schema_version: "1.0" deployment: name: omni-local mode: local_only public_entrypoint: "http://127.0.0.1:8006" only_public_port: 8006 auto_start_models: false auto_download_models: false local_files_only: true fail_closed_on_missing_model: true state_dir: "${OMNI_STATE_DIR:-./.state}" artifact_dir: "${OMNI_ARTIFACT_DIR:-./artifacts}" network: bind_default: "127.0.0.1" allow_remote_endpoints: false gateway_proxy_prefix: "/v1/agent" services: minicpm_gateway: host: "127.0.0.1" port: 8006 public: true minicpm_registry: host: "127.0.0.1" port: 8007 public: false minicpm_worker: host: "127.0.0.1" port: 22400 public: false minicpm_backend: host: "127.0.0.1" port: 22500 public: false conductor: host: "127.0.0.1" port: 8100 public: false streaming_asr: host: "127.0.0.1" port: 8101 public: false intent_router: host: "127.0.0.1" port: 8102 public: false qwen_coder: host: "127.0.0.1" port: 8103 public: false host_loopback_publication: true lan_publication: false model_manager: host: "127.0.0.1" port: 8110 public: false media_api: host: "127.0.0.1" port: 8111 public: false hermes_agent: host: "127.0.0.1" port: 8642 public: false desktop_sidecar: host: "127.0.0.1" port: 8765 public: false hermes_sidecar_bridge: host: "127.0.0.1" port: 8766 public: false h3_controller: host: "127.0.0.1" port: 30010 public: false h3_worker: host: "127.0.0.1" port: 30011 public: false hunyuan_image: host: "127.0.0.1" port: 30020 public: false hardware: selected_profile: "${OMNI_HARDWARE_PROFILE:-mi300x_single}" probe_at_runtime: true never_infer_capacity_from_device_count: true require_free_memory_probe_before_colocation: true profiles: mi300x_single: status: recommended vendor: amd architecture: cdna3 device_count: 1 per_device_memory_gib: 192 memory_is_single_device_address_space: true preferred_precision: bf16 minicpm_precision: fp16_existing_checkpoint qwen_precision: bf16 rocm: require_supported_runtime_and_kernel_probe: true require_hip_health_probe: true placement: target: colocate_minicpm_and_qwen_when_probed_free_memory_allows conversation_priority: minicpm_o_4_5 qwen_is_preemptible_at_idle_boundary: true media_never_loads_without_new_memory_lease: true do_not_overcommit_from_nominal_capacity: true mi50_12x16_legacy: status: legacy_unsupported_current_rocm vendor: amd architecture: gfx906 device_count: 12 per_device_memory_gib: 16 memory_is_single_device_address_space: false never_report_summed_memory_as_one_pool: true automatic_selection: false production_recommended: false expected_service_level: degraded_non_realtime requirements: - isolated_operator_pinned_legacy_rocm_stack - exact_kernel_and_runtime_smoke_test - explicit_tensor_parallel_support_per_model - per_rank_memory_and_collective_probe restrictions: - no_low_latency_guarantee - no_assumed_cross_gpu_memory_pooling - no_unverified_minicpm_duplex_sharding - no_unverified_qwen_speculation remote_compute: enabled: "${OMNI_REMOTE_NODES_ENABLED:-false}" default_role: delegated_qwen_and_tool_planning_only paired_node_role: full_qwen_and_hermes_feature_parity local_voice_and_video_are_authoritative: true direct_local_hermes_provider: capabilities: - hermes.run - code - tools - internet.search permissions: - tool.execute - network.search forbidden_without_paired_sidecar: - desktop.observe - desktop.control - files.read - files.write - webcam.read - context.vision main_computer_uses_paired_mtls_sidecar_for_privileged_resources: true discovery: method: mdns service_type: "_omni-node._tcp.local." enabled: "${OMNI_MDNS_DISCOVERY_ENABLED:-false}" discovery_is_never_trust: true advertisement_ttl_seconds: 10 txt_allowlist: - protocol_version - node_id - pairing_state - api_port listener: enabled: "${OMNI_REMOTE_LISTENER_ENABLED:-false}" default_host: "127.0.0.1" host: "${OMNI_NODE_LISTEN_HOST:-127.0.0.1}" port: "${OMNI_NODE_LISTEN_PORT:-8100}" reject_unspecified_bind: - "0.0.0.0" - "::" require_explicit_lan_interface: true