# Strata v0.1.43 source and deployment review Both quantizations have passed independently recorded real inference with Docker network isolation, a nonroot user, read-only root/model mounts and no capabilities. The engine was compiled before runtime, and official standard/optional benchmark outputs are preserved. Final benchmark/scoring status is recorded in the technical report and immutable evidence snapshot. This is an engineering review, not an independent security audit or certification. The vulnerability scans cover the retained inference images only. They do not scan the Proxmox host, NVIDIA kernel driver, workstation or separate EvalPlus scorer. Retaining the exact image archive permits reproducible deployment; byte-identical rebuilds are not guaranteed with live apt repositories and incompletely locked reconstructed scorer transitives. ## Exact baseline - Repository: https://github.com/Niko1221/Strata - Release: https://github.com/Niko1221/Strata/releases/tag/v0.1.43 - Resolved commit: `7695859aa13afb248bdb4d36f9b2e95707db079d`. - Annotated tag object: `16374b3e6dfe452a163c3a961ae5faa3b4aec84b`. - Embedded llama.cpp source pin: `3cf03257f219afbe7334045ff7c6a06ac68c627d`. - Engine sources and official benchmark tools are retained without edits. - CUDA 13.0.0 Ubuntu 24.04 amd64 builder manifest: `sha256:435220c0fef35cbf712e11999f8670a83835ef3cdd18564e5e8122f83078c88c`. - CUDA 13.0.0 Ubuntu 24.04 amd64 runtime manifest: `sha256:4757e6477d94d56fd8230e15b7d59956750c983a47a42584f44dbe143090da82`. - Production image `sonnyslabs/strata:0.1.43-sm120-v2`: `sha256:f759e6167315dac77292d394a470240493dad78de6d23dd270eaa5c7ffc3e143`. - Compiled engine SHA256: `ffae66a01126cbf32723380d249f49dff5387a35292c52818fb7e2ea6734837f`. SM120, vision disabled. Runtime v2 updates OS/CUDA packages; the engine hash matches v1. No engine compilation occurred during that update or inference. ## Confirmed source findings | Finding | Evidence in pinned checkout | Experiment treatment | |---|---|---| | Official Dockerfile compiles the engine during image build. | `Dockerfile` build stage | Retain build-time compilation, narrow architecture to 120, disable vision. | | Official startup invokes setup even after an installation exists; first setup can download model artifacts. | `docker-entrypoint.sh`, final `exec ... setup.py`; `setup.py` ensure/update paths | Separate preparation from serving. Runtime directly executes `serve.server`. | | Default prebuilt selection tries the checkout's release and then latest. | `setup.py:prebuilt_bases` | Do not use upstream prebuilt executables. Compile pinned source locally. | | Executable verification uses the GitHub release asset digest when available, rejects mismatches, but warns and continues when the digest is unavailable; a skip environment variable also exists. | `setup.py`, executable verification around lines 2808–2876 | No runtime executable fetch. Verify locally compiled engine against the build receipt at every start. | | llama.cpp is fetched as a source archive at a commit pin. | `setup.py:get_llama_cpp` | Record observed archive SHA256. No independently published archive hash has yet been verified. | | Requirements pin Python package versions including listed transitives; official Dockerfile upgrades pip without a version pin. | `requirements.txt`, `Dockerfile` | Do not upgrade pip from the network. Download wheels in the build and inventory their SHA256 values; install from that wheelhouse offline. | | Config may start MCP subprocesses; client tool calling and server-side tool execution are different capabilities. | `serve/mcp.py:hub_from_config`; `serve/server.py` MCP opt-in | Runtime entry point refuses nonempty MCP configuration. Benchmark tool calls remain client-controlled. | | Vision code can fetch remote images. | `serve/server.py:Vision.download` | Text-only configuration rejects vision. Tested inference uses Docker network isolation. | | Server retains recent prompts/answers and request metadata in memory for monitoring. | `serve/server.py:Service`, API monitor | Use synthetic public benchmark data and local namespace access; review logs before packaging. | ## Build and runtime boundary Build/preparation may reach signed Debian/Ubuntu repositories, Docker Hub, PyPI, GitHub source archives and pinned Hugging Face files. This access does not imply the inference runtime can reach those services. Tested inference restrictions: unprivileged