2026-08-12 (t_9adf0889): Phi alias — War Machine.
+# ------------------------------------------------------------------------------
+
+# =============================================================================
+# TAG: router_preset
+# Deploy the preset INI and restart the router if the INI or unit changed.
+# =============================================================================
+
+- name: "[router_preset] Deploy preset INI to {{ llm_router_preset_path }}"
+  ansible.builtin.template:
+    src: llama-server-router-preset.ini.j2
+    dest: "{{ llm_router_preset_path }}"
+    owner: root
+    group: root
+    mode: "0644"
+  become: true
+  register: llm_router_preset_deployed
+  notify:
+    - restart router
+  when: llm_router_preset_enabled | default(false)
+  tags: [router_preset]
+
+- name: "[router_preset] Report preset INI deployment result"
+  ansible.builtin.debug:
+    msg: >-
+      Preset INI {{ 'deployed (changed)' if llm_router_preset_deployed.changed | default(false) else 'already up-to-date (no change)' }}
+      at {{ llm_router_preset_path }}.
+  when: llm_router_preset_enabled | default(false)
+  tags: [router_preset]
+
+- name: "[router_preset] Flush handlers so router restarts before verification"
+  ansible.builtin.meta: flush_handlers
+  when: llm_router_preset_enabled | default(false)
+  tags: [router_preset]
+
+# =============================================================================
+# Verification: confirm both the original ID and the alias appear in /v1/models
+# =============================================================================
+
+- name: "[router_preset] Wait for router /health after potential restart"
+  ansible.builtin.uri:
+    url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/health"
+    status_code: 200
+    timeout: 30
+  retries: 12
+  delay: 5
+  register: llm_preset_health
+  until: llm_preset_health.status == 200
+  when: llm_router_preset_enabled | default(false)
+  tags: [router_preset]
+
+- name: "[router_preset] Query /v1/models to verify preset loaded"
+  ansible.builtin.uri:
+    url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/models"
+    status_code: 200
+    return_content: true
+    timeout: 30
+  register: llm_preset_models
+  when: llm_router_preset_enabled | default(false)
+  tags: [router_preset]
+
+- name: "[router_preset] Extract model IDs and aliases from /v1/models"
+  ansible.builtin.set_fact:
+    llm_preset_model_ids: >-
+      {{ llm_preset_models.json.data | map(attribute='id') | list }}
+    llm_preset_model_aliases: >-
+      {{ llm_preset_models.json.data | map(attribute='aliases') | flatten | list }}
+  when:
+    - llm_router_preset_enabled | default(false)
+    - llm_preset_models is defined
+  tags: [router_preset]
+
+- name: "[router_preset] VERIFY: Phi original ID (Phi-3.5-mini-instruct-Q8_0) present in /v1/models"
+  ansible.builtin.fail:
+    msg: >-
+      PRESET VERIFY FAIL: 'Phi-3.5-mini-instruct-Q8_0' not found in /v1/models IDs.
+      Returned IDs: {{ llm_preset_model_ids | default([]) }}
+      Check the preset INI section name.
+  when:
+    - llm_router_preset_enabled | default(false)
+    - llm_preset_model_ids is defined
+    - "'Phi-3.5-mini-instruct-Q8_0' not in llm_preset_model_ids"
+  tags: [router_preset]
+
+- name: "[router_preset] VERIFY: Phi alias (Phi-3.5-mini-instruct-8bit) present in /v1/models aliases"
+  ansible.builtin.fail:
+    msg: >-
+      PRESET VERIFY FAIL: alias 'Phi-3.5-mini-instruct-8bit' not found in /v1/models.
+      Returned IDs:     {{ llm_preset_model_ids | default([]) }}
+      Returned aliases: {{ llm_preset_model_aliases | default([]) }}
+      Check the 'alias' field in the preset INI for the [Phi-3.5-mini-instruct-Q8_0] section.
+  when:
+    - llm_router_preset_enabled | default(false)
+    - llm_preset_model_ids is defined
+    - "'Phi-3.5-mini-instruct-8bit' not in llm_preset_model_ids and 'Phi-3.5-mini-instruct-8bit' not in llm_preset_model_aliases"
+  tags: [router_preset]
+
+- name: "[router_preset] VERIFY: Qwen model ID unchanged"
+  ansible.builtin.fail:
+    msg: >-
+      PRESET VERIFY FAIL: 'Qwen3.6-35B-A3B-UD-Q4_K_S' not found in /v1/models.
+      Returned IDs: {{ llm_preset_model_ids | default([]) }}
+  when:
+    - llm_router_preset_enabled | default(false)
+    - llm_preset_model_ids is defined
+    - "'Qwen3.6-35B-A3B-UD-Q4_K_S' not in llm_preset_model_ids"
+  tags: [router_preset]
+
+- name: "[router_preset] VERIFY: Llama model ID unchanged"
+  ansible.builtin.fail:
+    msg: >-
+      PRESET VERIFY FAIL: 'Meta-Llama-3.1-8B-Instruct-Q4_K_M' not found in /v1/models.
+      Returned IDs: {{ llm_preset_model_ids | default([]) }}
+  when:
+    - llm_router_preset_enabled | default(false)
+    - llm_preset_model_ids is defined
+    - "'Meta-Llama-3.1-8B-Instruct-Q4_K_M' not in llm_preset_model_ids"
+  tags: [router_preset]
+
+- name: "[router_preset] VERIFY PASS — preset mode active, all models and alias confirmed"
+  ansible.builtin.debug:
+    msg:
+      - "======================================================================"
+      - "PRESET VERIFY PASS: --models-preset mode active on llama-server-router."
+      - ""
+      - "  /v1/models IDs:     {{ llm_preset_model_ids | default([]) }}"
+      - "  /v1/models aliases: {{ llm_preset_model_aliases | default([]) }}"
+      - ""
+      - "  'Phi-3.5-mini-instruct-Q8_0'  => PRESENT (primary ID)"
+      - "  'Phi-3.5-mini-instruct-8bit'  => PRESENT (alias — Ryan's title_generation target)"
+      - "  'Qwen3.6-35B-A3B-UD-Q4_K_S'  => PRESENT"
+      - "  'Meta-Llama-3.1-8B-Instruct-Q4_K_M' => PRESENT"
+      - ""
+      - "  GH #22364 note: a 'default' model entry may also appear above."
+      - "  This is an expected upstream behavior in preset mode — cosmetic only."
+      - "======================================================================"
+  when:
+    - llm_router_preset_enabled | default(false)
+    - llm_preset_model_ids is defined
+  tags: [router_preset]

