Expose a narrowly bounded loopback service without turning model acquisition or filesystem authority into a request API.
Bind loopback
Listen on localhost by default and require a separate threat model, authentication, TLS, origin policy, and network controls before broader exposure.
Startup ownership
Acquire, verify, and load the model during controlled host startup. Do not accept model uploads, arbitrary paths, or URLs from generation requests.
Request bounds
Set body size, prompt length, output token, concurrency, timeout, and cancellation limits. Use RequestAborted as a cancellation input.
Response evidence
Return a narrow result and path-free state; keep package version, model hash, selected backend, stop reason, and limitations in local evidence.
Available now
- The public UAIX.LmRuntime package family and canonical package documentation.
- The host-facing workflow and evidence distinctions described on this page.
Host responsibilities
- Select and trust inputs, define policy and limits, integrate the UI or service, retain application evidence, and test the exact deployment.
Not claimed
- Loopback is not equivalent to secure public exposure.
- The runtime does not own HTTP, authentication, or server policy.
Operational boundary
What this page covers: Expose a narrowly bounded loopback service without turning model acquisition or filesystem authority into a request API.
Available now: The documented package surfaces and this host-facing guidance are public.
Host responsibility: Own acquisition, trust, configuration, presentation, persistence, transport, policy, tests, and deployment.
Not claimed: Universal compatibility, production certification, safety certification, hidden fallbacks, or behavior beyond retained evidence.
Canonical sources: Canonical package documentation · Current release metadata
Last reviewed UTC:
Source and review record
Prerequisites
- Read Get Started
- Review host/runtime boundaries