LXC; nonroot Docker user 65534; read-only image filesystem, model/config mounts read-only; a dedicated writable logs directory; temporary filesystem; all capabilities dropped; `no-new-privileges`; no Docker socket, host root, management paths or SSH keys; only NVIDIA device access required for inference. The production entry point checks the engine digest, executable path, working directory, library paths, environment overrides and absence of MCP/vision configuration. The IQ2 offline test passed using `--network none` and `docker exec` for the local HTTP client. It loaded the model, returned healthy, and generated exactly `STRATA_OFFLINE_OK` (21 prompt tokens, six generated). Socket interface discovery found only loopback; IPv4 routes were empty and an external TCP probe failed. The client shared the isolated server namespace, not the host network. Inspection and logs capture UID 65534, capabilities zero, NoNewPrivs 1, seccomp mode 2, read-only root and read-only model/config mounts. The first validator mistakenly counted the sysfs control file `bonding_masters` as a network interface; its false failure is retained alongside the corrected socket-based validator and passing rerun. No privileged flag or unlimited memlock was needed for successful CUDA page-locked expert RAM. IQ3 must pass its own smoke test before inference is claimed for that quantization. No container restriction eliminates kernel, NVIDIA driver, native engine, Python dependency or parser vulnerabilities. NVIDIA driver libraries are copied from the running host at exact version 615.71.09, with observed hashes in private provisioning records. GPU access shares the host driver/kernel. ## Reproducibility limits still open - Image and base digest receipts are retained; Docker image archives remain on the experiment filesystem for offline inspection/reuse. - Apt packages are resolved from signed repositories, not a frozen snapshot; package inventories record what was installed. A build on another day may resolve different OS package versions. - Wheel hashes are observed build receipts, not independently trusted hashes embedded before the first build. Preserve the wheelhouse for offline rebuilds. - The builder's bootstrap Python/pip packages come from the pinned base plus resolved OS packages. Pinning those fully requires retaining the actual image. - Source commit pins identify code; they do not establish that it is benign. - Syft 1.54.1 generated native JSON and CycloneDX SBOMs. Grype 0.120.1 scanned both runtime archives against the same database. Original: 550 package matches, 296 unique IDs, 14 high matches covering three IDs. Updated: 281 matches, 151 unique IDs, 253 medium, 26 low, two negligible, zero high/critical. A package match is not an independently confirmed exploit. Official scanner release checksums were verified from the same origin, not an independent signature. - Updated package inventory includes OpenSSL/libssl3t64 3.0.13-0ubuntu3.16 and GnuPG 2.4.4-2ubuntu17.6. Remaining medium/low findings are preserved, not hidden. - Strict JSON-schema validation is unavailable in the tested production image because its optional validator dependency is absent. Valid JSON examples do not establish schema enforcement. No dependency was installed during serving. ## Bob's video and fork Reference: https://www.youtube.com/watch?v=i18vpg0T-mk and https://github.com/robertkarl/UnbiasedStrata (reference only). Direct video retrieval was unavailable. The prior video project's retained `source/source-bob-transcript.en.vtt` was located and read, with provenance in its `COMPLETION.md`. See `bob-comparison.md` for caption timestamps and the measured comparison. Caption ambiguity is disclosed; ambiguous lines are not used as evidence. This experiment independently confirms the source behaviors above. It has not established malicious behavior, endorsement, or complete safety. ## Supply-chain and attribution evidence to finish Preserve image inspections/history, base registry digests, source/engine/build hashes, package inventories, wheel hashes, model LFS hashes, MTP verification, pack metadata, preparation/build logs, and offline smoke evidence. Credit Strata maintainers and contributors, Qwen, ISTA-DASLab/GSQ-RCO contributors, llama.cpp/ggml, NVIDIA/container tooling and Bob's independent work accurately. Contributor-specific claims remain subject to checking the pinned model cards and upstream attribution files.