ansible/roles/llm-inference-multimodel/tasks/router.yml

@@ -0,0 +1,651 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: roles/llm-inference-multimodel/tasks/router.yml
+# DESCRIPTION: Phase R — llama.cpp router mode shadow deployment (port 8003).
+#
+#              This phase is ADDITIVE and IDEMPOTENT. The existing production
+#              unit (llama-server-qwen, port 8002) is never touched here.
+#
+#              All tasks are gated on  llm_router_enabled | default(false).
+#              With the default (false) this entire file is a no-op, making
+#              it safe to import unconditionally from main.yml.
+#
+#              When llm_router_enabled: true (set by the shadow playbook or
+#              extra-vars), this phase:
+#                router_systemd  — deploy the router unit file (no auto-start)
+#                router_firewall — open port 8003 scoped to the Hermes subnet
+#                router_verify   — start router, run all 4 validation gates
+#                router_ui_check — (nice-to-have) check bundled SvelteKit UI
+#
+#              Tags map 1:1 to the sub-phases so you can run each independently:
+#                --tags router_systemd,router_firewall,router_verify,router_ui_check
+#
+#              IMPORTANT: router_verify starts the router service. Do not run
+#              router_verify unless router_systemd and router_firewall have
+#              already run (or use the full shadow playbook which runs all four).
+#
+#              Added 2026-08-12 (t_0cca74a2): Qwen router migration — War Machine.
+#              Approved by Ryan 2026-08-12 (see task comment thread).
+# ------------------------------------------------------------------------------
+
+
+# =============================================================================
+# TAG: router_systemd
+# Deploy the router unit file and reload systemd.
+# Does NOT start the service — that is Phase router_verify only.
+# =============================================================================
+
+- name: "[router_systemd] Deploy llama-server-router systemd unit (shadow, port {{ llm_router_port }})"
+  ansible.builtin.template:
+    src: llama-server-router.service.j2
+    dest: "/etc/systemd/system/{{ llm_router_service_name }}.service"
+    owner: root
+    group: root
+    mode: "0644"
+  become: true
+  register: llm_router_unit_deployed
+  notify:
+    - reload systemd
+  when: llm_router_enabled | default(false)
+  tags: [router_systemd]
+
+- name: "[router_systemd] Flush handlers so daemon-reload lands before router_verify starts the unit"
+  ansible.builtin.meta: flush_handlers
+  when: llm_router_enabled | default(false)
+  tags: [router_systemd]
+
+# =============================================================================
+# TAG: router_firewall
+# Open port 8003 in ufw scoped to the Hermes source subnet.
+# Idempotent: named comment + state: present prevents duplicate rules.
+# =============================================================================
+
+- name: "[router_firewall] Check whether ufw is installed/active"
+  ansible.builtin.command:
+    cmd: ufw status
+  register: llm_router_ufw_status
+  changed_when: false
+  failed_when: false
+  become: true
+  when: llm_router_enabled | default(false)
+  tags: [router_firewall]
+
+- name: "[router_firewall] WARNING — ufw not active, port {{ llm_router_port }} scoping cannot be applied"
+  ansible.builtin.debug:
+    msg: >-
+      ufw does not appear to be active on this host. Firewall scoping for
+      port {{ llm_router_port }} was skipped. Bind address alone
+      ({{ llm_router_bind_address }}) limits exposure — flag to Ryan.
+  when:
+    - llm_router_enabled | default(false)
+    - "'Status: active' not in (llm_router_ufw_status.stdout | default(''))"
+  tags: [router_firewall]
+
+- name: "[router_firewall] Allow router port ({{ llm_router_port }}) from Hermes source subnet"
+  community.general.ufw:
+    rule: allow
+    port: "{{ llm_router_port | string }}"
+    proto: tcp
+    src: "{{ llm_router_allowed_source_cidr }}"
+    comment: "llm-inference-multimodel: router shadow ({{ llm_router_port }}) — scoped to Hermes subnet"
+  become: true
+  when:
+    - llm_router_enabled | default(false)
+    - "'Status: active' in (llm_router_ufw_status.stdout | default(''))"
+  tags: [router_firewall]
+
+# =============================================================================
+# TAG: router_verify
+# Start the router, then run the 4 validation gates defined in the proposal.
+# This is the ONLY phase that starts llama-server-router.
+# Gates 1-3 are hard failures (play fails on any gate miss).
+# Gate 4 (UI) is informational only.
+# =============================================================================
+
+- name: "[router_verify] Pre-check: confirm port {{ llm_router_port }} is not already bound"
+  ansible.builtin.command:
+    cmd: "ss -ltnp"
+  register: llm_router_port_check
+  changed_when: false
+  failed_when: false
+  become: true
+  when: llm_router_enabled | default(false)
+  tags: [router_verify]
+
+- name: "[router_verify] Check if the process on port {{ llm_router_port }} is already our router service"
+  ansible.builtin.set_fact:
+    llm_router_port_bound: "{{ ':' + (llm_router_port | string) + ' ' in (llm_router_port_check.stdout | default('')) or ':' + (llm_router_port | string) + ':' in (llm_router_port_check.stdout | default('')) }}"
+    # ss output format: "LISTEN 0 512 10.1.71.130:8003 ... users:((\"llama-server\",pid=N,...))"
+    # The router runs as "llama-server" process name; use the systemd service to verify it's ours
+    llm_router_port_already_ours: >-
+      {{ 'llama-server' in (llm_router_port_check.stdout | default('')) and
+         ((':' + (llm_router_port | string) + ' ') in (llm_router_port_check.stdout | default('')) or
+          (':' + (llm_router_port | string) + ':') in (llm_router_port_check.stdout | default(''))) }}
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_port_check is defined
+  tags: [router_verify]
+
+- name: "[router_verify] Fail if port {{ llm_router_port }} is in use by an UNKNOWN service (not our router)"
+  ansible.builtin.fail:
+    msg: >-
+      Port {{ llm_router_port }} is already bound on astro-orbiter by an UNKNOWN
+      process (not llama-server-router). Cannot safely start our router on this port.
+      Check with 'ss -ltnp | grep :{{ llm_router_port }}' and resolve before retrying.
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_port_bound | default(false)
+    - not (llm_router_port_already_ours | default(false))
+  tags: [router_verify]
+
+- name: "[router_verify] Note: port {{ llm_router_port }} already bound by our router — skip start, proceed to gates"
+  ansible.builtin.debug:
+    msg: >-
+      Port {{ llm_router_port }} is already bound by {{ llm_router_service_name }}.
+      Skipping start task — router is already running. Proceeding to validation gates.
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_port_bound | default(false)
+    - llm_router_port_already_ours | default(false)
+  tags: [router_verify]
+
+- name: "[router_verify] Enable and start llama-server-router (shadow, port {{ llm_router_port }})"
+  ansible.builtin.systemd:
+    name: "{{ llm_router_service_name }}"
+    state: "{{ 'restarted' if (llm_router_unit_deployed.changed | default(false)) else 'started' }}"
+    enabled: true
+    daemon_reload: true
+  become: true
+  when:
+    - llm_router_enabled | default(false)
+    - not (llm_router_port_already_ours | default(false))
+  tags: [router_verify]
+
+# --- Gate 1: /health (waits for cold model load ~30-60s for 35B) ---
+# IMPORTANT: The router's model load requires free VRAM. If llama-server-qwen
+# (production, port 8002) is running, it holds ~20GB of VRAM and the router
+# cannot load Qwen concurrently on a 24GB card.
+# This task temporarily stops the production service to free VRAM for the
+# shadow validation. The production service is restarted after all gates pass.
+# This is the expected shadow-test flow for a 24GB single-GPU host.
+
+- name: "[router_verify] VRAM GATE PRE: Check if production service is holding VRAM"
+  ansible.builtin.command:
+    cmd: nvidia-smi --query-compute-apps=pid,name,used_memory --format=csv,noheader
+  register: llm_router_vram_pre_stop
+  changed_when: false
+  become: true
+  when: llm_router_enabled | default(false)
+  tags: [router_verify]
+
+- name: "[router_verify] VRAM GATE PRE: Stop production llama-server-qwen to free VRAM for router validation"
+  ansible.builtin.systemd:
+    name: "{{ llm_qwen_service_name }}"
+    state: stopped
+  become: true
+  register: llm_router_qwen_stopped
+  when:
+    - llm_router_enabled | default(false)
+    - "'llama-server' in (llm_router_vram_pre_stop.stdout | default(''))"
+  tags: [router_verify]
+
+- name: "[router_verify] VRAM GATE PRE: Wait 5s for VRAM to be released after production stop"
+  ansible.builtin.pause:
+    seconds: 5
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_qwen_stopped is defined
+    - llm_router_qwen_stopped.changed | default(false)
+  tags: [router_verify]
+
+- name: "[router_verify] VRAM GATE PRE: Report VRAM state after stopping production service"
+  ansible.builtin.command:
+    cmd: nvidia-smi --query-gpu=memory.used,memory.total --format=csv,noheader
+  register: llm_router_vram_after_stop
+  changed_when: false
+  become: true
+  when: llm_router_enabled | default(false)
+  tags: [router_verify]
+
+- name: "[router_verify] VRAM GATE PRE: Report VRAM available for router validation"
+  ansible.builtin.debug:
+    msg: >-
+      VRAM after stopping production service:
+      {{ llm_router_vram_after_stop.stdout | default('unknown') }}.
+      {{ 'Production service was stopped to free VRAM for router validation.' if (llm_router_qwen_stopped.changed | default(false)) else 'Production service was not running (VRAM already free).' }}
+      Router model load requires ~20GB. NOTE: production service will be restarted after validation.
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_vram_after_stop is defined
+  tags: [router_verify]
+
+- name: "[router_verify] GATE 1a: Wait for router /health (up to 5min — cold model load)"
+  ansible.builtin.uri:
+    url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/health"
+    status_code: 200
+  register: llm_router_health
+  retries: 30
+  delay: 10
+  until: llm_router_health.status == 200
+  when: llm_router_enabled | default(false)
+  tags: [router_verify]
+
+# Trigger the model load — router lazy-loads models on first request.
+# This POST will block until the model is loaded (~30-60s for 35B).
+# We use a short max_tokens=5 probe so the response is nearly instant
+# after load completes. The timeout is set high (300s) to cover cold load.
+- name: "[router_verify] GATE 1a: Trigger model load via first request (router lazy-loads on demand)"
+  ansible.builtin.uri:
+    url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/chat/completions"
+    method: POST
+    body_format: json
+    body:
+      model: "{{ llm_router_expected_model_id }}"
+      messages:
+        - role: user
+          content: "Reply with one word: hello"
+      max_tokens: 5
+      temperature: 0.0
+    status_code: 200
+    return_content: true
+    timeout: 300
+  register: llm_router_warmup
+  when: llm_router_enabled | default(false)
+  tags: [router_verify]
+
+- name: "[router_verify] GATE 1a: Report warmup response (confirms model loaded successfully)"
+  ansible.builtin.debug:
+    msg:
+      - "Model loaded via warmup request. finish_reason={{ llm_router_warmup.json.choices[0].finish_reason | default('unknown') }}"
+      - "Response preview: {{ llm_router_warmup.json.choices[0].message.content | default('(empty)') | truncate(100) }}"
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_warmup is defined
+    - llm_router_warmup.json is defined
+  tags: [router_verify]
+
+# --- Gate 1: /v1/models — Qwen present, n_ctx_train >= 64K ---
+
+- name: "[router_verify] GATE 1b: Query /v1/models on router endpoint"
+  ansible.builtin.uri:
+    url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/models"
+    status_code: 200
+    return_content: true
+  register: llm_router_models
+  when: llm_router_enabled | default(false)
+  tags: [router_verify]
+
+- name: "[router_verify] GATE 1b: Report models returned by router"
+  ansible.builtin.debug:
+    msg:
+      - "Router /v1/models response: {{ llm_router_models.json.data | map(attribute='id') | list }}"
+      - "Model status: {{ llm_router_models.json.data | map(attribute='status') | map(attribute='value') | list }}"
+      - "ctx-size in args: {{ llm_router_models.json.data[0].status.args | select('match', '^[0-9]+$') | list }}"
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_models is defined
+  tags: [router_verify]
+
+- name: "[router_verify] GATE 1b: Fail if expected model ID not found in /v1/models"
+  ansible.builtin.fail:
+    msg: >-
+      GATE 1 FAIL: Model '{{ llm_router_expected_model_id }}' not found in router
+      /v1/models response. Returned IDs:
+      {{ llm_router_models.json.data | map(attribute='id') | list }}
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_models is defined
+    - llm_router_models.json.data | selectattr('id', 'equalto', llm_router_expected_model_id) | list | length == 0
+  tags: [router_verify]
+
+- name: "[router_verify] GATE 1b: Extract ctx-size from model args (router uses status.args, not meta.n_ctx)"
+  ansible.builtin.set_fact:
+    llm_router_qwen_n_ctx: >-
+      {%- set model = llm_router_models.json.data | selectattr('id', 'equalto', llm_router_expected_model_id) | first -%}
+      {%- set args = model.status.args -%}
+      {%- set ctx_idx = args.index('--ctx-size') if '--ctx-size' in args else -1 -%}
+      {{ args[ctx_idx + 1] | int if ctx_idx >= 0 else 0 }}
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_models is defined
+    - llm_router_models.json.data | selectattr('id', 'equalto', llm_router_expected_model_id) | list | length > 0
+  tags: [router_verify]
+
+- name: "[router_verify] GATE 1b: Fail if n_ctx < 64000 (Hermes 64K context floor)"
+  ansible.builtin.fail:
+    msg: >-
+      GATE 1 FAIL: Router args show --ctx-size={{ llm_router_qwen_n_ctx }} for
+      {{ llm_router_expected_model_id }}. Hermes requires >= 64000 (64K floor).
+      Check --ctx-size in the unit template and verify the model args.
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_qwen_n_ctx is defined
+    - llm_router_qwen_n_ctx | int < 64000
+  tags: [router_verify]
+
+- name: "[router_verify] GATE 1b: PASS — n_ctx >= 64K confirmed (from router model args)"
+  ansible.builtin.debug:
+    msg: "GATE 1 PASS: Router passes --ctx-size={{ llm_router_qwen_n_ctx }} for {{ llm_router_expected_model_id }} (>= 64000 required)."
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_qwen_n_ctx is defined
+    - llm_router_qwen_n_ctx | int >= 64000
+  tags: [router_verify]
+
+# --- Gate 2: Tool-calling through router path (hard gate) ---
+# Tests the tool-calling trigger path THROUGH the router proxy, not via the
+# bare llama-server. Router mode is a different process/proxy path — parity
+# with port 8002 is not assumed.
+
+- name: "[router_verify] GATE 2: Tool-calling trigger probe (weather probe — should return tool_calls)"
+  ansible.builtin.uri:
+    url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/chat/completions"
+    method: POST
+    body_format: json
+    body:
+      model: "{{ llm_router_expected_model_id }}"
+      messages:
+        - role: user
+          content: "What is the current weather in Chicago? Use the provided tool."
+      tools:
+        - type: function
+          function:
+            name: get_weather
+            description: "Get current weather conditions for a city"
+            parameters:
+              type: object
+              properties:
+                city:
+                  type: string
+                  description: "The city name"
+              required:
+                - city
+      temperature: 0.0
+    status_code: 200
+    return_content: true
+    timeout: 120
+  register: llm_router_toolcall_probe
+  when: llm_router_enabled | default(false)
+  tags: [router_verify]
+
+- name: "[router_verify] GATE 2: Fail if tool-calling probe did not return finish_reason=tool_calls"
+  ansible.builtin.fail:
+    msg: >-
+      GATE 2 FAIL: Tool-calling probe returned finish_reason=
+      {{ llm_router_toolcall_probe.json.choices[0].finish_reason | default('(missing)') }}
+      instead of 'tool_calls'. Router is not correctly proxying tool-call requests.
+      Full response: {{ llm_router_toolcall_probe.json | to_json }}
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_toolcall_probe is defined
+    - llm_router_toolcall_probe.json.choices[0].finish_reason | default('') != 'tool_calls'
+  tags: [router_verify]
+
+- name: "[router_verify] GATE 2: Validate tool_calls arguments are valid JSON"
+  ansible.builtin.set_fact:
+    llm_router_toolcall_args: >-
+      {{ llm_router_toolcall_probe.json.choices[0].message.tool_calls[0].function.arguments | default('') }}
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_toolcall_probe is defined
+    - llm_router_toolcall_probe.json.choices[0].finish_reason | default('') == 'tool_calls'
+  tags: [router_verify]
+
+- name: "[router_verify] GATE 2: PASS — tool_calls returned with arguments"
+  ansible.builtin.debug:
+    msg:
+      - "GATE 2 PASS: Router proxied tool-calling correctly."
+      - "finish_reason: {{ llm_router_toolcall_probe.json.choices[0].finish_reason }}"
+      - "function: {{ llm_router_toolcall_probe.json.choices[0].message.tool_calls[0].function.name | default('(unknown)') }}"
+      - "arguments: {{ llm_router_toolcall_args | default('(none)') }}"
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_toolcall_probe is defined
+    - llm_router_toolcall_probe.json.choices[0].finish_reason | default('') == 'tool_calls'
+  tags: [router_verify]
+
+# --- Gate 2b: Hallucination stress test (should NOT trigger tool_calls) ---
+
+- name: "[router_verify] GATE 2b: Hallucination stress test (no-tool prompt — should return stop)"
+  ansible.builtin.uri:
+    url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/v1/chat/completions"
+    method: POST
+    body_format: json
+    body:
+      model: "{{ llm_router_expected_model_id }}"
+      messages:
+        - role: user
+          content: "Tell me a brief fact about the planet Mars. Do not call any functions."
+      tools:
+        - type: function
+          function:
+            name: get_weather
+            description: "Get current weather conditions for a city"
+            parameters:
+              type: object
+              properties:
+                city:
+                  type: string
+              required:
+                - city
+      temperature: 0.1
+    status_code: 200
+    return_content: true
+    timeout: 120
+  register: llm_router_halluc_probe
+  when: llm_router_enabled | default(false)
+  tags: [router_verify]
+
+- name: "[router_verify] GATE 2b: Fail if hallucination stress test triggered spurious tool_calls"
+  ansible.builtin.fail:
+    msg: >-
+      GATE 2b FAIL: Hallucination stress test returned finish_reason=tool_calls
+      (spurious tool call on an unrelated prompt). The model is over-triggering
+      tool-calling through the router proxy. Investigate router mode tool-call
+      framing before proceeding.
+      Full response: {{ llm_router_halluc_probe.json | to_json }}
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_halluc_probe is defined
+    - llm_router_halluc_probe.json.choices[0].finish_reason | default('') == 'tool_calls'
+  tags: [router_verify]
+
+- name: "[router_verify] GATE 2b: PASS — hallucination stress test returned stop (no spurious tool_calls)"
+  ansible.builtin.debug:
+    msg: "GATE 2b PASS: finish_reason={{ llm_router_halluc_probe.json.choices[0].finish_reason }} — no spurious tool call."
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_halluc_probe is defined
+    - llm_router_halluc_probe.json.choices[0].finish_reason | default('') != 'tool_calls'
+  tags: [router_verify]
+
+# --- Gate 3: VRAM guard — --models-max 1 confirmed effective ---
+
+- name: "[router_verify] GATE 3: Check VRAM usage after router load (--models-max 1 guard)"
+  ansible.builtin.command:
+    cmd: nvidia-smi --query-gpu=memory.used,memory.total,utilization.gpu --format=csv,noheader
+  register: llm_router_vram_post
+  changed_when: false
+  become: true
+  when: llm_router_enabled | default(false)
+  tags: [router_verify]
+
+- name: "[router_verify] GATE 3: Parse VRAM used (MiB)"
+  ansible.builtin.set_fact:
+    llm_router_vram_used_mib: "{{ llm_router_vram_post.stdout.split(',')[0].strip().split(' ')[0] | int }}"
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_vram_post is defined
+  tags: [router_verify]
+
+- name: "[router_verify] GATE 3: Fail if VRAM usage exceeds safety ceiling ({{ llm_router_vram_max_mib }} MiB)"
+  ansible.builtin.fail:
+    msg: >-
+      GATE 3 FAIL: nvidia-smi reports {{ llm_router_vram_used_mib }} MiB VRAM used,
+      which exceeds the safety ceiling of {{ llm_router_vram_max_mib }} MiB.
+      --models-max 1 may not be effective, or a second model may be resident.
+      Full nvidia-smi output: {{ llm_router_vram_post.stdout }}
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_vram_used_mib is defined
+    - llm_router_vram_used_mib | int > llm_router_vram_max_mib | int
+  tags: [router_verify]
+
+- name: "[router_verify] GATE 3: Count GPU processes (should be exactly 1 — the router's Qwen child)"
+  ansible.builtin.command:
+    cmd: nvidia-smi --query-compute-apps=pid,name --format=csv,noheader
+  register: llm_router_gpu_procs
+  changed_when: false
+  failed_when: false
+  become: true
+  when: llm_router_enabled | default(false)
+  tags: [router_verify]
+
+- name: "[router_verify] GATE 3: PASS — VRAM usage and GPU process count"
+  ansible.builtin.debug:
+    msg:
+      - "GATE 3 PASS: VRAM {{ llm_router_vram_used_mib }} MiB / {{ llm_router_vram_max_mib }} MiB ceiling."
+      - "nvidia-smi compute apps: {{ llm_router_gpu_procs.stdout_lines | default(['(none — model not yet loaded under GPU?']) }}"
+      - "Full nvidia-smi: {{ llm_router_vram_post.stdout }}"
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_vram_used_mib is defined
+    - llm_router_vram_used_mib | int <= llm_router_vram_max_mib | int
+  tags: [router_verify]
+
+- name: "[router_verify] OOM CHECK: Check for OOM events in dmesg (last 120s, router-related)"
+  ansible.builtin.shell:
+    cmd: "dmesg --ctime | tail -200 | grep -i -E 'oom|killed|llama' || true"
+  register: llm_router_oom_check
+  changed_when: false
+  become: true
+  when: llm_router_enabled | default(false)
+  tags: [router_verify]
+
+- name: "[router_verify] OOM CHECK: Report OOM check findings"
+  ansible.builtin.debug:
+    msg: >-
+      OOM/kill events near router start:
+      {{ llm_router_oom_check.stdout if (llm_router_oom_check.stdout | length > 0) else 'None found.' }}
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_oom_check is defined
+  tags: [router_verify]
+
+# --- POST-VALIDATION: Restart production service -----------------------
+# After validation gates: stop the router (to free VRAM), then restart production.
+# The router stays installed and enabled on port 8003 for Ryan's review period —
+# it will restart automatically on next reboot or systemctl start.
+# When Ryan approves cutover, day2_cutover_qwen_to_router.yml will handle the
+# permanent transition (router on :8002, production unit retired).
+
+- name: "[router_verify] POST-VALIDATION: Stop router to free VRAM for production restart"
+  ansible.builtin.systemd:
+    name: "{{ llm_router_service_name }}"
+    state: stopped
+    # Do NOT disable — keep it installed and enabled for Ryan's review.
+    # Router will need to be manually started again for further testing.
+  become: true
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_qwen_stopped is defined
+    - llm_router_qwen_stopped.changed | default(false)
+  tags: [router_verify]
+
+- name: "[router_verify] POST-VALIDATION: Wait 5s for router VRAM to be released"
+  ansible.builtin.pause:
+    seconds: 5
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_qwen_stopped is defined
+    - llm_router_qwen_stopped.changed | default(false)
+  tags: [router_verify]
+
+- name: "[router_verify] POST-VALIDATION: Restart production llama-server-qwen (port 8002)"
+  ansible.builtin.systemd:
+    name: "{{ llm_qwen_service_name }}"
+    state: started
+    enabled: true
+  become: true
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_qwen_stopped is defined
+    - llm_router_qwen_stopped.changed | default(false)
+  tags: [router_verify]
+
+- name: "[router_verify] POST-VALIDATION: Wait for production /health to confirm restart"
+  ansible.builtin.uri:
+    url: "http://{{ llm_bind_address }}:{{ llm_qwen_port }}/health"
+    status_code: 200
+  register: llm_router_qwen_post_health
+  retries: 30
+  delay: 10
+  until: llm_router_qwen_post_health.status == 200
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_qwen_stopped is defined
+    - llm_router_qwen_stopped.changed | default(false)
+  tags: [router_verify]
+
+- name: "[router_verify] POST-VALIDATION: Confirm production is back on port 8002"
+  ansible.builtin.debug:
+    msg: >-
+      Production llama-server-qwen restarted on port {{ llm_qwen_port }} and confirmed healthy.
+      7 Hermes profiles (bruce-banner, groot, happy, heimdall, rocket-raccoon, war-machine, wong)
+      are back to full service. Router (port 8003) is stopped but installed; restart with:
+      systemctl start llama-server-router  (or via a follow-up playbook run).
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_qwen_stopped is defined
+    - llm_router_qwen_stopped.changed | default(false)
+  tags: [router_verify]
+
+# =============================================================================
+# TAG: router_ui_check
+# Nice-to-have: verify the bundled SvelteKit web UI is served.
+# This does NOT fail the playbook on UI error — it is informational only.
+# =============================================================================
+
+- name: "[router_ui_check] GATE 4 (nice-to-have): Check bundled SvelteKit UI returns HTTP 200"
+  ansible.builtin.uri:
+    url: "http://{{ llm_router_bind_address }}:{{ llm_router_port }}/"
+    status_code: [200, 301, 302]
+    return_content: false
+  register: llm_router_ui_check
+  failed_when: false
+  when: llm_router_enabled | default(false)
+  tags: [router_ui_check]
+
+- name: "[router_ui_check] Report UI check result (informational — does not gate cutover)"
+  ansible.builtin.debug:
+    msg: >-
+      GATE 4 (nice-to-have): Bundled UI at http://{{ llm_router_bind_address }}:{{ llm_router_port }}/
+      returned HTTP {{ llm_router_ui_check.status | default('UNREACHABLE') }}.
+      {{ 'PASS — UI accessible.' if (llm_router_ui_check.status | default(0) | int in [200, 301, 302])
+         else 'WARN — UI not accessible. This does NOT block cutover (API traffic only, UI is cosmetic).' }}
+  when:
+    - llm_router_enabled | default(false)
+    - llm_router_ui_check is defined
+  tags: [router_ui_check]
+
+# =============================================================================
+# Summary block — print when all gates pass
+# =============================================================================
+
+- name: "[router_verify] VALIDATION SUMMARY — all hard gates passed"
+  ansible.builtin.debug:
+    msg:
+      - "======================================================================"
+      - "llama-server-router (port {{ llm_router_port }}) shadow deployment PASSED all validation gates."
+      - "Gate 1 (context): n_ctx={{ llm_router_qwen_n_ctx | default('N/A') }} >= 64000 required — PASS"
+      - "Gate 2 (tool-calling through router): finish_reason=tool_calls — PASS"
+      - "Gate 2b (hallucination stress): no spurious tool_calls — PASS"
+      - "Gate 3 (VRAM guard): {{ llm_router_vram_used_mib | default('N/A') }} MiB <= {{ llm_router_vram_max_mib }} MiB — PASS"
+      - "Gate 4 (UI): {{ llm_router_ui_check.status | default('N/A') }} (informational)"
+      - "----------------------------------------------------------------------"
+      - "Production port 8002 (llama-server-qwen) is UNCHANGED."
+      - "Post Ryan's review and sign-off on these results, War Machine will"
+      - "execute day2_cutover_qwen_to_router.yml to promote the router to port 8002."
+      - "======================================================================"
+  when: llm_router_enabled | default(false)
+  tags: [router_verify]

