Flow
What each old rule became
1Network off
Stays off. No change.
2Training off
Stays off. No change.
3Running off, port off
Now both must be on or both off.
4Running off
Now allowed only if the test report says passed.
5No model calls
Now one call, on the box only, with an exact expected answer.
According to the gate for the GPU box, the model I'd picked wasn't running. That was true. But one reason my notes gave for it was wrong, and once I fixed that, the gate had to learn to say "just this one thing is OK."
A few files and one picky script
It's not a service. It's a few files I keep in the repo, plus a script that checks them against each other. One file is the plan. One is a log of read-only checks run on the box, each marked as found, not found, or not run. One is a test report. At the start, the script wanted every "on" switch in every file to be off, and it wanted the status to say blocked.
The check looked for the wrong program
The plan wanted a big model server first and a backup second. Neither was installed. The row for a small llama.cpp server was marked bad too. When I read why, the check had looked for the command-line tool, which isn't on the box. The server program is. A copy of my model was already on disk.
I pointed the check at the right program and it came back fine. I added a check that the model file exists, and a read of the server's model list. That read failed, which was the right answer. Nothing was running yet.
Fix the plan before turning anything on
The small server moved to the top of the plan. The big one stayed as the later choice. The log still said the model wasn't served. Only after that did anything get turned on.
The server was started by hand, and it only listens on the box itself. Its model list showed the model. One test call asked it to repeat a set word, and it did. The report went to passed.
Turning "never" into "only this"
Deleting the old checks would have been easy. Instead, each one changed into something narrower:
- Network access stays off, and so does training.
- "Running" and "listening on a port" must both be on or both be off.
- "Running" is only allowed if the test report says passed.
- The test call has to stay on the box and get back exactly the word it asked for.
- One call made, one run allowed. A second run would mean editing that number.
The core rule is short.
The main rule is that nothing counts as running unless a passed test report backs it.
The list of banned work got edited, not wiped. "Model server" became "more model servers." Installs and public access were added to it.
What still bugs me
The script now demands "passed," the way it used to demand "blocked." Say the server crashes. An honest "failed" in the report would break my own build. And since it only reads files, it can't even tell me the server is down. I'd have to go look.