UAIX.LmRuntime / Required For application integration

UAIX.LmRuntime.LocalEndpoint

The high-level local-only GGUF facade for verified files, bounded loading, isolated sessions, and deterministic greedy generation.

Required For application integration

UAIX.LmRuntime.LocalEndpoint

High-level local-only GGUF facade with verified files, bounded loading, isolated sessions, managed CPU execution, and explicit backend capability boundaries.

Overview

The application-facing local GGUF facade. It verifies caller-selected files, loads the managed LLaMA reference path, creates isolated sessions, generates deterministically, and exposes fixed capability evidence. Acceleration selection packages are dependencies, but this facade currently reports managed execution and no GPU or native inference.

Who should use it Desktop, service, and worker applications that require local GGUF generation without assembling every lower runtime layer directly.
Execution status Managed, in-process CPU execution is implemented. The facade reports UsesGpuAcceleration=false and UsesNativeInference=false; installing a diagnostic GPU backend package does not change that claim.

Install

.NET CLI
dotnet add package UAIX.LmRuntime.LocalEndpoint
Project file
<PackageReference Include="UAIX.LmRuntime.LocalEndpoint" />

Version policy: The documentation deliberately omits UAIX.LmRuntime package version numbers. Resolve and pin versions through your normal dependency-management and lock-file process.

Direct package dependencies
UAIX.LmRuntime.Acceleration Guide NuGet ↗
UAIX.LmRuntime.Backends.CpuManaged Guide NuGet ↗
UAIX.LmRuntime.Models.Llama Guide NuGet ↗
UAIX.LmRuntime.Tokenization Guide NuGet ↗

Installing this facade brings the curated GGUF, tensor, CPU-kernel, sampling, tokenizer, LLaMA, and abstraction dependencies transitively.

Package role and boundaries

Required For application integration

  • Application integration with local managed GGUF inference.
  • SHA-256 and byte-count verification, allowed-root checks, reparse-point rejection, execution limits, and path-safe diagnostics.
  • One isolated LocalGgufSession per conversation or worker with deterministic token observation.

Boundary

  • Downloading models, starting a server, calling provider APIs, running subprocesses, collecting telemetry, or persisting prompts/content.
  • Reading .uaix packages, expanding .uai profiles, selecting wiki memory, assembling prompts, or granting command/network authority.

Verify before parse

The facade can require expected SHA-256 and byte count, constrain the canonical path to an allowed root, reject reparse points, and enforce maximum model size before loading.

Session isolation

A loaded model can create multiple explicit sessions. Each session owns its position and UAIX context evidence; no process-global active profile is required.

Closed authority boundary

UAIX profile and memory fields are retained as immutable evidence only. Runtime execution, policy override, commands, network, providers, website intake, telemetry, and auto-export flags must remain false.

How to use this package

  1. Create a console or desktop application and install LocalEndpoint.
  2. Obtain the trusted local GGUF path, lowercase SHA-256, and exact byte count.
  3. Construct LocalGgufModelLoadOptions with root, size, and reparse-point policy.
  4. Call LoadVerifiedModel and retain the returned model owner.
  5. Create an isolated LocalGgufSession, optionally with caller-owned UAIX context evidence.
  6. Generate with explicit token ceilings, stop identifiers, and cancellation.
  7. Dispose the session before disposing the model.

Key types

These are the main public entry points. The generated reference below includes the documented public package surface.

Coding examples

Examples use the documented public package surface. Paths, identities, runtime identifiers, device evidence, and application policy remain host inputs.

Verify, load, and generate locally

Use a trusted model root, exact file identity, explicit UAIX evidence, bounded generation, and deterministic disposal.

LocalGgufQuickStart.cs
using UAIX.LmRuntime.LocalEndpoint;

public static class LocalGgufQuickStart
{
    /// <summary>
    /// Loads a verified local GGUF model and performs deterministic greedy generation.
    /// </summary>
    /// <param name="modelPath">The local path to the GGUF model.</param>
    /// <param name="trustedModelRoot">The canonical root under which the model must reside.</param>
    /// <param name="expectedSha256">The expected SHA-256 digest.</param>
    /// <param name="expectedByteCount">The exact expected model byte count.</param>
    /// <param name="appInstanceId">The host application's stable instance identifier.</param>
    /// <param name="importedPackageCorrelationId">A legacy UAIX package correlation identifier; it grants no authority.</param>
    /// <param name="profileId">The already validated UAIX profile identifier.</param>
    /// <param name="profileDisplayName">The display-safe profile name.</param>
    /// <param name="loadSessionId">The host-owned profile load-session identifier.</param>
    /// <param name="wikiRootId">The host-owned long-term-memory root identifier.</param>
    /// <param name="workerSessionId">The host-owned inference session identifier.</param>
    /// <param name="prompt">The already prepared prompt; the runtime does not assemble it.</param>
    /// <param name="cancellationToken">A token used to cancel between committed inference steps.</param>
    /// <returns>The deterministic generation result.</returns>
    public static LocalGgufGenerationResult Generate(
        string modelPath,
        string trustedModelRoot,
        string expectedSha256,
        long expectedByteCount,
        string appInstanceId,
        string importedPackageCorrelationId,
        string profileId,
        string profileDisplayName,
        string loadSessionId,
        string wikiRootId,
        string workerSessionId,
        string prompt,
        CancellationToken cancellationToken)
    {
        var runtime = new LocalGgufRuntime(
            new LocalGgufRuntimeScope
            {
                ApplicationInstanceId = appInstanceId,
                UaixPackageId = importedPackageCorrelationId
            });