require_mtls_before_accepting_jobs: true pairing: enabled: "${OMNI_PAIRING_ENABLED:-false}" method: one_time_code_with_mutual_sas_confirmation window_seconds: 120 max_attempts: 5 single_use: true issue_scoped_client_certificate: true close_pairing_window_after_success: true persist_only: - node_id - certificate_fingerprint - allowed_roles - paired_at security: transport: mtls_tls_1_3 ca_path: "${OMNI_MTLS_CA_PATH:-}" certificate_path: "${OMNI_MTLS_CERT_PATH:-}" private_key_path: "${OMNI_MTLS_KEY_PATH:-}" private_key_passphrase_env: OMNI_MTLS_KEY_PASSPHRASE node_allowlist_path: "${OMNI_NODE_ALLOWLIST_PATH:-./.state/pairing/nodes.json}" require_certificate_and_node_allowlist: true certificate_rotation_days: 30 revocation_check: true never_log_pairing_code_or_private_key: true capability_grants: default: deny require_both_certificate_role_and_local_grant: true grant_is_signed_and_scoped: true max_grant_seconds: 3600 fields: - grant_id - node_id - capability - session_id - path_or_device_scope - issued_at - expires_at available: qwen.inference: interactive_confirmation: false hermes.computer_use: interactive_confirmation: true screen.capture: interactive_confirmation: true visible_remote_indicator: true files.read: interactive_confirmation: true require_path_scope: true files.write: interactive_confirmation: true require_path_scope: true webcam.capture: interactive_confirmation: always_per_session require_device_scope: true indicator_before_first_frame: true persistent_camera_indicator: true never_activate_on_unpaired_node: true internet.search: interactive_confirmation: false paired_node_resources: qwen_inference: true hermes_computer_use: true screen_and_files: capability_grant_required webcam: explicit_paired_node_grant_required resource_locality: resources_stay_on_the_node_that_owns_them inter_node_raw_media_forwarding: false advertisement: fetch_only_after_mtls: true signed: true max_age_seconds: 5 required_fields: - protocol_version - node_id - boot_id - sequence - timestamp - exact_model_ids_and_revisions - supported_precisions - inference_modes - tool_schema_versions - accelerator_devices - healthy - queue_depth - available_slots - measured_latency_ms accelerator_memory: report_per_device_only: true never_sum_as_single_pool: true selection: require_exact_model_revision: true require_matching_tool_schema: true prefer_profile: mi300x_single scoring_order: - healthy_and_fresh - exact_capability_match - locally_measured_p95_latency - available_slots - mi300x_preference ignore_self_reported_latency_without_local_probe: true stale_node_policy: remove_from_candidates sessions: affinity: rendezvous_hash_over_eligible_nodes lease_seconds: 30 renew_seconds: 10 preserve_node_for_active_operation: true idempotency_key: operation_id node_deduplication_ttl_seconds: 3600 cancel_requires_ack: true cancel_retry_count: 3 failover: allowed_before_external_side_effect: true allowed_for_idempotent_stage: true never_blindly_replay_unknown_side_effect: true unknown_commit_state: reconcile_required qwen_inference: eligible_exact_capability_node hermes_computer_use: same_node_or_reconcile_required screen_files_webcam: no_cross_node_failover_without_new_grant targeting: modes: - auto - paired_node_id user_selected_node_overrides_preference_if_healthy_and_capable: true reject_unpaired_target: true show_active_node_in_ui: true payload_policy: allowed: - sanitized_text_prompt - structured_tool_schema - structured_tool_result - operation_and_trace_ids forbidden: - raw_microphone_audio - raw_camera_video - raw_desktop_capture - credentials - clipboard_secrets vision_required_policy: keep_local_or_clarify encrypt_in_transit: mtls retain_remote_payload_seconds: 0 indicators: remote_operation: visible_for_entire_operation: true show_node_name: true remote_camera: visible_before_first_frame: true visible_for_entire_capture: true include_device_name: true may_not_be_suppressed_by_remote_node: true emergency_stop: local_always_available: true stop_actions: - cancel_active_operations - stop_remote_camera_before_next_frame - revoke_active_capability_grants - close_node_transport revoke_pairing: remove_from_allowlist: true revoke_certificate: true invalidate_session_leases: true node_heartbeat_expiry_stops_tools: true audit: enabled: true append_only_local_path: "${OMNI_REMOTE_AUDIT_PATH:-./.state/audit/remote-nodes.v1.jsonl}" events: - discovery_seen - pairing_started - pairing_completed - pairing_revoked - capability_granted - capability_denied - capability_revoked - operation_routed - tool_started - tool_completed - camera_started - camera_stopped - emergency_stop - failover_or_reconcile never_store: - pairing_code - private_key - credential_value - raw_audio - raw_video - raw_screen_frame offline_mock: enabled: true never_open_socket: true candidates: - node_id: mock-mi300x profile: mi300x_single healthy: true exact_model_revision: true tool_schema_match: true measured_latency_ms: 18 - node_id: mock-mi50-legacy profile: mi50_12x16_legacy healthy: false exact_model_revision: false tool_schema_match: false measured_latency_ms: 9999 conversation: owner: minicpm_o_4_5 model_path: "${MINICPM_MODEL_PATH}" model_revision: "${MINICPM_MODEL_REVISION}" dtype: fp16 local_files_only: true native_duplex_path: true speculative_decoding: enabled: false reason: native_multimodal_duplex_state_is_latency_critical ingress: websocket: "ws://127.0.0.1:8006/v1/realtime" audio_to_minicpm_is_authoritative: true video_to_minicpm_is_authoritative: true asr_is_side_tap_only: true context: strategy: sliding budget_tokens: "${MINICPM_CONTEXT_BUDGET_TOKENS:-32768}" reserve_generation_tokens: "${MINICPM_RESERVE_TOKENS:-2048}" keep_recent_turns: "${MINICPM_KEEP_RECENT_TURNS:-10}" preserve_system_identity: true preserve_active_tool_operation: true preserve_recent_tool_results: true old_audio_policy: transcript_summary old_video_policy: sparse_keyframe_summary never_drop_unacknowledged_user_turn: true interruption: user_barge_in: true cancel_assistant_audio_immediately: true cancel_background_job_only_on_explicit_cancel: true transcript_side_tap: endpoint: "ws://127.0.0.1:8101/v1/stream" enabled: true audio: encoding: pcm_s16le sample_rate_hz: 16000 channels: 1 emit_partials: true route_only_final_transcripts: true partial_debounce_ms: 80 final_silence_ms: 280 connect_timeout_ms: 350 local_files_only: true model_path: "${ASR_MODEL_PATH}" model_revision: "${ASR_MODEL_REVISION}" routing: endpoint: "http://127.0.0.1:8102/v1" deterministic_first: true deterministic_budget_ms: 2 model_fallback: enabled: "${OMNI_ROUTER_ENABLED:-false}" model_path: "${ROUTER_MODEL_PATH:-}" model_revision: "${ROUTER_MODEL_REVISION:-}" local_files_only: true timeout_ms: 650 temperature: 0.0 max_output_tokens: 160 routes: dialogue: minicpm_o_4_5 hermes: hermes_qwen video: media_h3 image: media_hunyuan cancel: conductor clarify: minicpm_o_4_5 quality_guards: confidence_floor_for_action: 0.82 ambiguous_action: clarify never_execute_from_partial_transcript: true high_risk_requires_confirmation: true qwen_inference: service: "http://127.0.0.1:8103/v1" deployment_alias: qwen3.8-27b launcher: module: qwen_runtime.launcher shell: false inspect_only_supported: true never_download: true never_import_vllm_during_probe: true checkpoint_attestation: "${QWEN_MODEL_PATH}/.omni-checkpoint.json" checkpoint_attestation_sha256_env: QWEN_CHECKPOINT_MANIFEST_SHA256 require_exact_target_model_id: Qwen/Qwen3.8-27B require_pinned_40_character_revision: true require_config_and_weight_index_sha256: true require_all_indexed_shards_present: true bind: container: 0.0.0.0 container_internal_marker_required: true host: 127.0.0.1 port: 8103 lan_publication: false api_key_env: QWEN_API_KEY exact_identity: model_id: "${QWEN_EXACT_MODEL_ID}" model_path: "${QWEN_MODEL_PATH}" model_revision: "${QWEN_EXACT_MODEL_REVISION}" require_local_path: true require_revision_pin: true dtype: "${QWEN_DTYPE:-bf16}" local_files_only: true engine: family: vllm image: "${QWEN_VLLM_IMAGE}" baseline_commit: "${QWEN_VLLM_BASELINE_COMMIT}" trust_remote_code: false continuous_batching: true prefix_caching: true chunked_prefill: true mode_selection: strategy: auto_at_engine_start selection_window_seconds: 60 switch_only_when_idle: true minimum_mode_residency_seconds: 300 low_concurrency_max_inflight: 2 high_concurrency_min_inflight: 3 low_concurrency_preference: - native_mtp - autoregressive experimental_canary: dflash2_exact hardware_preferences: amd_mi300x: - native_mtp - autoregressive nvidia_dflash2_validated: - dflash2_exact - native_mtp - autoregressive high_concurrency_mode: autoregressive modes: dflash2_exact: default_enabled: false rollout: benchmark_canary_only capability_gated: true lossless_verification: true exact_target_required: true speculator_path: "${QWEN_DFLASH2_SPECULATOR_PATH:-}" speculator_revision: "${QWEN_DFLASH2_SPECULATOR_REVISION:-}" speculator_manifest_sha256: "${QWEN_DFLASH2_MANIFEST_SHA256:-}" target_model_id: "${QWEN_EXACT_MODEL_ID}" target_model_revision: "${QWEN_EXACT_MODEL_REVISION}" engine_source: vllm_main engine_commit: "${QWEN_DFLASH2_VLLM_COMMIT:-}" require_pinned_40_char_commit: true block_sizes_to_benchmark: - 4 - 8 enable_only_after_parity_test: true amd: capability_gated: true canary_only: true automatic_selection: false required_checks: - exact_vllm_commit_builds_for_selected_rocm - all_dflash2_kernels_available_on_selected_gpu_architecture - deterministic_ar_parity_passes - p95_latency_beats_ar_on_target_hardware failure_fallback: - native_mtp - autoregressive launcher_gate: explicit_canary_env: QWEN_DFLASH2_CANARY explicit_mode: dflash2_canary auto_selection: false exact_speculator_model_id: incoai/Qwen3.8-27B-DFlash2 require_full_speculator_weight_sha256: true require_gate_file_sha256: true require_exact_target_speculator_and_vllm_commits: true require_gpu_arch: gfx942 parity_covers: - greedy - sampling - tool_json - stop_and_cancel benchmark_concurrency: - 1 - 2 benchmark_min_samples_per_mode: 100 benchmark_min_p95_improvement_percent: 5.0 native_mtp: capability_gated: true require_native_model_mtp_head: true lossless_verification: true num_speculative_tokens: 1 max_tokens_after_benchmark: 2 enable_only_after_parity_test: true autoregressive: enabled: true continuous_batching: true quality_baseline: true generation_defaults: temperature: 0.15 top_p: 0.9 max_output_tokens: 4096 code_and_tool_quality: require_structured_tool_schema: true validate_tool_arguments: true max_repair_attempts: 1 preserve_full_error_output: true hermes: runtime: native_windows_api api_base: "http://127.0.0.1:8642" api_key_env: HERMES_API_KEY model_alias: hermes-agent official_model_config: development: provider: openai-codex auth: chatgpt_device_code_managed_by_hermes default: gpt-5.6-luna production: provider: openai-api base_url: "https://api.openai.com/v1" api_key_env: OPENAI_API_KEY api_server: enabled_env: API_SERVER_ENABLED host: "127.0.0.1" port: 8642 bearer_key_env: API_SERVER_KEY key_is_separate_from_openai_api_key: true web_search_backends: choose_exactly_one: - env: SEARXNG_URL example: "http://127.0.0.1:8080" - env: TAVILY_API_KEY - env: EXA_API_KEY - env: PARALLEL_API_KEY - env: FIRECRAWL_API_KEY bind_loopback_only: true stream_transport: sse request_timeout_seconds: 900 toolsets: - name: desktop transport: paired_sidecar_mcp endpoint: "http://127.0.0.1:8766/v1/hermes/node-actions" capabilities: - screen.capture - mouse.move - mouse.click - mouse.drag - keyboard.type - keyboard.hotkey - clipboard.read - clipboard.write - name: browser transport: paired_sidecar_mcp capabilities: - browser.inspect - browser.navigate - browser.click - browser.type - browser.download_to_workspace - name: filesystem transport: paired_sidecar_mcp capabilities: - file.read - file.write - file.move - file.trash - name: shell_and_code