qiip POC Roll-up (release #2)

.env.example

@@ -97,6 +97,9 @@ INFERENCE_PROXY_ETCD__ENDPOINTS=["http://localhost:2379"]
 # Emails whose tokens are exempt from endpoint scoping and owner isolation
 # (and from the SSO whitelist gate); they may pin tokens to any endpoint.
 # INFERENCE_PROXY_AUTH__ADMIN_ONLY_TOKENS_FULL_ACCESS=["ops@example.com"]
+# Grants from the list above apply to Google accounts only; the local OIDC
+# provider must be granted per issuer (its "iss" URL) by key, e.g.:
+# INFERENCE_PROXY_AUTH__ADMIN_ONLY_TOKENS_FULL_ACCESS_BY_ISSUER={"https://inference-proxy.localdomain/oidc":["ops@example.com"]}
 
 # Google OAuth (set all three credentials to enable)
 # Set up an OAuth 2.0 client at https://console.cloud.google.com/apis/credentials.
@@ -126,12 +129,12 @@ INFERENCE_PROXY_ETCD__ENDPOINTS=["http://localhost:2379"]
 # INFERENCE_PROXY_DASHBOARD__POLL_INTERVAL=10
 
 # Premium-equivalent pricing for token budget estimates (token dashboards)
-# Rates are USD per million tokens. Defaults track Anthropic Claude Opus-class
-# 1M-context pricing; the estimate is what the recorded usage would have cost
-# at this rate, not a cash ledger.
-# INFERENCE_PROXY_PRICING__INPUT_RATE_PER_MTOK=5.0
-# INFERENCE_PROXY_PRICING__OUTPUT_RATE_PER_MTOK=25.0
-# INFERENCE_PROXY_PRICING__MODEL_LABEL=claude-opus-4.8
+# Rates are USD per million tokens. Defaults track the published Anthropic
+# Claude Sonnet MSRP (Sonnet 5, 1M context at standard pricing); the estimate
+# is what the recorded usage would have cost at this rate, not a cash ledger.
+# INFERENCE_PROXY_PRICING__INPUT_RATE_PER_MTOK=2.0
+# INFERENCE_PROXY_PRICING__OUTPUT_RATE_PER_MTOK=10.0
+# INFERENCE_PROXY_PRICING__MODEL_LABEL=claude-sonnet-5
 