        var uaixContext = new LocalUaixRuntimeContext
        {
            LoadedUaixProfilePresent = true,
            LoadedUaixProfileId = profileId,
            LoadedUaixProfileDisplayName = profileDisplayName,
            LoadedUaixLoadSessionId = loadSessionId,
            LoadedUaixUaiRelativePath = $"Memories/Profiles/{profileId}/.uai",
            LoadedUaixSessionRelativePath = $"Memories/Sessions/{loadSessionId}.json",
            LongTermMemoryRootId = wikiRootId,
            LongTermMemoryRootRelativePath = $"Profiles/{profileId}",
            LongTermMemoryMode = LocalUaixLongTermMemoryMode.Isolated,
            RuntimeExecutionAllowed = false,
            MemoryCanOverridePolicy = false,
            CommandExecutionAllowed = false,
            NetworkAccessAllowed = false,
            ProviderApisAllowed = false,
            WebsitePromptIntakeAllowed = false,
            TelemetryEnabled = false,
            AutoExportAllowed = false
        };

        LocalUaixRuntimeContextEvidence contextEvidence =
            LocalGgufRuntime.VerifyUaixRuntimeContext(uaixContext);

        using LocalGgufModel model = runtime.LoadVerifiedModel(
            modelPath,
            new LocalGgufFileExpectation
            {
                ModelSha256 = expectedSha256,
                ModelByteCount = expectedByteCount
            },
            new LocalGgufModelLoadOptions
            {
                AllowedRootDirectory = trustedModelRoot,
                RejectReparsePoints = true,
                MaximumModelBytes = expectedByteCount,
                ExecutionLimits = new LocalGgufExecutionLimits
                {
                    MaximumPromptCharacters = 32_768,
                    MaximumGeneratedTokens = 256,
                    MaximumStopTokenCount = 32
                }
            });

        using LocalGgufSession session = model.CreateSession(
            new LocalGgufSessionContext
            {
                SessionId = workerSessionId,
                UaixRuntimeContext = uaixContext
            });

        return session.GenerateGreedy(
            new LocalGgufGenerationRequest
            {
                Prompt = prompt,
                MaximumTokens = 128,
                ResetSession = true,
                AddSpecialTokens = false,
                ParseSpecialTokens = false,
                EmitTokenizerTrace = false,
                RemoveSpecialTokens = false,
                UnparseSpecialTokens = true,
                CleanSpaces = false
            },
            cancellationToken);
    }
}

Boundary: The host validates and prepares profile, memory, and prompt data. The runtime retains context as evidence only; every authority flag remains false.

Observe generated tokens synchronously

Map each committed token to the host worker protocol without giving the runtime ownership of transport or persistence.

TokenObservationExample.cs
using UAIX.LmRuntime.LocalEndpoint;

public static class TokenObservationExample
{
    /// <summary>
    /// Generates a bounded response and observes each selected token synchronously.
    /// </summary>
    /// <param name="session">The isolated local GGUF session.</param>
    /// <param name="preparedPrompt">The host-prepared prompt.</param>
    /// <param name="cancellationToken">A token observed between committed model steps.</param>
    /// <returns>The complete deterministic generation result.</returns>
    public static LocalGgufGenerationResult Generate(
        LocalGgufSession session,
        string preparedPrompt,
        CancellationToken cancellationToken)
    {
        ArgumentNullException.ThrowIfNull(session);
        ArgumentException.ThrowIfNullOrWhiteSpace(preparedPrompt);

        return session.GenerateGreedy(
            new LocalGgufGenerationRequest
            {
                Prompt = preparedPrompt,
                MaximumTokens = 64,
                ResetSession = true,
                AddSpecialTokens = true,
                ParseSpecialTokens = false,
                RemoveSpecialTokens = true
            },
            token => Console.WriteLine(
                $"{session.SessionId}:{token.Sequence}:{token.TokenId}:{token.SelectedLogit}"),
            cancellationToken);
    }
}

Verify associated artifacts without granting execution authority

Hash and bound extra local artifacts while keeping them outside the generation path.