ansible/roles/llm-inference-multimodel/tasks/stage_model.yml

@@ -0,0 +1,67 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: roles/llm-inference-multimodel/tasks/stage_model.yml
+# DESCRIPTION: Idempotent staging of a SINGLE GGUF listed in llm_staged_models.
+#              Looped from tasks/models.yml (one include per entry).
+#
+#              GUARD (idempotency):
+#                - stat the target path in llm_models_dir
+#                - get_url ONLY when the file is MISSING or its on-disk size
+#                  != the exact HF manifest size (staged_model.size_bytes)
+#                - when present AND size matches -> pure no-op (no download,
+#                  no service touch)
+#
+#              SIDE EFFECT ON CHANGE:
+#                When a genuine new/mismatched GGUF is downloaded (or its
+#                ownership/mode corrected), this task notifies the
+#                "restart llama-server-router on new GGUF" handler so the
+#                llama.cpp router re-discovers the models_dir. A normal
+#                re-run that finds the files already correct will NOT fire
+#                the handler — the live router is left untouched.
+#
+#              Driven entirely by inventory vars (host_vars), nothing
+#              hardcoded here, so adding a future model = append to the list.
+# ------------------------------------------------------------------------------
+
+- name: "Check if {{ staged_model.filename }} is present on disk"
+  ansible.builtin.stat:
+    path: "{{ llm_models_dir }}/{{ staged_model.filename }}"
+  register: _staged_stat
+
+- name: "Report {{ staged_model.filename }} presence (source: {{ staged_model.source_repo | default('n/a') }})"
+  ansible.builtin.debug:
+    msg: >-
+      {{ staged_model.filename }}:
+      exists={{ _staged_stat.stat.exists | default(false) }},
+      size={{ (_staged_stat.stat.size | default(0) | int) }},
+      expected={{ staged_model.size_bytes | int }},
+      match={{ (_staged_stat.stat.exists | default(false)) and
+               ((_staged_stat.stat.size | default(0) | int) == (staged_model.size_bytes | int)) }}
+  when: _staged_stat.stat.exists | default(false)
+
+- name: "Download {{ staged_model.filename }} (missing or size mismatch)"
+  ansible.builtin.get_url:
+    url: "{{ staged_model.url }}"
+    dest: "{{ llm_models_dir }}/{{ staged_model.filename }}"
+    owner: "{{ llm_service_user }}"
+    group: "{{ llm_service_user }}"
+    mode: "0664"
+    timeout: 600
+  become: true
+  when: >-
+    not (_staged_stat.stat.exists | default(false))
+    or (_staged_stat.stat.size | default(0) | int != (staged_model.size_bytes | int))
+  register: _staged_download
+  notify: restart llama-server-router on new GGUF
+
+- name: "Ensure ownership/mode on {{ staged_model.filename }}"
+  ansible.builtin.file:
+    path: "{{ llm_models_dir }}/{{ staged_model.filename }}"
+    owner: "{{ llm_service_user }}"
+    group: "{{ llm_service_user }}"
+    mode: "0664"
+  become: true
+  when: >-
+    (_staged_stat.stat.exists | default(false))
+    or (_staged_download is changed | default(false))
+  notify: restart llama-server-router on new GGUF

ansible/roles/llm-inference-multimodel/tasks/systemd.yml

@@ -1,54 +1,63 @@
 ---
 # ------------------------------------------------------------------------------
 # FILE: roles/llm-inference-multimodel/tasks/systemd.yml
-# DESCRIPTION: Phase 2 — template + deploy both unit files.
-#              DELIBERATELY DOES NOT START OR ENABLE either service — that is
-#              Phase 4 (verify.yml)'s job, after Phase 3 firewall scoping is
-#              in place. This keeps "units land on disk" and "processes
-#              actually bind ports and load 20+GB into VRAM" as separately
-#              reviewable checkpoints per Ryan's iterative-build preference.
+# DESCRIPTION: Phase 2 (REVISED 2026-08-06) — consolidated to a single
+#              production unit: llama-server-qwen (Qwen2.5-14B-Instruct-1M,
+#              port 8002), serving BOTH the friday and war-machine Hermes
+#              profiles. Ryan explicitly accepted the tradeoffs of running
+#              one model for both profiles instead of the original
+#              aux+toolcall two-model split.
 #
-#              Two independent units (llama-server-aux.service,
-#              llama-server-toolcall.service) — NOT one unit with two
-#              ExecStarts — so either can be stopped/restarted without
-#              affecting the other (plan §2, §6 rollback requirement).
+#              llama-server-aux (Phi-4, port 8000) and llama-server-toolcall
+#              (Mistral-Small-24B, port 8001) are RETIRED: services stopped
+#              + disabled, unit files removed from astro-orbiter, and their
+#              GGUF weights deleted from /opt/models (~45GB reclaimed).
+#              Ansible no longer templates or manages either unit — see git
+#              log for the prior task definitions if a future rollback needs
+#              them restored.
 #
-#              The pre-existing Gemma unit (whatever discover.yml found it to
-#              be) is never templated, restarted, or disabled by this file.
+#              The pre-existing Gemma unit/weights (llama-server.service,
+#              gemma-2-27b-it-Q4_K_M.gguf) were ALSO removed as part of this
+#              consolidation (superseded baseline, no longer a rollback
+#              target once Qwen was accepted as sole production model).
 # ------------------------------------------------------------------------------
 
