#Embedded Inference Architecture

Power treats inference as a bounded operation whose identity and effects can be verified. It does not treat a model name as an execution contract.

#Derive the boundary from first principles

#One core, three surfaces

revision-locked bundle       model-owned graph       API client
          |                         |                     |
    provisioner                 embedded               service
          \                         |                    /
           +----------- shared runtime core -----------+
                                  |
              admission / placement / cancellation
                                  |
                    devices / weights / state
                                  |
                   evidence / canonical receipt
                                  |
                      independent verification

The embedded library and hosted service are entry points into the same contracts, not two model implementations. Artifact provisioning is independent because downloading and installing a reviewed bundle is a different authority from executing it.

#Ownership is explicit

This boundary keeps Power model-neutral. Language, vision, OCR, embedding, and future model crates can share resource and evidence machinery without moving their semantics into a central model switch statement.

#The runtime contracts

#Bounded execution

Admission limits active and queued work. Device admission prevents independent models from overcommitting the same accelerator. Cancellation is checked before admission and remains safe while a request waits or executes. A caller may set one monotonic deadline across sequential model and physical-device waits; expiry releases earlier permits and records only aggregate counters, never a wall-clock timestamp, request content, or slot identity.

#Model-owned finite profiles

Model crates may declare finite optimized shape classes as opaque SHA-256 identities. Power checks only aggregate batch, tensor-element, scratch, device, artifact, and TEE-policy bounds; it never interprets sequence lengths, image geometry, tokenization, or a model family. Unsupported classes either fail closed or select an explicitly identified dynamic implementation. Receipt v5 records that decision without exposing private geometry.

#Model-neutral mutable replicas

Stateful model crates can request a finite set of lazy, independently initialized session replicas for one exact model and execution identity. Each non-cloneable lease owns one anonymous slot; all slots share the same resolved runtime and physical-device admission gate. Power reserves the worst-case resident bytes before any loader runs and reports only aggregate replica counts. Language, vision, OCR, embedding, and multimodal contexts use the same path: the model family is opaque identity, never a dispatch branch. Replica acquisition can use the same monotonic deadline contract, and its pool-lifetime expiry counter survives removal of an otherwise empty entry. A model crate can also consume an exclusive lease with retire() after its own health check rejects mutable state. Power replaces that anonymous generation before returning the slot and reconstructs it lazily; failed or cancelled reconstruction remains retryable and cannot disturb healthy peers. Telemetry contains only current pending-reconstruction and cumulative lifecycle counts.

#Device-resident reviewed graph chains

Adjacent reviewed graphs can pass an opaque ResidentGraphTensor without an intermediate owned host copy. The non-cloneable handle retains the exact request permit and a shared runtime byte reservation. The next graph must use the same runtime, logical device, permit, F32 dtype, and a compatible reviewed fixed/symbolic shape. Errors, cancellation, and drops release the reservation.

Power hashes the initial owned input and the one final materialized output. It does not invent an intermediate digest or silently copy across runtimes. This is a generic graph boundary, not a language-model engine: model crates still own architecture, quantization, attention, tokenization, decoding, image geometry, and the choice of graphs to compose.

#Verified weights

Weight descriptors bind tensor ranges to storage identities. Complete and partial mirrors retain that identity across storage tiers. Placement and residency evidence record the actual selected path rather than the preferred path alone.

#Accelerator evidence

Execution receipts can include the concrete device, fallback, fused-batch, or multi-device mesh selected for a declaration-bound execution. Evidence must match the model, runtime device, input digest, and output digest before it can be attached to a receipt.

#Recoverable state

Authenticated sealed-state envelopes bind model and runtime identity to warm state. Recovery policy distinguishes primary and backup sources, authorizes export scopes, detects rollback, and zeroizes sensitive material.

#Private observability

Digest-only receipts and telemetry make execution inspectable without requiring prompt or response content. Opaque renderer paths omit claims they cannot derive instead of fabricating deterministic evidence.

#Execution lifecycle

declare limits and identity
          |
          v
admit model + device capacity
          |
          v
resolve storage + placement
          |
          v
execute reviewed model plan
          |
          v
commit input/output/device evidence
          |
          v
release permits and verify receipt

The detailed design includes tensor batches, residency budgets, partial mirrors, prefetch hints, heterogeneous meshes, sealed state, and tuning evidence. Read the canonical architecture document for the complete APIs, invariants, and validation gates. The shape-profile contract session-replica contract, and resident-graph contract document their model-neutral ownership boundaries and reproduction commands.