transport: local_api capabilities: - shell.run - process.inspect - code.search - code.patch - tests.run - name: internet_search transport: hermes_core tool_name: web_search enabled: "${HERMES_ENABLE_INTERNET_SEARCH:-true}" network_access: explicit_runtime_capability api_key_env: HERMES_SEARCH_API_KEY capabilities: - web.search - web.open - web.read restrictions: - no_model_download - no_secret_in_query_or_event - no_unconfirmed_external_side_effect approvals: policy: dangerous_or_external_effect require_confirmation_for: - permanent_delete - privilege_escalation - credential_entry - purchase_or_payment - send_or_publish - install_or_uninstall - security_setting_change desktop_feedback: cursor_scale: 1.25 cursor_halo: true edge_activity_overlay: true overlay_click_through: true overlay_never_captures_input: true events: schema: "./contracts/event-envelope.schema.json" endpoint: "http://127.0.0.1:8100/v1/events" stream: "http://127.0.0.1:8100/v1/events/stream" transport: sse durable_store: "${OMNI_EVENT_STORE_PATH:-./.state/orchestrator/events.v1.jsonl}" protocol_version: "1.0" replay: enabled: true max_events: 10000 cursor_field: seq ordering: scope: session_id monotonic_field: seq terminal_states: - completed - failed - cancelled media: manager_endpoint: "http://127.0.0.1:8110" api_endpoint: "http://127.0.0.1:8111" request_schema: "./contracts/media-job.schema.json" never_auto_download: true load_cold_models_on_authenticated_job: true artifacts_as_urls_only: true max_parallel_jobs: 1 video: provider: minimax_h3 controller_endpoint: "http://127.0.0.1:30010" worker_endpoint: "http://127.0.0.1:30011" model_path: "${H3_MODEL_PATH}" model_revision: "${H3_MODEL_REVISION}" model_variant: fl2va local_files_only: true precision: preferred: bf16 official_baseline: bf16 fp16: requested: "${H3_ALLOW_FP16:-false}" capability_gated: true required_checks: - backend_reports_fp16_support - weights_load_without_implicit_cast - finite_output_smoke_test - bf16_quality_parity_threshold_passes failure_policy: refuse_start_and_report lifecycle: pool: cold min_loaded: 0 max_loaded: 1 load_on_first_job: true idle_unload_seconds: "${H3_IDLE_UNLOAD_SECONDS:-300}" unload_after_failure: true image: provider: hunyuan_image_3 endpoint: "http://127.0.0.1:30020" model_path: "${HUNYUAN_MODEL_PATH}" model_revision: "${HUNYUAN_MODEL_REVISION}" quantization: nf4-v2 external_safety_checker: disabled local_files_only: true lifecycle: pool: cold min_loaded: 0 max_loaded: 1 load_on_first_job: true idle_unload_seconds: "${HUNYUAN_IDLE_UNLOAD_SECONDS:-300}" unload_after_failure: true latency_and_quality: priorities: - preserve_duplex_audio_deadline - never_block_barge_in - deterministic_routing_before_model_routing - verified_speculation_only - background_media_generation budgets_ms: ui_orb_level_update: 50 deterministic_route: 2 transcript_final_to_ack: 250 conductor_event_fanout: 25 desktop_overlay_event: 50 backpressure: audio_queue_max_ms: 240 drop_old_video_frames_before_audio: true coalesce_ui_progress_events: true never_drop_terminal_events: true startup: default_profile: none profiles: core: starts_models: false services: - minicpm_gateway - conductor - model_manager - media_api minicpm: explicit_only: true services: - minicpm_worker - minicpm_backend tools: explicit_only: true services: - streaming_asr - qwen_coder external_dependencies: - hermes_agent - desktop_sidecar video: explicit_only: false model_weights_load_on_first_job: true services: - h3_controller - h3_worker image: explicit_only: false model_weights_load_on_first_job: true services: - hunyuan_image offline_guards: environment: HF_HUB_OFFLINE: "1" TRANSFORMERS_OFFLINE: "1" HF_DATASETS_OFFLINE: "1" VLLM_USE_MODELSCOPE: "0" reject_url_model_paths: true reject_unpinned_revisions: - main - master - latest reject_floating_image_tags: - latest - main health_checks_may_not_trigger_load: true topology_checks_may_not_trigger_load: true