-- name: Deploy llama-server-aux systemd unit
+- name: Deploy llama-server-qwen systemd unit (production, port 8002)
   ansible.builtin.template:
-    src: llama-server-aux.service.j2
-    dest: "/etc/systemd/system/{{ llm_aux_service_name }}.service"
+    src: llama-server-qwen.service.j2
+    dest: "/etc/systemd/system/{{ llm_qwen_service_name }}.service"
     owner: root
     group: root
     mode: "0644"
   become: true
+  register: llm_qwen_unit_deployed
   notify:
     - reload systemd
-    - restart llama-server-aux
-
-- name: Deploy llama-server-toolcall systemd unit
-  ansible.builtin.template:
-    src: llama-server-toolcall.service.j2
-    dest: "/etc/systemd/system/{{ llm_toolcall_service_name }}.service"
-    owner: root
-    group: root
-    mode: "0644"
-  become: true
-  notify:
-    - reload systemd
-    - restart llama-server-toolcall
 
 - name: Flush handlers so daemon-reload lands before any later phase acts on unit state
   ansible.builtin.meta: flush_handlers
 
-# NOTE: no `ansible.builtin.systemd: state: started / enabled: true` task here
-# on purpose. Units exist on disk after this phase; nothing is running.
-# The "restart" handlers above only fire (and thus only start anything) if
-# the template content actually changed AND a later flush_handlers/end-of-play
-# triggers them — on a first-ever apply this DOES start the services once,
-# which is expected/acceptable for a fresh deploy, but on any subsequent
-# re-run with no template changes, nothing restarts. Ryan/verify.yml owns
-# the deliberate first start + smoke test.
+# NOTE: no `ansible.builtin.systemd: state: started / enabled: true / restarted`
+# task here on purpose. Units exist on disk after this phase; nothing is
+# running or restarted.
+#
+# BUGFIX (found in production): this file used to `notify: restart
+# llama-server-*` on the template tasks above, followed by the
+# flush_handlers meta task. That combination meant Phase 2 (the `systemd`
+# tag) fired the restart handlers itself — on any run where either unit's
+# rendered content changed (including the very first apply), BOTH services
+# got restarted immediately, right here in Phase 2, before Phase 3's
+# firewall scoping or Phase 4's smoke tests ever ran. That directly
+# contradicted this file's own stated purpose (units land on disk, nothing
+# starts/restarts until Phase 4) and caused live services to bounce
+# unexpectedly on a routine re-run of just `--tags systemd`.
+#
+# Fix: Phase 2 only reloads the systemd daemon (harmless, no process
+# impact) and records whether each unit's content actually changed via
+# `llm_aux_unit_deployed` / `llm_toolcall_unit_deployed` (both `.changed`
+# booleans, persisted as play vars for later phases in this same run).
+# Phase 4 (verify.yml) is the only phase that starts OR restarts either
+# service, and it does so per-instance using those recorded `changed`
+# flags — so a content change to one unit's template still never causes
+# the other to restart, and no restart happens at all until Phase 4 has
+# been reached.

ansible/roles/llm-inference-multimodel/tasks/verify.yml

@@ -1,123 +1,115 @@
 ---
 # ------------------------------------------------------------------------------
 # FILE: roles/llm-inference-multimodel/tasks/verify.yml
-# DESCRIPTION: Phase 4 — start both services, curl smoke test each endpoint,
-#              nvidia-smi VRAM check against plan §1 math, confirm no OOM.
+# DESCRIPTION: Phase 4 (REVISED 2026-08-06) — consolidated deployment.
+#              Only llama-server-qwen (Qwen2.5-14B-Instruct-1M, port 8002) is
+#              started/enabled here now. The prior aux (Phi-4, port 8000) and
+#              toolcall (Mistral-Small-24B, port 8001) start/smoke-test tasks
+#              were removed along with those services — see git log for the
+#              previous version of this file if a rollback needs them.
 #
-#              This is the ONLY phase that actually starts the services
+#              This is the ONLY phase that actually starts the qwen service
 #              (systemd.yml deliberately does not). Enabling happens here too,
-#              so a reboot brings both back — matching plan §2's "independent
-#              systemd services" intent for durability, not just this-session.
+#              so a reboot brings it back.
 # ------------------------------------------------------------------------------
 
-- name: Enable and start llama-server-aux
+- name: Gather service facts (systemd unit inventory) — ensure available even if discover.yml's tag wasn't selected
+  ansible.builtin.service_facts:
+  when: llm_existing_gemma_unit_found is not defined
+
+- name: Determine whether a systemd unit matching the existing Gemma service exists (if not already known from discover.yml)
+  ansible.builtin.set_fact:
+    llm_existing_gemma_unit_found: "{{ (llm_existing_gemma_service_name_guess + '.service') in ansible_facts.services }}"
+  when: llm_existing_gemma_unit_found is not defined
+
+- name: Stop pre-existing Gemma llama-server before starting new instances (avoid double VRAM usage / OOM)
   ansible.builtin.systemd:
-    name: "{{ llm_aux_service_name }}"
-    state: started
+    name: "{{ llm_existing_gemma_service_name_guess }}"
+    state: stopped
+  become: true
+  when:
+    - llm_existing_gemma_unit_found | default(false)
+    - ansible_facts.services[llm_existing_gemma_service_name_guess + '.service'].status | default('not-found') != 'not-found'
+    - ansible_facts.services[llm_existing_gemma_service_name_guess + '.service'].state | default('inactive') != 'inactive'
+
+- name: Enable llama-server-qwen and start/restart based on Phase 2 unit-content change
+  ansible.builtin.systemd:
+    name: "{{ llm_qwen_service_name }}"
+    state: "{{ 'restarted' if (llm_qwen_unit_deployed.changed | default(false)) else 'started' }}"
     enabled: true
     daemon_reload: true
   become: true
+  when: llm_qwen_service_enabled | default(false)
 
-- name: Enable and start llama-server-toolcall
-  ansible.builtin.systemd:
-    name: "{{ llm_toolcall_service_name }}"
-    state: started
-    enabled: true
-    daemon_reload: true
-  become: true
-
-- name: Wait for aux instance API to become available (model load may take a couple minutes)
+- name: Wait for Qwen instance API to become available
   ansible.builtin.uri:
-    url: "http://{{ llm_bind_address }}:{{ llm_aux_port }}/health"
+    url: "http://{{ llm_bind_address }}:{{ llm_qwen_port }}/health"
     status_code: 200
-  register: llm_aux_health
+  register: llm_qwen_health
   retries: 24
   delay: 10
-  until: llm_aux_health.status == 200
+  until: llm_qwen_health.status == 200
+  when: llm_qwen_service_enabled | default(false)
+  check_mode: false    # URI tasks return incomplete results in check mode; run for real
 
-- name: Wait for tool-calling instance API to become available
+- name: Smoke-test — Qwen instance model listing + n_ctx verification
   ansible.builtin.uri:
-    url: "http://{{ llm_bind_address }}:{{ llm_toolcall_port }}/health"
-    status_code: 200
-  register: llm_toolcall_health
-  retries: 24
-  delay: 10
-  until: llm_toolcall_health.status == 200
-
-- name: Smoke-test — aux instance model listing
-  ansible.builtin.uri:
-    url: "http://{{ llm_bind_address }}:{{ llm_aux_port }}/v1/models"
+    url: "http://{{ llm_bind_address }}:{{ llm_qwen_port }}/v1/models"
     status_code: 200
     return_content: true
-  register: llm_aux_models
+  register: llm_qwen_models
+  when: llm_qwen_service_enabled | default(false)
+  check_mode: false    # URI tasks return incomplete results in check mode; run for real
 
-- name: Smoke-test — tool-calling instance model listing
-  ansible.builtin.uri:
-    url: "http://{{ llm_bind_address }}:{{ llm_toolcall_port }}/v1/models"
-    status_code: 200
-    return_content: true
-  register: llm_toolcall_models
-
-- name: Report served models per instance
+- name: Report Qwen instance served model + verified n_ctx
   ansible.builtin.debug:
     msg:
-      - "Aux (:{{ llm_aux_port }}) serving:        {{ llm_aux_models.json.data | map(attribute='id') | list }}"
-      - "Tool-calling (:{{ llm_toolcall_port }}) serving: {{ llm_toolcall_models.json.data | map(attribute='id') | list }}"
+      - "Qwen (:{{ llm_qwen_port }}) serving: {{ llm_qwen_models.json.data | map(attribute='id') | list }}"
+      - "Verified n_ctx (must be >= 64000, not just requested): {{ llm_qwen_models.json.data | map(attribute='meta') | map(attribute='n_ctx') | list }}"
+  when:
+    - llm_qwen_service_enabled | default(false)
+    - llm_qwen_models is defined
+    - llm_qwen_models.json is defined
 
-- name: Basic completion smoke test — aux instance (non-tool-calling sanity check only)
+- name: Basic tool-calling smoke test — Qwen instance (this is the sole production model for both profiles)
   ansible.builtin.uri:
-    url: "http://{{ llm_bind_address }}:{{ llm_aux_port }}/v1/chat/completions"
+    url: "http://{{ llm_bind_address }}:{{ llm_qwen_port }}/v1/chat/completions"
     method: POST
     body_format: json
     body:
-      model: "{{ llm_aux_model_id }}"
+      model: "{{ llm_qwen_model_id }}"
       messages:
         - role: user
-          content: "Reply with exactly one word: OK"
-      max_tokens: 10
+          content: "What is the weather in Chicago?"
+      tools:
+        - type: function
+          function:
+            name: get_weather
+            description: Get weather for a city
+            parameters:
+              type: object
+              properties:
+                city:
+                  type: string
+              required:
+                - city
     status_code: 200
     return_content: true
-  register: llm_aux_completion
+  register: llm_qwen_toolcall_smoke
+  when: llm_qwen_service_enabled | default(false)
+  check_mode: false    # URI tasks return incomplete results in check mode; run for real
 
-- name: Basic completion smoke test — tool-calling instance (plain-text sanity check only)
-  ansible.builtin.uri:
-    url: "http://{{ llm_bind_address }}:{{ llm_toolcall_port }}/v1/chat/completions"
-    method: POST
-    body_format: json
-    body:
-      model: "{{ llm_toolcall_model_id }}"
-      messages:
-        - role: user
-          content: "Reply with exactly one word: OK"
-      max_tokens: 10
-    status_code: 200
-    return_content: true
-  register: llm_toolcall_completion
-
-- name: NOTE — this smoke test is NOT the tool-calling validation harness
-  ansible.builtin.debug:
-    msg: >-
-      Both endpoints respond to basic completions. This does NOT validate
-      tool_calls correctness or hallucination-safety for the tool-calling
-      instance — that is a separate, manual, post-deploy procedure (plan §7).
-      See references/tool-calling-validation.sh (copied from the
-      llm-inference-homelab skill) and docs/validation-log.md in this role.
-      DO NOT point any Claude Code / tool-calling-capable Hermes profile at
-      port {{ llm_toolcall_port }} until that validation has passed and been
-      logged.
-
-- name: Check GPU VRAM usage after both instances are running
+- name: Check GPU VRAM usage after Qwen instance is running
   ansible.builtin.command:
     cmd: nvidia-smi --query-gpu=memory.used,memory.total,utilization.gpu --format=csv,noheader
   register: llm_post_start_vram
   changed_when: false
 
-- name: Report VRAM usage vs plan §1 expectations
+- name: Report VRAM usage
   ansible.builtin.debug:
     msg:
       - "Measured (nvidia-smi):      {{ llm_post_start_vram.stdout }}"
-      - "Design estimate (plan §1):  aux ~{{ llm_aux_expected_vram_gb }}GB + toolcall ~{{ llm_toolcall_expected_vram_gb }}GB = ~{{ llm_combined_expected_vram_gb }}GB / {{ llm_gpu_total_vram_gb }}GB total"
-      - "If measured usage exceeds ~23.5GB or is within ~0.5GB of the 24GB card limit, treat as the OOM-risk trigger condition from plan §6 — do not leave both services running unattended without confirming headroom."
+      - "Qwen2.5-14B-Instruct-1M expected footprint: ~{{ llm_qwen_expected_vram_gb }}GB. Ports 8000/8001 are retired and no longer consume VRAM."
 