 # SSH (node provisioning access)
 # INFERENCE_PROXY_SSH__KEY_PATH=~/.ssh/id_rsa
@@ -147,6 +150,7 @@ INFERENCE_PROXY_ETCD__ENDPOINTS=["http://localhost:2379"]
 # INFERENCE_PROXY_PROVISIONING__MIN_DISK_GB=20
 # INFERENCE_PROXY_PROVISIONING__DRAIN_TIMEOUT=30
 # INFERENCE_PROXY_PROVISIONING__SCRIPTS_DIR=auto-vllm
+# INFERENCE_PROXY_PROVISIONING__GENERATION_ROOT=/opt/qiip
 # INFERENCE_PROXY_PROVISIONING__BOOT_WAIT_TIMEOUT=300
 # INFERENCE_PROXY_PROVISIONING__BOOT_WAIT_INTERVAL=10
 # INFERENCE_PROXY_PROVISIONING__MAX_CONCURRENT_PROVISIONS=32
@@ -172,24 +176,51 @@ INFERENCE_PROXY_ETCD__ENDPOINTS=["http://localhost:2379"]
 # INFERENCE_PROXY_PROVISIONING__DIAGNOSTICS_TIMEOUT=25
 # INFERENCE_PROXY_PROVISIONING__DIAGNOSTICS_SOURCE_MAX_BYTES=16384
 # INFERENCE_PROXY_PROVISIONING__NFS_MOUNT_POINT=/srv/hf-cache
+# Replacement artifact; compatible working drivers are reused after CUDA proof.
 # INFERENCE_PROXY_PROVISIONING__NVIDIA_DRIVER_VERSION=580.126.09
 # INFERENCE_PROXY_PROVISIONING__NVIDIA_DRIVER_SHA256=4cac53e48f8adff661d47c8788ed24059a248c9fd8098ceafd088a498986ec26
-# llama.cpp is compiled for the managed node's NVIDIA GPU from verified source.
+# llama.cpp reuses sealed builds or a pinned catalog, with verified source fallback.
 # INFERENCE_PROXY_PROVISIONING__LLAMACPP_VERSION=v0.4.1
 # INFERENCE_PROXY_PROVISIONING__LLAMACPP_SHA256=ef3d5b1907a391500ae11b5e61a8e2022e0deaac9790899cad9c4e02f03bfb9a
 # INFERENCE_PROXY_PROVISIONING__LLAMACPP_SOURCE_URL=https://github.com/ggml-org/llama.cpp/archive/refs/tags/{version}.tar.gz
+# Set both catalog values to enable downloads of verified CUDA builds.
+# INFERENCE_PROXY_PROVISIONING__LLAMACPP_ARTIFACT_CATALOG_URL=https://artifacts.example/llamacpp/catalog.json
+# INFERENCE_PROXY_PROVISIONING__LLAMACPP_ARTIFACT_CATALOG_SHA256=<sha256-of-catalog.json>
+# INFERENCE_PROXY_PROVISIONING__LLAMACPP_ALLOW_SOURCE_BUILD=true
+# Upper bound on compiler jobs; 0 selects automatically from available CPU/RAM.
+# INFERENCE_PROXY_PROVISIONING__LLAMACPP_BUILD_JOBS=0
 # INFERENCE_PROXY_PROVISIONING__LLAMACPP_SETUP_TIMEOUT=7200
 # INFERENCE_PROXY_PROVISIONING__LLAMACPP_FIT_TARGET_MIB=512
+# Bounded number of automatic vLLM launches per setup, including the initial
+# memory-aware plan (N allows N-1 recognized-OOM retries); 1-5.
+# INFERENCE_PROXY_PROVISIONING__VLLM_MEMORY_RETRY_MAX_ATTEMPTS=4
+# Total deadline for one vLLM setup run (dependency resolution and venv sync).
+# INFERENCE_PROXY_PROVISIONING__VLLM_SETUP_TIMEOUT=3600
+# Bounded automatic retry of transient download/repository/SSH failures. Only
+# recognized transient failures retry; configuration, unsupported-hardware, and
+# maintenance failures stop immediately.
+# INFERENCE_PROXY_PROVISIONING__STAGE_RETRY_MAX_ATTEMPTS=3
+# INFERENCE_PROXY_PROVISIONING__STAGE_RETRY_BASE_DELAY=5.0
+# INFERENCE_PROXY_PROVISIONING__STAGE_RETRY_MAX_DELAY=120.0
+# INFERENCE_PROXY_PROVISIONING__STAGE_RETRY_JITTER=0.25
 
 # QUADS (set BASE_URL to enable integration)
 # INFERENCE_PROXY_QUADS__BASE_URL=http://quads.example.com
 # Required with BASE_URL: IANA timezone used by the QUADS server's local clock.
 # INFERENCE_PROXY_QUADS__SERVER_TIMEZONE=America/New_York
 # INFERENCE_PROXY_QUADS__TIMEOUT=10.0
+# Must be at least 1; the poller sleeps this long after each poll finishes.
 # INFERENCE_PROXY_QUADS__POLL_INTERVAL=300
 # INFERENCE_PROXY_QUADS__VERIFY_SSL=true
+# Must be at least 1; the schedule enforcer sleeps this long after each check.
 # INFERENCE_PROXY_QUADS__SCHEDULE_CHECK_INTERVAL=300
+# Must be at least 1; placement, manual setup and the schedule enforcer need
+# a host free for the whole window.
 # INFERENCE_PROXY_QUADS__SCHEDULE_LOOKAHEAD_HOURS=24
+# Placement makes no decision from a QUADS inventory snapshot older than this.
+# Must be at least 60; where placement runs it must also be at least twice
+# POLL_INTERVAL, checked at startup.
+# INFERENCE_PROXY_QUADS__STALE_AFTER_SECONDS=900
 
 # Automatic placement of catalog llama.cpp profiles on free single-GPU hosts.
 # Needs QUADS. Enabled by default; set false to opt out.
@@ -239,3 +270,6 @@ INFERENCE_PROXY_HUGGINGFACE__CACHE_DIR=/data/huggingface
 # INFERENCE_PROXY_REDFISH__POWER_POLL_TIMEOUT=60.0
 # INFERENCE_PROXY_REDFISH__POWER_POLL_INTERVAL=5.0
 # INFERENCE_PROXY_REDFISH__VERIFY_SSL=false
+# Per-lab/per-host BMC credential overrides are a nested map; prefer setting
+# them in conf/qiip.yml (redfish.bmc_credentials). Via env it must be JSON:
+# INFERENCE_PROXY_REDFISH__BMC_CREDENTIALS={"labs": {"rdu2.scalelab": {"username": "root", "password": "mypass1"}}}