pllmCurrent support
What you can use today, what remains experimental, and what is not yet supported.
PLLM documentationView Markdown ↗
Checked 16 September 2026.
Available
The CLI can run the trusted local gateway, start inference and preparation roles, run a headless loopback benchmark, inspect public configuration and components, and report bounded diagnostics.
Experimental
Prepared public-weight inference runs for supported text checkpoint layouts. This
path assumes protocol-following, non-colluding inference and preparation roles;
the co-located gateway --local topology is for development and does not establish
that separation.
Not supported
Complete private generation from an arbitrary semantic ModelPlan, production
deployment assurance, malicious-participant security, and canonical
evidence-producing benchmark runs are not supported.
Status labels
PLLM uses six labels throughout the documentation:
| Label | Meaning |
|---|---|
| Available | Implemented and usable within the stated limits |
| Experimental | Implemented, but not ready for production use |
| Planned | Intended work with no available implementation |
| Not supported | Outside the current implementation |
| Not evaluated | Implemented or proposed, but not measured for this claim |
| Not applicable | The claim does not apply to this item |
CLI
Start from the CLI guide for task-oriented flows. The links below open parser-generated command references.
| Command | Status | Current limit |
|---|---|---|
config | Available | Validates public Experiment data; Python targets require explicit trust |
components | Available | Reads built-in component metadata only |
gateway | Available | Trusted loopback client boundary exposing the Responses API and Chat Completions API; --local co-locates roles for development only |
serve inference | Available | Starts an authenticated computation role; host provisioning, TLS termination, and operator separation remain deployment responsibilities |
serve preparation | Available | Starts the trusted preparation role and pushes offline corrections to inference; it must not collude with inference |
dev dashboard | Experimental | Uses the shared LocalTopology to run the two remote roles on one machine and records local diagnostic history, not canonical research evidence |
benchmark run | Experimental | Runs the dashboard driver in-process over the same two role processes and writes a sanitized diagnostic report, not a canonical EvidenceReport |
init, --set | Not supported | Profile catalog and typed overrides are incomplete |
model lower | Not supported | The CLI output contract is incomplete |
plan check, plan compile, plan show | Not supported | Plan locking, artifacts, and compatibility checks are incomplete |
prepare, run, chat | Not supported | The CLI does not manage prepared material |
benchmark search, benchmark compare | Not supported | The CLI does not query or compare canonical evidence records |
assure run | Not supported | The CLI assurance interface is incomplete |
The CLI reference remains the source for exact parser help.
Python support
| Capability | Current status |
|---|---|
Immutable Experiment configuration | Available for the documented schema |
Typed Model source and load_model | Available for canonical Hugging Face/local Safetensors, MLX, GGUF, synchronous Ollama inspection, and deterministic tiny Qwen2 materialization; actual source files are hashed into checkpoint/source-lock digests, while secrets and cache paths remain operational arguments |
| Component family classes | Available for all previously registered compiler components plus current guarded/blinded/secure/direct-FHE/cleartext linear arms, BFV and HE-authenticated preparation, seeded correlation expansion, inference role, client-local KV state, linear integrity, and tiny/bundle model sources; descriptors are class-derived |
| Typed pipeline profiles | MaskedLinearCpu is available as the two-role public-weight baseline; ProprietaryGuarded, ProprietaryBlinded, and DirectFHEProfile are available as one-role proprietary runtime profiles through the same configuration, local topology, gateway, and diagnostic benchmark paths; SecureLinear, BFVCorrelations as a distinct profile, plaintext reference backends, and protected research profiles remain uncomposed |
| Provider metadata discovery | Available through static pllm.providers.v1 manifests with distribution/resource hash checks, package confinement, host/category version checks, editable-install opt-in, and host-generated external component classes; Python factory import requires an explicit provider approval set; Native Plugin ABI 1 and its conformance fixtures are available, while runtime native-library loading remains unavailable |
| Metric contracts and evidence registry | Typed latency, throughput, communication, memory, energy, accuracy, perplexity, and cost components are available; BenchmarkResult validates canonical full-result records and EvidenceRegistry retains and queries exact completed, failed, and unavailable cohorts; existing native region/deployment reports and dashboard diagnostics remain their documented schemas rather than being silently relabeled |
| Typed search | Exhaustive GridSearch, seeded discrete RandomSearch, path constraints, result binding, and explicit-direction ParetoFrontier are available over immutable Experiments and canonical benchmark results; failed/unavailable results remain recorded but unranked; Bayesian search and CLI search/compare remain unavailable |
| Research registry and quarantine | Canonical SourceRecord, ArtifactLock, MethodRecord, and ResearchRegistry contracts are available; existing source records and the MPCache upstream lock validate, restricted artifacts remain external-process/oracle-only, and promotion fails closed across source, reproduction, native implementation, lifecycle, and profile gates; the registry does not acquire or execute artifacts |
| Local role topology | Available through build_roles/serve_local for typed Model, Pipeline, or Experiment inputs; the public baseline keeps inference and preparation as separate child processes, while proprietary profiles start inference only; credentials stay out of argv/status, health and client routing are bound, and close is deterministic; this is loopback development orchestration, not operator separation |