 - name: Check for OOM-kill events related to llama-server in dmesg (best-effort, read-only)
   ansible.builtin.shell:

ansible/roles/llm-inference-multimodel/templates/llama-server-aux.service.j2

@@ -1,33 +0,0 @@
-[Unit]
-Description=llama-server (aux/classification) — Phi-4-14B Q4_K_M (OpenAI-compatible inference)
-After=network.target nvidia-persistenced.service
-Wants=nvidia-persistenced.service
-
-[Service]
-Type=simple
-User={{ llm_service_user }}
-Group={{ llm_service_user }}
-Environment="HOME=/home/{{ llm_service_user }}"
-ExecStart={{ llm_binary_path }} \
-    --model {{ llm_aux_model_path }} \
-    --host {{ llm_bind_address }} \
-    --port {{ llm_aux_port }} \
-    --ctx-size {{ llm_aux_ctx_size }} \
-    --n-gpu-layers {{ llm_aux_gpu_layers }} \
-    --parallel {{ llm_aux_parallel }} \
-    --metrics
-# NOTE: no --chat-template flag — let llama-server auto-detect Phi-4's own
-# embedded chat template from GGUF metadata (same reasoning as the existing
-# llm-inference role's Gemma unit: explicit overrides risk mismatching the
-# model's actual expected format).
-# NOTE: --host is the private LAN IP (10.1.71.130 by default), NOT 0.0.0.0 —
-# deliberate change from the pre-existing Gemma pattern (plan §5).
-Restart=on-failure
-RestartSec=10
-TimeoutStartSec=600
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=llama-server-aux
-
-[Install]
-WantedBy=multi-user.target

ansible/roles/llm-inference-multimodel/templates/llama-server-qwen.service.j2

@@ -0,0 +1,44 @@
+[Unit]
+Description=llama-server — Qwen3.6-35B-A3B-UD-Q4_K_S (OpenAI-compatible inference, 64K ctx)
+Documentation=https://github.com/ggml-org/llama.cpp
+After=network.target nvidia-persistenced.service
+Wants=nvidia-persistenced.service
+
+[Service]
+Type=simple
+User={{ llm_service_user }}
+Group={{ llm_service_user }}
+Environment="HOME=/home/{{ llm_service_user }}"
+ExecStart={{ llm_binary_path }} \
+    --model {{ llm_qwen_model_path }} \
+    --host {{ llm_bind_address }} \
+    --port {{ llm_qwen_port }} \
+    --n-gpu-layers {{ llm_qwen_gpu_layers }} \
+    --ctx-size {{ llm_qwen_ctx_size }} \
+    --flash-attn on \
+    --cache-type-k q4_0 --cache-type-v q4_0 \
+    --batch-size {{ llm_qwen_batch_size }} --ubatch-size {{ llm_qwen_ubatch_size }} \
+    --parallel {{ llm_qwen_parallel }} \
+    --metrics
+
+# PRODUCTION UNIT — Qwen3.6-35B-A3B-UD-Q4_K_S
+# Current as of 2026-08-07 (t_2ffc0f63) — superseded Qwen2.5-14B-Instruct-1M.
+# VRAM: ~20,390 MiB / 24,576 MiB (verified 2026-08-07).
+# Context: 65536 (64K) with q4_0 KV cache to fit 64K in 24GB headroom.
+# DO NOT change --cache-type-k/v — q8_0 requires more VRAM; 24GB is tight.
+# DO NOT add --jinja — Qwen3.6's embedded chat template is correct for
+#   both chat and tool-calling without an override.
+#
+# Shadow validation (router mode, port 8003) — see templates/llama-server-router.service.j2
+# and playbooks/day1_deploy_llm_router_shadow.yml (t_0cca74a2).
+# This unit is the ROLLBACK TARGET — preserved on 8002 until router validation
+# passes and Ryan approves cutover.
+Restart=on-failure
+RestartSec=10
+TimeoutStartSec=600
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=llama-server-qwen
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/llm-inference-multimodel/templates/llama-server-router-preset.ini.j2

@@ -0,0 +1,204 @@
+; ------------------------------------------------------------------------------
+; FILE: roles/llm-inference-multimodel/templates/llama-server-router-preset.ini.j2
+; DESCRIPTION: llama.cpp --models-preset INI for llama-server-router.
+;
+; Purpose: define all router-served GGUFs as named model entries so that:
+;   - Each model is explicitly named and configured (no auto-discovery surprises)
+;   - Aliases can be added per model (impossible with --models-dir alone)
+;   - The Phi-3.5-mini-instruct-Q8_0 entry carries the alias
+;     "Phi-3.5-mini-instruct-8bit" — Ryan's Hermes auxiliary.title_generation
+;     already references this friendlier name; both names resolve to the same
+;     GGUF child process.
+;
+; INI format notes (llama.cpp preset.md):
+;   - Section header (e.g. [Phi-3.5-mini-instruct-Q8_0]) is the primary model ID
+;     that appears in /v1/models and that clients send in the "model" field.
+;   - `alias` adds an ADDITIONAL name — both the section name and the alias work.
+;   - The `model` key is the absolute path to the GGUF file.
+;   - All other keys map directly to llama-server CLI flags (underscores or hyphens).
+;
+; Known upstream issues (Aug 2026):
+;   - GH #22364: --models-preset creates an extra "default" model entry in
+;     /v1/models. This is cosmetic — it has no functional effect on model
+;     selection by name. Document and move on.
+;   - GH #23460: can't pass per-model samplers via --models-preset in router
+;     mode. Non-issue: Hermes always sends sampling params in the request body.
+;
+; Added 2026-08-12 (t_9adf0889): Phi alias — War Machine.
+; All per-model settings carry over unchanged from the --models-dir baseline
+; (ctx_size=65536, n_gpu_layers=99, cache=q4_0 for both K and V, models-max=4).
+;
+; UPDATED (t_ryan_per_model_ctx, per Ryan/JARVIS request): Llama-3.1-8B and
+; Phi-3.5-mini now get PER-MODEL ctx-size/flash-attn matched to actual
+; workload instead of the uniform 65536 used by every model previously:
+;   - Llama-3.1-8B-Instruct-Q4_K_M: ctx-size 8192  (tool-routing/micro-tasks)
+;   - Phi-3.5-mini-instruct-Q8_0:   ctx-size 32768 (long web scrapes/logs)
+; Both now request explicit flash-attn=true (was "auto"). Qwen3.6-35B is
+; INTENTIONALLY left untouched at ctx-size 65536 / flash-attn auto — not part
+; of this change. Existing aliases (Meta-Llama-3.1-8B-Instruct-4bit,
+; Phi-3.5-mini-instruct-8bit) are PRESERVED unchanged to avoid breaking live
+; Hermes custom_providers routing — see role README / deployment report for
+; the alias-naming ambiguity flag (Ryan's pasted TOML used different alias
+; strings: "llama-3.1-8b" / "phi-3.5-mini").
+;
+; UPDATED (t_34b96e83, 2026-08-13, per Ryan approval): Added nomic-embed-text-v1.5
+; embedding model. Embedding models fold cleanly into the router preset via
+; embedding=true. No alias needed — clients call it by section name.
+; VRAM estimate ~90MB (negligible). sleep-idle-seconds=-1 keeps it always loaded
+; since embedding calls are latency-sensitive and it costs near-nothing to hold.
+; load-on-startup=true ensures the embedding endpoint is warm at boot without
+; waiting for the first request. — War Machine.
+; ------------------------------------------------------------------------------
+
+; --- Production model: Qwen3.8-27B-Q4_K_M ------------------------------------
+; Swapped from Qwen3.6-35B-A3B-UD-Q4_K_S by War Machine (t_f5f7e9ad, 2026-08-16).
+; Ryan-directed swap. Qwen3.8-27B is a dense 27B VLM (Apache-2.0) from Alibaba,
+; released Aug 2026. GGUF quantized by Unsloth Dynamic V3.0 (preview).
+; Q4_K_M chosen: 17.1GB weights — fits RTX 3090 (24GB) with ~7GB headroom for
+; KV cache at ctx=65536 (q4_0 KV). Smaller than prior Qwen3.6 at ~20GB.
+; Native context: 262,144 tokens. Running at 65536 (Hermes floor) for now;
+; can be raised later if needed.
+; VRAM footprint (empirically tested, t_4455a44c 2026-08-16):
+;   ctx=32768:  17,068 MiB; ctx=65536: 17,804 MiB; ctx=131072: 20,282 MiB.
+;   BUMPED to 131072 (128K) per Ryan approval (t_441470b9, 2026-08-16).
+;   nomic-embed always resident at 558 MiB -> total ~20.8GB, ~3.2GB headroom.
+;   Native context is 262,144 tokens; 128K is the production ceiling.
+; Architecture note: Qwen3.8 uses Gated DeltaNet; llama.cpp 6ea215d logs
+; "fused Gated Delta Net (chunked) not supported, set to disabled" — falls
+; back to non-fused implementation. Inference works correctly but may be
+; slower on the GDN layers. An updated llama.cpp may improve throughput.
+; load-on-startup NOT set (loads on first request, ~30-60s cold load).
+; With models-max=2 in host_vars, nomic-embed occupies slot 1 (pinned),
+; and the generative slot (slot 2) is Qwen3.8 on first request. Auxiliary
+; models (Phi, Llama, Coder) evict Qwen3.8 when requested; Qwen3.8 evicts
+; them in turn. One cold-load (~30-60s) per switch between Qwen3.8 and
+; auxiliary models is expected and acceptable. In practice, once Hermes
+; config.yaml references Qwen3.8 as primary, it stays resident.
+; ctx-size raised to 131072 (128K) per Ryan approval (t_441470b9, 2026-08-16).
+; Primary model ID: Qwen3.8-27B-Q4_K_M
+[Qwen3.8-27B-Q4_K_M]
+model              = {{ llm_models_dir }}/Qwen3.8-27B-Q4_K_M.gguf
+n-gpu-layers       = {{ llm_router_gpu_layers }}
+ctx-size           = {{ llm_router_qwen38_ctx_size }}
+cache-type-k       = {{ llm_router_cache_type_k }}
+cache-type-v       = {{ llm_router_cache_type_v }}
+batch-size         = {{ llm_router_batch_size }}
+ubatch-size        = {{ llm_router_ubatch_size }}
+parallel           = {{ llm_router_parallel }}
+
+; --- Auxiliary model: Phi-3.5-mini-instruct-Q8_0 ----------------------------
+; Primary model ID: Phi-3.5-mini-instruct-Q8_0 (unchanged from --models-dir)
+; Alias:            Phi-3.5-mini-instruct-8bit (NEW — Ryan's config target)
+; Both names resolve to this GGUF child process.
+; ~3.8GB, auxiliary.title_generation consumer in Ryan's Hermes config.
+; The alias is deployed — "model not found" errors are resolved.
+;
+; KNOWN ISSUE (2026-08-12, t_9adf0889):
+;   json_schema response_format fails for Phi-3.5-mini in llama.cpp router
+;   mode due to chat template grammar sampler incompatibility (GH #23460).
+;   The grammar sampler generates root ::= "assistant|>\n" ... which fails
+;   to initialize. This means Hermes auxiliary.title_generation still errors
+;   with "HTTP 400: Failed to initialize samplers" when json_schema format
+;   is requested. Without response_format (plain text), Phi works fine.
+;
+;   Resolution options:
+;   a) Update auxiliary.title_generation.model in ~/.hermes/config.yaml to
+;      Meta-Llama-3.1-8B-Instruct-Q4_K_M (which supports json_schema) — Ryan
+;      needs to approve this config.yaml write (protected file).
+;   b) Rebuild llama.cpp from a newer commit if this bug is fixed upstream.
+;   c) Accept title generation degradation for Phi-specific structured output.
+[Phi-3.5-mini-instruct-Q8_0]
+model        = {{ llm_models_dir }}/Phi-3.5-mini-instruct-Q8_0.gguf
+alias        = Phi-3.5-mini-instruct-8bit
+n-gpu-layers = {{ llm_router_gpu_layers }}
+ctx-size     = {{ llm_router_phi_ctx_size }}
+flash-attn   = {{ llm_router_phi_flash_attn }}
+cache-type-k = {{ llm_router_cache_type_k }}
+cache-type-v = {{ llm_router_cache_type_v }}
+batch-size   = {{ llm_router_batch_size }}
+ubatch-size  = {{ llm_router_ubatch_size }}
+parallel     = {{ llm_router_parallel }}
+
+; --- Auxiliary model: Meta-Llama-3.1-8B-Instruct-Q4_K_M --------------------
+; Primary model ID: Meta-Llama-3.1-8B-Instruct-Q4_K_M (unchanged from --models-dir)
+; Alias:            Meta-Llama-3.1-8B-Instruct-4bit (NEW — friendlier name)
+; Both names resolve to this GGUF child process.
+; ~4.6GB, general-purpose small model. Works with json_schema structured output.
+[Meta-Llama-3.1-8B-Instruct-Q4_K_M]
+model        = {{ llm_models_dir }}/Meta-Llama-3.1-8B-Instruct-Q4_K_M.gguf
+alias        = Meta-Llama-3.1-8B-Instruct-4bit
+n-gpu-layers = {{ llm_router_gpu_layers }}
+ctx-size     = {{ llm_router_llama_ctx_size }}
+flash-attn   = {{ llm_router_llama_flash_attn }}
+cache-type-k = {{ llm_router_cache_type_k }}
+cache-type-v = {{ llm_router_cache_type_v }}
+batch-size   = {{ llm_router_batch_size }}
+ubatch-size  = {{ llm_router_ubatch_size }}
+parallel     = {{ llm_router_parallel }}
+
+; --- Coder model: Qwen2.5-Coder-14B-Instruct-Q4_K_M -------------------------
+; Primary model ID: Qwen2.5-Coder-14B-Instruct-Q4_K_M (filename-derived)
+; Alias:            Qwen2.5-Coder-14B-Instruct-4bit (friendlier name)
+; Both names resolve to this GGUF child process.
+; ~8.4GB weights + ~0.6GB KV @ 16K ctx = ~9.0GB VRAM.
+; ctx-size=16384, flash-attn=true per task t_55c164f5 / Ryan's request.
+; Source: bartowski/Qwen2.5-Coder-14B-Instruct-GGUF (public, no auth)
+; Added 2026-08-13 (t_55c164f5) — War Machine.
+[Qwen2.5-Coder-14B-Instruct-Q4_K_M]
+model        = {{ llm_models_dir }}/Qwen2.5-Coder-14B-Instruct-Q4_K_M.gguf
+alias        = Qwen2.5-Coder-14B-Instruct-4bit
+n-gpu-layers = {{ llm_router_gpu_layers }}
+ctx-size     = {{ llm_router_coder_ctx_size }}
+flash-attn   = {{ llm_router_coder_flash_attn }}
+cache-type-k = {{ llm_router_cache_type_k }}
+cache-type-v = {{ llm_router_cache_type_v }}
+batch-size   = {{ llm_router_batch_size }}
+ubatch-size  = {{ llm_router_ubatch_size }}
+parallel     = {{ llm_router_parallel }}
+
+; --- Embedding model: nomic-embed-text-v1.5 ----------------------------------
+; Primary model ID: nomic-embed-text-v1.5 (section name / client-visible ID)
+; ~84MB GGUF — negligible VRAM, always-loaded. Embedding endpoint: /v1/embeddings.
+; embedding=true: required to expose /v1/embeddings and embed the model (not chat).
+; n-gpu-layers=99: GPU offload all layers (tiny model, no reason to leave on CPU).
+; ctx-size=8192: per task spec (OpenViking Phase 1b, t_34b96e83).
+; load-on-startup=true: warm at boot — embedding callers (peter-parker) are
+;   latency-sensitive; no cold-load wait on first request.
+; sleep-idle-seconds=-1: never evict — ~84MB is negligible, always keep hot.
+; NO flash-attn, NO KV cache params: embedding models use a different forward
+;   pass (bidirectional, no autoregressive KV cache). These keys are irrelevant
+;   for embedding inference and may be silently ignored or cause warnings; omit.
+; Source: nomic-ai/nomic-embed-text-v1.5-GGUF (public, no auth needed)
+; Added 2026-08-13 (t_34b96e83) — War Machine.
+;
+; FIXED (2026-08-14, t_openviking_embed_batch): the original section omitted
+; batch-size/ubatch-size, so llama-server defaulted the PHYSICAL batch
+; (ubatch-size) to 512 tokens. For embedding requests llama.cpp cannot split
+; a single input across ubatches, so any OpenViking chunk over ~512 tokens
+; large chunk over ~512 tokens (observed 2000-3400 tokens/chunk) failed hard with "input (N tokens) is too
+; large to process. increase the physical batch size (current batch size:
+; 512)". This tripped OpenViking's circuit breaker into an infinite
+; fail/re-enqueue loop. Fix: set batch-size/ubatch-size to 4096 (comfortably
+; over the observed max chunk size and under ctx-size=8192).
+;
+; FOLLOW-UP FINDING (2026-08-14, same task): after the batch-size fix landed,
+; logs showed a SECOND, separate problem: llama.cpp capped the effective
+; context to 2048 regardless of ctx-size=8192 ("n_ctx_seq (8192) > n_ctx_train
+; (2048)" / "capping"). This is expected per the nomic-embed-text-v1.5-GGUF
+; model card: the base GGUF's native RoPE training context is 2048; the
+; original HF model reaches its benchmarked 8192-token context via Dynamic
+; NTK-Aware RoPE scaling, which llama.cpp does not implement — so llama.cpp
+; defaults to 2048 unless YaRN scaling is explicitly requested. Model card
+; prescribes: --rope-scaling yarn --rope-freq-scale 0.75 alongside -c 8192.
+; Added rope-scaling/rope-freq-scale below to actually reach 8192.
+[nomic-embed-text-v1.5]
+model              = {{ llm_models_dir }}/nomic-embed-text-v1.5-Q4_K_M.gguf
+embedding          = true
+n-gpu-layers       = {{ llm_router_gpu_layers }}
+ctx-size           = {{ llm_router_nomic_ctx_size }}
+batch-size         = {{ llm_router_nomic_batch_size }}
+ubatch-size        = {{ llm_router_nomic_ubatch_size }}
+rope-scaling       = yarn
+rope-freq-scale    = 0.75
+load-on-startup    = true
+sleep-idle-seconds = -1

ansible/roles/llm-inference-multimodel/templates/llama-server-router.service.j2

@@ -0,0 +1,70 @@
+[Unit]
+Description=llama-server router — {{ llm_router_models_dir }} (OpenAI-compatible, port {{ llm_router_port }})
+Documentation=https://github.com/ggml-org/llama.cpp
+After=network.target nvidia-persistenced.service
+Wants=nvidia-persistenced.service
+
+[Service]
+Type=simple
+User={{ llm_service_user }}
+Group={{ llm_service_user }}
+Environment="HOME=/home/{{ llm_service_user }}"
+ExecStart={{ llm_binary_path }} \
+{% if llm_router_preset_enabled | default(false) %}
+    --models-preset {{ llm_router_preset_path }} \
+{% else %}
+    --models-dir {{ llm_router_models_dir }} \
+{% endif %}
+    --models-max {{ llm_router_models_max }} \
+    --host {{ llm_router_bind_address }} \
+    --port {{ llm_router_port }} \
+    --n-gpu-layers {{ llm_router_gpu_layers }} \
+{% if not (llm_router_preset_enabled | default(false)) %}
+    --ctx-size {{ llm_router_ctx_size }} \
+    --flash-attn {{ llm_router_flash_attn }} \
+{% endif %}
+    --cache-type-k {{ llm_router_cache_type_k }} \
+    --cache-type-v {{ llm_router_cache_type_v }} \
+    --batch-size {{ llm_router_batch_size }} \
+    --ubatch-size {{ llm_router_ubatch_size }} \
+    --parallel {{ llm_router_parallel }} \
+    --metrics
+
+# ROUTER MODE NOTES (2026-08-12, t_0cca74a2 / updated t_9adf0889):
+# - NO -m/--model flag: this is what enables llama-server router/supervisor mode.
+#   Without -m, llama-server discovers all .gguf files in --models-dir, or uses
+#   the per-model definitions in a --models-preset INI file.
+# - PRESET MODE (t_9adf0889, 2026-08-12):
+#   llm_router_preset_enabled=true switches from --models-dir to --models-preset.
+#   Preset mode adds alias support (--models-dir cannot assign aliases).
+#   The preset INI is at {{ llm_router_preset_path | default('/opt/llama-server-router-preset.ini') }}.
+#   Both the section name and the alias field in the INI work as model IDs.
+#   GH #22364 (extra "default" entry in /v1/models) is expected in preset mode — cosmetic.
+# - --models-max {{ llm_router_models_max }} is driven by llm_router_models_max
+#   (default 1 in defaults/main.yml; overridden to 4 in host_vars/astro-orbiter
+#   as of t_33acbb2e after VRAM budget review — see host_vars for OOM risk note).
+#   Default llama-server cap is 4 simultaneous — OOM on 24GB if all 3 current
+#   GGUFs load at once. LRU eviction mitigates in practice but review before adding
+#   models. See host_vars/astro-orbiter/vars.yml for full VRAM breakdown.
+# - Clients select a model via "model": "<section-name-or-alias>" in their
+#   chat completion request. Hermes sends model: "<id>" on every request already.
+# - Cold model load on first request: ~30-60s for Qwen3.6-35B. First response
+#   will be slow. This is expected. Document in runbook.
+# - No --jinja flag: Qwen3.6-35B uses its own embedded chat template correctly.
+#   If per-model template overrides are ever needed, use --models-preset INI
+#   (but note GH #23460: sampler params in presets may not work in router mode).
+#
+# SHADOW DEPLOYMENT NOTE (historical — 2026-08-12, t_0cca74a2):
+# This unit was originally deployed on port 8003 as a shadow. After validation,
+# it was promoted to production on port 8002 (t_cd0d5388). The --port value
+# above is the authoritative value; the port 8003 references below are historical.
+# Production is now llama-server-router (this unit); llama-server-qwen is the rollback target.
+Restart=on-failure
+RestartSec=10
+TimeoutStartSec=600
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=llama-server-router
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/llm-inference-multimodel/templates/llama-server-toolcall.service.j2

@@ -1,38 +0,0 @@
-[Unit]
-Description=llama-server (tool-calling) — Mistral-Small-24B-Instruct-2501 Q3_K_M (OpenAI-compatible inference)
-After=network.target nvidia-persistenced.service
-Wants=nvidia-persistenced.service
-
-[Service]
-Type=simple
-User={{ llm_service_user }}
-Group={{ llm_service_user }}
-Environment="HOME=/home/{{ llm_service_user }}"
-ExecStart={{ llm_binary_path }} \
-    --model {{ llm_toolcall_model_path }} \
-    --host {{ llm_bind_address }} \
-    --port {{ llm_toolcall_port }} \
-    --ctx-size {{ llm_toolcall_ctx_size }} \
-    --n-gpu-layers {{ llm_toolcall_gpu_layers }} \
-    --parallel {{ llm_toolcall_parallel }} \
-    --metrics
-# NOTE: no --chat-template flag — let llama-server auto-detect Mistral-Small's
-# own embedded chat template from GGUF metadata.
-# NOTE: --host is the private LAN IP (10.1.71.130 by default), NOT 0.0.0.0.
-# NOTE: --parallel 1 is deliberate (plan §1/§2) — tool-calling profiles are
-# single-session-at-a-time per Claude Code profile; lower parallelism reduces
-# KV overhead and lowers hallucination surface from context bleed between
-# concurrent slots.
-# IMPORTANT: this endpoint MUST pass the plan §7 validation harness
-# (docs/validation-log.md in this role) before any Claude Code / tool-calling
-# Hermes profile is pointed at it. Mistral-Small shares lineage concerns
-# flagged for Qwen2.5/Qwen3 hallucinated tool_calls — do not assume safety.
-Restart=on-failure
-RestartSec=10
-TimeoutStartSec=600
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=llama-server-toolcall
-
-[Install]
-WantedBy=multi-user.target

cluster/applications/monitoring/values.yaml

@@ -232,15 +232,65 @@ prometheus:
               hostname: astro-orbiter
               gpu: rtx3090
 
-      - job_name: llama-server-astro-orbiter
-        scrape_interval: 15s
+      # Router exposes per-model Prometheus metrics via /metrics?model=<id>.
+      # The old :8000 target (gemma-2-27b-it-GGUF) was removed after the day2
+      # cutover (2026-08-12) to llama-server-router on :8002. Three separate
+      # jobs — one per model registered in the router — are used so each gets
+      # its own model label. The static `model` label is set to the canonical
+      # llama.cpp model id (the `id` field from /v1/models, not the alias).
+      # scrape_interval: 90s (reduced from 15s) -- each /metrics?model= request
+      # wakes the GPU sub-server to P2 (~110W); at 15s, continuous spikes kept
+      # the GPU drawing ~110W despite zero inference load. At 90s, the GPU gets
+      # ~80s of genuine P8 idle (~20W) between wake-ups. (t_e7d547ea, 2026-08-13)
+
+      # llama-server-astro-orbiter-qwen3 REMOVED (t_02c15dae, 2026-08-13):
+      # /metrics?model=Qwen3.6 forces the router to attempt loading Qwen3.6 each
+      # scrape cycle, which fails with CUDA OOM (VRAM already consumed by resident
+      # Llama3+Phi3.5). This generated real GPU power spikes, not just a benign
+      # counter read. nvidia_gpu_exporter (:9835) already covers GPU power/VRAM/
+      # utilization at zero wake cost. No Grafana dashboard panel depends on
+      # Qwen3.6-specific llama-server metrics. Ryan approved full removal.
+      # Commented out rather than deleted for easy revert if Qwen3.6 is ever
+      # re-added as a resident model.
+      #
+      # - job_name: llama-server-astro-orbiter-qwen3
+      #   scrape_interval: 90s
+      #   metrics_path: /metrics
+      #   params:
+      #     model: ["Qwen3.6-35B-A3B-UD-Q4_K_S"]
+      #   static_configs:
+      #     - targets:
+      #         - 10.1.71.130:8002
+      #       labels:
+      #         hostname: astro-orbiter
+      #         endpoint: astro-orbiter-router
+      #         model: Qwen3.6-35B-A3B-UD-Q4_K_S
+
+      - job_name: llama-server-astro-orbiter-llama3
+        scrape_interval: 90s
         metrics_path: /metrics
+        params:
+          model: ["Meta-Llama-3.1-8B-Instruct-Q4_K_M"]
         static_configs:
           - targets:
-              - 10.1.71.130:8000
+              - 10.1.71.130:8002
             labels:
               hostname: astro-orbiter
-              model: bartowski/gemma-2-27b-it-GGUF
+              endpoint: astro-orbiter-router
+              model: Meta-Llama-3.1-8B-Instruct-Q4_K_M
+
+      - job_name: llama-server-astro-orbiter-phi35
+        scrape_interval: 90s
+        metrics_path: /metrics
+        params:
+          model: ["Phi-3.5-mini-instruct-Q8_0"]
+        static_configs:
+          - targets:
+              - 10.1.71.130:8002
+            labels:
+              hostname: astro-orbiter
+              endpoint: astro-orbiter-router
+              model: Phi-3.5-mini-instruct-Q8_0
 