| Semantic model adapters | Available for the listed Qwen2, Qwen3, Qwen3.5, Phi-4-mini, and Gemma 4 text configurations |
| MPCache plan transformation | Experimental for dense Qwen2/Qwen3 fixed-shape plans; preserves fixed Key/Value capacity and adds explicit index state; Gemma plans are rejected |
| Compiler coverage report | Available and composition-scoped; the MaskedLinearCpu preset composition is complete for untransformed dense Qwen2 through the model-aware runtime schedule, while whole-model protected composition remains incomplete |
| Dense-Qwen2 runtime schedule | Available for the model-aware prepared runtime; topology-derived q/k/v and gate/up fusion, all layers, final norm, output head, decoder tail, and prefill/decode state are bound to the model plan, runtime bundle, tokenizer, and quantized-weight digests; a plan-bound session enforces greedy selection, feedback, workload limits, per-stage output contracts, and poisoned-state failure handling; the schedule is client-heavy and not protected execution of the fixed-Q10 research composites |
| Plan-bound Q10 state regions | Available for RMSNorm, rotary embedding, fixed-capacity KV initialization/append, and visible-prefix cache views; oversized RMSNorm falls back to the explicit FP32 reference and malformed provenance fails closed |
| Client-local Q10 token lookup | Available for bounded dense-Qwen token tables with typed token IDs, pre-allocation vocabulary checks, borrowed Q10 weights, and zeroized embedding outputs |
| Graph-derived Q14-to-Q10 transitions | Available for dense-Qwen q/k/v projection-to-head edges and o-projection-to-attention-residual edges; topology-derived matching excludes gate/up/down/output-head paths and rejects incomplete model families |
| Dense-Qwen2 attention-block oracle | Available as a clear fixed-scale prefill/decode composite covering RMSNorm through attention residual with plan/weight binding, fixed KV state, zeroized intermediates, and poisoned-state failure handling; Qwen3 and MPCache execution remain separate work |
| Dense-Qwen2 layer oracle | Available as clear fixed-scale attention→MLP prefill/decode composition with a checked signed-Q10 edge and mode-stable plan/layer/weight state binding; post-append attention or MLP failures poison the layer state |
| Protected Q7 gated-MLP nonlinear region | Available for dense-Qwen SiLU and multiplication as one chunked one-use tensor region up to 4,000,000 elements; oversized tensors remain primitive-only |
| Decoder tail regions | Available for dense Qwen: prefill last-valid selection, decode physical-last selection, signed-wrap32 greedy selection with lowest-index tie-breaking, and token-id feedback; they participate in the complete model-aware baseline schedule but remain uncomposed in the fixed-Q10 research profile |
| Client-local Softmax region | Available for scaled signed-Q20 attention scores with explicit masking, deterministic Q30 probabilities, and exact active-row sums; cryptographic Softmax alternatives remain research components |
| Client-local attention-value region | Available for exact Q30-probability by Q10-value contraction in grouped-query cache and MPCache per-query/head-window layouts; output is signed Q10 with ties-to-even rounding |
| Client-local attention score chain | Available for grouped-query caches and MPCache per-query windows; Q10 dot products, exact Q20 scaling, causal/validity masking, and selected-position masking execute as one fused plan-bound region |
| Prepared public-weight generation | Available for runtime-supported text checkpoint layouts; validated end to end with Qwen/Qwen2.5-0.5B-Instruct, including the digest-bound baseline ModelPlan schedule and shared runtime weight bundle |
| Responses API gateway | Available for text, streaming, function tools, continuation, compaction, storage controls, and structured errors |
| Chat Completions API gateway | Available as a translation over the same private execution path for text, streaming, and function tools |
| Native compile, benchmark, and assurance APIs | Available for their documented narrow scopes |
Complete private generation from ModelPlan | Available for untransformed Qwen2 and compatible dense Qwen3 bundles through the same model-neutral baseline.masked_linear_cpu compiler path; only Qwen2 has pinned real-checkpoint evidence, while protected research scheduling, MPCache execution, Qwen3.5, Phi, and compiler-bound Gemma checkpoint execution remain incomplete |
| Generation quality for semantic adapters | Not evaluated |
| Privacy evidence for generated component descriptors | Not evaluated |
| Remote role processes | Available; deployment automation, TLS, identity, rollback protection, and non-colluding operators are not provided by the commands |
| Production deployment maturity | Not evaluated |
The package still exposes older runtime and client interfaces. Their presence does not mean that complete plan-based deployment is supported. See the generated Python API inventory.
Consumer compatibility
| Consumer | Status | Validated limit |
|---|---|---|
| Raw Responses API | Available | Pinned 2026-04-24 contract; 17 official conformance tests pass |
| Raw Chat Completions API | Available | Text, SSE streaming, function calls, usage, and structured errors |
| OpenAI Python SDK | Available | Sync, async, Responses API, Chat Completions API, and streaming with openai 3.8.0 |
| OpenAI Agents SDK | Available | Responses API model adapter with openai-agents 0.22.2 |
| Codex | Available | Custom Responses API provider validated with Codex 0.154.0; provider web search must be disabled |
| OpenCode | Available | Custom Chat Completions API provider validated with OpenCode 1.18.31; current runtime models remain text and function-tool limited |
| Image and file understanding | Not supported | Current runtime models are text-only and reject media inputs explicitly |
See consumer integrations for exact tested configurations and private inference from the CLI for the serving topology.
Python SDK example
from pllm.components import get_component
component = get_component("pllm/cpu")
assert component.lifecycle_phase == "compilation"Static discovery reports availability, not production maturity or complete private execution.