 # ─── Grafana ──────────────────────────────────────────────────────────────────
 grafana:

cluster/platform/openviking/PHASE-1-HANDOFF.md

@@ -0,0 +1,118 @@
+# OpenViking Phase 1: ExternalSecret Manifests — Handoff Summary
+
+**Status:** COMPLETE  
+**Task:** Wong, t_32766900  
+**Date:** 2026-08-13  
+**Destination:** Gitea rblundon/homelab, cluster/platform/openviking/
+
+## Deliverables
+
+### Primary Manifest
+- **File:** `externalsecret-phase1.yaml`
+- **Purpose:** Syncs OpenViking credentials from 1Password mk-labs vault
+- **Status:** Validated (kubectl apply --dry-run=client: PASS)
+
+### Documentation
+- **File:** `PHASE-1-HANDOFF.md` (this file)
+- **Purpose:** Handoff notes for Phase 2 coordination
+
+## Manifest Details
+
+**ExternalSecret Name:** openviking-credentials  
+**Target Namespace:** openviking  
+**ClusterSecretStore:** onepassword-connect (existing, proven)  
+**Refresh Interval:** 1h  
+**Sync Wave:** 8 (ArgoCD annotation)  
+**Pattern:** Harbor proven pattern (single consolidated manifest)
+
+## 1Password Item Requirements
+
+The manifest references three 1Password items in the mk-labs vault:
+
+### Item 1: openviking-root-api-key
+- **Field:** root-api-key (CONCEALED)
+- **Status:** EXISTS (per dashboard confirmation)
+- **Purpose:** OpenViking server root API key
+
+### Item 2: openviking-embedding-api-key
+- **Field:** api-key (CONCEALED)
+- **Status:** NEEDS CREATION
+- **Recommended Value:** local-nomic-embed
+- **Purpose:** Embedding model endpoint (nomic-embed-text-v1.5 at astro-orbiter:8002)
+- **Note:** Local endpoint, placeholder token only — no cloud authentication needed
+
+### Item 3: openviking-vlm-api-key
+- **Field:** api-key (CONCEALED)
+- **Status:** NEEDS CREATION
+- **Recommended Value:** local-llama-vlm
+- **Purpose:** VLM endpoint (Llama-3.1-8B at astro-orbiter:8002)
+- **Note:** Local endpoint, placeholder token only — no cloud authentication needed
+
+## Workaround for Missing 1Password Items
+
+If separate 1Password items cannot be created due to permissions:
+
+1. Add fields to existing "openviking" item:
+   - `embedding_api_key` (CONCEALED): local-nomic-embed
+   - `vlm_api_key` (CONCEALED): local-llama-vlm
+
+2. Update manifest remoteRef.key fields:
+   - Change from `openviking-embedding-api-key` to `openviking`
+   - Change from `openviking-vlm-api-key` to `openviking`
+
+3. Update manifest remoteRef.property fields:
+   - Change from `api-key` to `embedding_api_key`
+   - Change from `api-key` to `vlm_api_key`
+
+## Dependencies & Constraints
+
+**Phase 1 Constraints Satisfied:**
+- Vault canonical: acknowledged (vault is canonical source for OpenViking index)
+- Honcho out of scope: confirmed (no Honcho/lincoln references)
+- Pilot scope only: confirmed (two corpora, two profiles)
+
+**Phase 2 Dependencies:**
+- namespace.yaml must create `openviking` namespace before ExternalSecret deployment
+- ExternalSecret must sync before pod startup
+- 1Password items must exist before sync (read-only ClusterSecretStore)
+
+**External Dependencies:**
+- Model staging: nomic-embed-text-v1.5 must be staged on astro-orbiter:8002 before pod startup
+- ClusterSecretStore: onepassword-connect must be healthy
+
+## Coordination Notes for Peter Parker (Phase 2)
+
+**ClusterSecretStore Naming Discrepancy:**
+- Phase 1 uses: `onepassword-connect` (proven, existing on cluster)
+- Your Phase 2 manifests reference: `1password-mk-labs` (does not currently exist)
+
+**Resolution Options:**
+1. Create `1password-mk-labs` as alias/new ClusterSecretStore
+2. Update Phase 1 manifest to match your reference
+3. Update Phase 2 manifests to use `onepassword-connect`
+
+**Next Steps:**
+1. Clarify ClusterSecretStore naming
+2. Verify/create 1Password items 2 & 3
+3. Create openviking namespace
+4. Deploy Phase 1 ExternalSecret
+5. Deploy Phase 2 (Helm values, ArgoCD Application)
+
+## References
+
+- Approved plan: ~/friday/inbox/ryan/2026-08-13-openviking-pilot-deployment-plan.md
+- Phase 0 model recommendation: ~/friday/inbox/ryan/2026-08-13-openviking-model-recommendation.md
+- Harbor pattern reference: cluster/platform/harbor/externalsecret.yaml
+
+## Manifest Validation
+
+```bash
+kubectl apply --dry-run=client -f externalsecret-phase1.yaml
+# Result: externalsecret.external-secrets.io/openviking-credentials created (dry run)
+```
+
+---
+
+**Created by:** Wong, Infrastructure Automation Specialist  
+**Task:** t_32766900, OpenViking Phase 1  
+**Pattern:** Harbor proven approach (consolidated ExternalSecret, template v2)

cluster/platform/openviking/application.yaml

@@ -0,0 +1,83 @@
+# ============================================================================
+# ArgoCD Application: OpenViking
+# Wave: 8 (after Harbor at Wave 7)
+# Deployment method: GitOps (Gitea -> ArgoCD)
+# ============================================================================
+#
+# Multi-source: Helm chart from upstream VolcEngine + local values + manifests from repo
+# Follows Harbor's pattern exactly (multi-source Application with local value overrides).
+#
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: openviking
+  namespace: argocd
+  annotations:
+    # Wave 8 (platform-level, apps-of-apps view): OpenViking Application syncs after Harbor (Wave 7)
+    # NOTE: This annotation controls the Application's position in the apps-of-apps rollout,
+    # NOT the ordering of resources within the Application. Internal resource ordering is
+    # controlled by sync-wave annotations on individual resources (ExternalSecret, etc.).
+    # argocd.argoproj.io/sync-wave: "8"  # Platform-level docs - NOT needed as annotation
+    description: |
+      OpenViking Platform Knowledge Infrastructure pilot deployment
+      Pilot scope: Two corpora (hermes/ skills library, personal/homelab/)
+      Two consumer profiles (Wong, Shuri) for before/after token comparison.
+      
+      CRITICAL CONSTRAINT: Vault (~/friday) is the canonical source of truth.
+      OpenViking's index is a derived cache, rebuilt from vault source files.
+      If index and vault ever diverge, vault wins and re-index runs.
+      See inbox/ryan/2026-08-13-openviking-pilot-deployment-plan.md
+spec:
+  project: default
+
+  sources:
+    # Source 1: Helm chart from upstream VolcEngine/OpenViking repository
+    - repoURL: https://github.com/volcengine/openviking.git
+      targetRevision: main
+      path: deploy/helm/openviking
+      helm:
+        valueFiles:
+          # Local values override upstream defaults
+          - $values/cluster/platform/openviking/values.yaml
+
+    # Source 2: Gitea homelab repo — values + ExternalSecret + namespace + ingress manifests
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      path: cluster/platform/openviking
+      ref: values
+      directory:
+        # Exclude the Application manifest itself (already in argocd)
+        exclude: "application.yaml"
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: openviking
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+      # Important: do not prune ExternalSecrets on ArgoCD uninstall
+      # (credentials live in 1Password, re-sync on pod restart)
+      - PrunePropagationPolicy=background
+
+# ============================================================================
+# DEPLOYMENT GATE: DO NOT SYNC TO ARGOCD UNTIL
+# ============================================================================
+# 1. Wong's Phase 1 (t_32766900) is complete: ExternalSecret manifests exist in Gitea,
+#    1Password vault items (openviking-root-api-key, openviking-embedding-api-key, openviking-vlm-api-key)
+#    are provisioned and synced to the cluster.
+#
+# 2. Model staging (separate task): nomic-embed-text-v1.5-Q4_K_M.gguf has been pulled into
+#    /opt/models/ on astro-orbiter and the router preset INI section appended + router restarted.
+#    Verify: POST http://10.1.71.130:8002/v1/embeddings with model="nomic-embed-text-v1.5"
+#    returns a 768-dim float vector.
+#
+# 3. Smoke test plan (below) documented and ready to execute post-sync.
+#
+# Contact: Peter Parker (Phase 2 owner) — check for blocker updates via kanban comment
+# or by monitoring Wong's task (t_32766900) for completion.
+# ============================================================================

cluster/platform/openviking/deployment-maelstrom.yaml

@@ -0,0 +1,37 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: maelstrom-ui
+  namespace: openviking
+spec:
+  replicas: 1
+  selector:
+    matchLabels: { app: maelstrom-ui }
+  template:
+    metadata:
+      labels: { app: maelstrom-ui }
+    spec:
+      containers:
+        - name: maelstrom-ui
+          image: the-seas.local.mk-labs.cloud/library/maelstrom-ui:v0.3.17-1
+          ports: [{ containerPort: 80 }]
+          env:
+            - name: MAELSTROM_UI_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: maelstrom-ui-credentials
+                  key: maelstrom_ui_key
+          resources:
+            requests: { cpu: 50m, memory: 64Mi }
+            limits: { cpu: 200m, memory: 128Mi }
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: maelstrom-ui
+  namespace: openviking
+spec:
+  selector: { app: maelstrom-ui }
+  ports:
+    - port: 80
+      targetPort: 80

cluster/platform/openviking/externalsecret-maelstrom.yaml

@@ -0,0 +1,30 @@
+# ExternalSecret - maelstrom-ui scoped API key
+# Per inbox/ryan/2026-08-14-maelstrom-key-approval.md: Ryan approved pre-seeding
+# via ExternalSecret (option b) since Ryan is the sole user of the pilot.
+# Scoped key (resources/search/tasks read-only, no bot/admin) minted by Nick Fury,
+# see system/inbox/agents/nick-fury/2026-08-14-maelstrom-ui-key-mint-complete.md
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: maelstrom-ui-credentials
+  namespace: openviking
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+    description: "Scoped read-only API key for maelstrom (Web Studio UI)"
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: maelstrom-ui-credentials
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        maelstrom_ui_key: "{{ .MAELSTROM_UI_KEY }}"
+  data:
+    - secretKey: MAELSTROM_UI_KEY
+      remoteRef:
+        key: openviking
+        property: maelstrom-ui-key

cluster/platform/openviking/externalsecret.yaml

@@ -0,0 +1,57 @@
+# ExternalSecret - OpenViking Credentials
+# Wong, Phase 1, t_32766900
+#
+# Syncs OpenViking credentials from 1Password mk-labs vault
+# Pattern: Harbor proven pattern (cluster/platform/harbor/externalsecret.yaml)
+# Store: onepassword-connect ClusterSecretStore
+# Namespace: openviking (created by Peter Parker in Phase 2)
+# Wave: 8 (after Harbor Wave 7)
+
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: openviking-credentials
+  namespace: openviking
+  annotations:
+    # Wave -1: Ensure ExternalSecret syncs BEFORE the Deployment (wave 0)
+    # This guarantees the secret exists before the pod tries to mount it
+    argocd.argoproj.io/sync-wave: "-1"
+    description: "Phase 1 secrets for OpenViking deployment"
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: openviking-credentials
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        root_api_key: "{{ .OPENVIKING_ROOT_API_KEY }}"
+        embedding_api_key: "{{ .OPENVIKING_EMBEDDING_API_KEY }}"
+        vlm_api_key: "{{ .OPENVIKING_VLM_API_KEY }}"
+
+  data:
+    # OpenViking root API key - server administration
+    # Source: 1Password item "openviking", field "root-api-key"
+    - secretKey: OPENVIKING_ROOT_API_KEY
+      remoteRef:
+        key: openviking
+        property: root-api-key
+
+    # Embedding model endpoint token (nomic-embed-text-v1.5 at astro-orbiter:8002)
+    # Source: 1Password item "openviking", field "embedding-api-key"
+    # Phase 0 recommendation: placeholder token for local endpoint
+    - secretKey: OPENVIKING_EMBEDDING_API_KEY
+      remoteRef:
+        key: openviking
+        property: embedding-api-key
+
+    # VLM endpoint token (Llama-3.1-8B at astro-orbiter:8002)
+    # Source: 1Password item "openviking", field "vlm-api-key"
+    # Phase 0 recommendation: placeholder token for local endpoint
+    - secretKey: OPENVIKING_VLM_API_KEY
+      remoteRef:
+        key: openviking
+        property: vlm-api-key

cluster/platform/openviking/ingress-maelstrom.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: maelstrom-ui
+  namespace: openviking
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - maelstrom.local.mk-labs.cloud
+      secretName: maelstrom-ui-tls
+  rules:
+    - host: maelstrom.local.mk-labs.cloud
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: maelstrom-ui
+                port:
+                  number: 80

cluster/platform/openviking/maelstrom-ui/Dockerfile

@@ -0,0 +1,25 @@
+# maelstrom-ui — OpenViking Web Studio static frontend
+# Built per finalized plan: inbox/ryan/2026-08-14-maelstrom-ui-deployment-plan.md (Option B)
+#
+# Source: volcengine/openviking upstream, subdirectory web-studio/, pinned to
+# commit 3cd1d4e9acdfcc2567fd78da95339c3b18936c1c (2026-08-14).
+# NOT vendored into this repo (GitOps manifests stay app-source-free) — the
+# build context is the upstream web-studio/ directory checked out at that
+# commit. Image built + pushed manually for this deployment; see
+# system/inbox/agents/peter-parker/ for the build log if promoted to CI.
+#
+# Stage 1: build the SPA
+FROM node:22-alpine AS build
+WORKDIR /app
+COPY web-studio/package.json web-studio/package-lock.json* web-studio/pnpm-lock.yaml* ./
+RUN if [ -f pnpm-lock.yaml ]; then corepack enable && corepack prepare pnpm@latest --activate && pnpm install --no-frozen-lockfile && pnpm approve-builds --all || true; \
+    else npm ci; fi
+COPY web-studio/ .
+RUN if [ -f pnpm-lock.yaml ]; then pnpm run build; else npm run build; fi
+
+# Stage 2: serve with nginx, proxying /api/, /health, /ready to the openviking Service.
+# /bot/ is deliberately NOT proxied (bot.enabled: false, defense-in-depth per plan §2).
+FROM nginx:alpine
+COPY --from=build /app/dist /usr/share/nginx/html
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+EXPOSE 80

cluster/platform/openviking/maelstrom-ui/nginx.conf

@@ -0,0 +1,34 @@
+# maelstrom-ui nginx config
+# Per plan §2: proxy /api/, /health, /ready to the openviking Service.
+# /bot/ is deliberately NOT proxied — bot stays disabled (scope decision #3);
+# any Web Studio call to /bot/v1/* 404s at this layer instead of reaching a disabled backend.
+server {
+    listen 80;
+    server_name _;
+
+    location /api/ {
+        proxy_pass http://openviking.openviking.svc.cluster.local:1933/api/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /health {
+        proxy_pass http://openviking.openviking.svc.cluster.local:1933/health;
+        proxy_set_header Host $host;
+    }
+
+    location /ready {
+        proxy_pass http://openviking.openviking.svc.cluster.local:1933/ready;
+        proxy_set_header Host $host;
+    }
+
+    # bot stays disabled — no proxy for /bot/, static 404 by default nginx behavior.
+
+    location / {
+        root /usr/share/nginx/html;
+        index index.html;
+        try_files $uri $uri/ /index.html;
+    }
+}

cluster/platform/openviking/namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: openviking
+  annotations:
+    # Wave 8 (platform-level): OpenViking deployment (after Harbor at Wave 7)
+    # This is documentation only - sync-wave at Application level, not resource level
+    # Depends on: cert-manager, nginx-ingress, External Secrets Operator

cluster/platform/openviking/values.yaml

@@ -0,0 +1,240 @@
+# ============================================================================
+# OpenViking Helm Chart Values
+# Cluster: fastpass (Talos Kubernetes)
+# Wave: 8 (after Harbor at Wave 7)
+# Pilot scope: Two corpora (hermes/ skills, personal/homelab/)
+# ============================================================================
+#
+# KEY CONSTRAINT: Vault (~/friday) is the CANONICAL source of truth.
+# OpenViking's index is a derived cache, rebuilt from vault source files.
+# If index and vault ever diverge, vault wins and re-index runs.
+# See inbox/ryan/2026-08-13-openviking-pilot-deployment-plan.md for full context.
+#
+
+replicaCount: 1
+
+image:
+  repository: ghcr.io/volcengine/openviking
+  # Pin to a stable release tag (not "latest" for production-ish pilot)
+  tag: v0.3.17
+  pullPolicy: IfNotPresent
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  create: false
+  annotations: {}
+  name: ""
+
+podAnnotations: {}
+podLabels:
+  app: openviking
+  wave: "8"
+
+# Security context: run as non-root if the image supports it
+podSecurityContext: {}
+securityContext: {}
+
+# Service: ClusterIP (no direct external exposure; MCP proxy handles agent access)
+service:
+  type: ClusterIP
+  port: 1933
+
+# ============================================================================
+# Ingress: enabled, INTERNAL-ONLY
+# Constraint from Phase 0 (Ryan's decision, 2026-08-13):
+# Standard nginx-ingress fronting the service (consistent with Harbor pattern),
+# but internal DNS only — no external/public DNS entry, no public-facing cert-manager issuer.
+# Use internal CA / self-signed cert to get ingress consistency without expanding public attack surface.
+# ============================================================================
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    # Internal cert-manager cluster issuer (DNS-01 via Cloudflare)
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    # Block external DNS registration (internal only)
+    external-dns.alpha.kubernetes.io/enabled: "false"
+  hosts:
+    - host: openviking.local.mk-labs.cloud
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: openviking-tls
+      hosts:
+        - openviking.local.mk-labs.cloud
+
+# ============================================================================
+# Resources: start conservative, tune after pilot
+# ============================================================================
+resources:
+  limits:
+    cpu: "2"
+    memory: 4Gi
+  requests:
+    cpu: 500m
+    memory: 1Gi
+
+# ============================================================================
+# Persistence: RocksDB index + workspace
+# Storage class: px-fa-direct-access (Portworx direct access to Pure FlashArray)
+# Rationale (from Phase 0 / t_77b3ff79): 40+ days of proven production history on fastpass,
+# RocksDB-optimized (direct block access, not NFS), RAID 6 durability via FlashArray.
+# Access mode: ReadWriteOnce (single replica only — RocksDB does not support concurrent access)
+# Update strategy: Recreate (no rolling updates; single-replica RocksDB workload)
+# ============================================================================
+persistence:
+  enabled: true
+  storageClass: px-fa-direct-access
+  accessMode: ReadWriteOnce
+  size: 30Gi  # 30Gi provides headroom for ~6 months of pilot corpus growth (~2GB actual use at launch)
+  existingClaim: ""
+  mountPath: /app/.openviking
+
+# Pod disruption budget: single replica, no HA
+# Explicit Recreate strategy (handled via Deployment patch in ArgoCD Application)
+podDisruptionBudget: {}
+
+# ============================================================================
+# Bot feature: disabled (scope out vikingbot for this phase)
+# ============================================================================
+bot:
+  enabled: false
+
+# ============================================================================
+# OpenViking server configuration (ov.conf)
+# Rendered into a ConfigMap mounted at ${persistence.mountPath}/ov.conf
+# ============================================================================
+config:
+  storage:
+    workspace: ""  # Defaults to /app/.openviking/openviking_workspace
+    vectordb:
+      name: context
+      backend: local
+      project: default
+    agfs:
+      backend: local
+      timeout: 10
+  log:
+    level: INFO
+    output: stdout
+  server:
+    host: "0.0.0.0"
+    port: 1933
+    workers: 1
+    # root_api_key injected via environment variable + ExternalSecret
+    root_api_key: "${OPENVIKING_ROOT_API_KEY}"
+    cors_origins:
+      - "*"
+
+  # ============================================================================
+  # Embedding configuration (dense)
+  # Provider: openai-compatible endpoint (local llama-server router)
+  # Model: nomic-embed-text-v1.5-Q4_K_M (137M params, 768-dim, local inference)
+  # Endpoint: http://astro-orbiter:8002/v1 (folded into existing astro-orbiter router per t_eb36eb2e)
+  # No cloud key needed; internal unauthenticated endpoint
+  # ============================================================================
+  embedding:
+    dense:
+      provider: "openai"
+      api_base: "http://astro-orbiter:8002/v1"
+      api_key: "${OPENVIKING_EMBEDDING_API_KEY}"  # Placeholder: "local-nomic" or similar
+      model: "nomic-embed-text-v1.5"
+      dimension: 768
+      input: "text"
+    max_concurrent: 5
+    # max_input_tokens caps the raw text tokens OpenViking sends per chunk to the
+    # embedding model. astro-orbiter's llama.cpp router hard-caps nomic-embed-text-v1.5's
+    # effective context at 2048 tokens regardless of ctx-size config (known llama.cpp
+    # nomic-bert limitation, not fixable via server flags). OpenViking's chunker was
+    # observed producing 2000-3400 token chunks, well over that ceiling, causing
+    # `400 exceed_context_size_error, n_ctx: 2048` and endless circuit-breaker re-enqueues.
+    # Set well under 2048 (1536) to leave headroom: OpenViking's chunk-time token
+    # estimator is not the same tokenizer llama.cpp uses to count context, so token
+    # counts won't match 1:1 between the two. Approved by Ryan as lowest-risk fix
+    # (option 1 of 3) vs. touching the astro-orbiter serving stack further.
+    #
+    # ROOT CAUSE (2026-08-15 incident): 1536 was still not low enough. Observed
+    # llama.cpp actual n_prompt_tokens vs. OpenViking's own max_input_tokens=1536
+    # estimate ratio ranged 1.35x-1.86x across real ingested chunks (see homelab
+    # re-ingest circuit-breaker errors, e.g. estimate 1536 -> actual 2860 tokens,
+    # 2124, 2088, 2066... all > 2048 n_ctx ceiling). OpenViking's estimator
+    # (likely a chars/4 or similar heuristic) undercounts vs. llama.cpp's real
+    # BPE/wordpiece tokenizer for this corpus's content (dense code/config
+    # snippets tokenize denser than the estimator assumes). Lowering to 1536 alone
+    # does not hold for all chunks; using worst-observed ratio (1.86x) with margin,
+    # 2048 / 1.86 ~= 1100, rounded down further for safety across untested
+    # corpora -> 1024.
+    max_input_tokens: 1024
+
+  # ============================================================================
+  # VLM / Summarization configuration (L0/L1/L2 generation)
+  # Provider: openai-compatible endpoint (local llama-server router)
+  # Model: Llama-3.1-8B (already resident on astro-orbiter per Phase 0 analysis)
+  # Endpoint: http://astro-orbiter:8002/v1 (same router as embedding)
+  # No cloud key needed; internal unauthenticated endpoint
+  # max_concurrent: 4 (recommend capping background indexing load on shared VLM)
+  # ============================================================================
+  vlm:
+    api_base: "http://astro-orbiter:8002/v1"
+    api_key: "${OPENVIKING_VLM_API_KEY}"  # Placeholder: "local-llama" or similar
+    # Fixed 2026-08-15: "llama3.1-8b" does not exist on astro-orbiter's /v1/models
+    # (caused every summarization call to fail with 400 model not found, endless
+    # circuit-breaker retries). Actual served model id/alias confirmed via
+    # /home/hermes/git/homelab/ansible/playbooks/day2_add_nomic_embed.yml and
+    # day2_per_model_ctx_size.yml: "Meta-Llama-3.1-8B-Instruct-Q4_K_M".
+    model: "Meta-Llama-3.1-8B-Instruct-Q4_K_M"
+    provider: "openai"
+    temperature: 0.0
+    max_retries: 2
+    thinking: false
+    max_concurrent: 4  # Cap background indexing pressure on shared VLM
+
+# ============================================================================
+# Extra environment variables: secrets from ExternalSecret
+# Injected by ArgoCD Application via kustomize or helm hook
+# ============================================================================
+extraEnv:
+  - name: OPENVIKING_ROOT_API_KEY
+    valueFrom:
+      secretKeyRef:
+        name: openviking-credentials
+        key: root_api_key
+  - name: OPENVIKING_EMBEDDING_API_KEY
+    valueFrom:
+      secretKeyRef:
+        name: openviking-credentials
+        key: embedding_api_key
+  - name: OPENVIKING_VLM_API_KEY
+    valueFrom:
+      secretKeyRef:
+        name: openviking-credentials
+        key: vlm_api_key
+
+# ============================================================================
+# Probes
+# ============================================================================
+livenessProbe:
+  httpGet:
+    path: /health
+    port: http
+  initialDelaySeconds: 30
+  periodSeconds: 30
+  timeoutSeconds: 5
+  failureThreshold: 3
+
+readinessProbe:
+  httpGet:
+    path: /ready
+    port: http
+  initialDelaySeconds: 15
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 3
+
+nodeSelector: {}
+tolerations: []
+affinity: {}