AssociatedArtifactExample.cs
using UAIX.LmRuntime.LocalEndpoint;

public static class AssociatedArtifactExample
{
    /// <summary>
    /// Verifies a LocalEndpoint-reviewed associated artifact without granting execution authority.
    /// </summary>
    /// <param name="runtime">The local runtime facade performing byte verification.</param>
    /// <param name="artifactPath">The local associated-artifact path.</param>
    /// <param name="trustedModelRoot">The canonical root that must contain the artifact.</param>
    /// <param name="expectedSha256">The expected SHA-256 digest.</param>
    /// <param name="expectedByteCount">The exact expected byte count.</param>
    /// <returns>Path-free immutable artifact identity evidence.</returns>
    public static IReadOnlyList<LocalGgufAssociatedArtifactIdentity> Verify(
        LocalGgufRuntime runtime,
        string artifactPath,
        string trustedModelRoot,
        string expectedSha256,
        long expectedByteCount)
    {
        ArgumentNullException.ThrowIfNull(runtime);

        string fileName = Path.GetFileName(artifactPath);

        return runtime.VerifyAssociatedArtifacts(
            [
                new LocalGgufAssociatedArtifactLoadInput
                {
                    ArtifactPath = artifactPath,
                    Role = "projector",
                    FileName = fileName,
                    ArtifactSha256 = expectedSha256,
                    ArtifactByteCount = expectedByteCount
                }
            ],
            new LocalGgufModelLoadOptions
            {
                AllowedRootDirectory = trustedModelRoot,
                RejectReparsePoints = true
            });
    }
}

Boundary: Associated artifacts are verified evidence; the facade does not use them for generation unless a future explicitly supported path says otherwise.

Inspect the local-only capability boundary

Read the facade capability object instead of inferring behavior from package names.

CapabilityBoundaryExample.cs
using UAIX.LmRuntime.LocalEndpoint;

var runtime = new LocalGgufRuntime();
LocalGgufRuntimeCapabilities capabilities = runtime.Capabilities;

Console.WriteLine($"Managed execution: {capabilities.IsManagedExecution}");
Console.WriteLine($"Explicit verification: {capabilities.SupportsExplicitFileVerification}");
Console.WriteLine($"Network access: {capabilities.UsesNetworkAccess}");
Console.WriteLine($"Subprocesses: {capabilities.UsesSubprocesses}");
Console.WriteLine($"Telemetry: {capabilities.UsesTelemetry}");
Console.WriteLine($"Server: {capabilities.HostsServer}");
Console.WriteLine($"Global UAIX profile: {capabilities.UsesGlobalUaixProfile}");
Console.WriteLine($"Memory grants authority: {capabilities.UaixMemoryGrantsAuthority}");

Reuse a session for a multi-turn prepared prompt

Preserve model state only when the host deliberately chooses not to reset the session.

SessionReuseExample.cs
using UAIX.LmRuntime.LocalEndpoint;

public static class SessionReuseExample
{
    /// <summary>
    /// Executes an initial prepared prompt, then continues the same isolated model session.
    /// </summary>
    /// <param name="session">The isolated local GGUF session.</param>
    /// <param name="firstPreparedPrompt">The complete first-turn prompt prepared by the host.</param>
    /// <param name="continuationPreparedPrompt">The continuation prompt prepared by the host.</param>
    /// <param name="cancellationToken">A token observed between committed model steps.</param>
    /// <returns>The first and continuation generation results.</returns>
    public static (
        LocalGgufGenerationResult First,
        LocalGgufGenerationResult Continuation) GenerateTwoTurns(
        LocalGgufSession session,
        string firstPreparedPrompt,
        string continuationPreparedPrompt,
        CancellationToken cancellationToken)
    {
        ArgumentNullException.ThrowIfNull(session);

        LocalGgufGenerationResult first = session.GenerateGreedy(
            new LocalGgufGenerationRequest
            {
                Prompt = firstPreparedPrompt,
                MaximumTokens = 64,
                ResetSession = true,
                AddSpecialTokens = true
            },
            cancellationToken);

        LocalGgufGenerationResult continuation = session.GenerateGreedy(
            new LocalGgufGenerationRequest
            {
                Prompt = continuationPreparedPrompt,
                MaximumTokens = 64,
                ResetSession = false,
                AddSpecialTokens = false
            },
            cancellationToken);

        return (first, continuation);
    }
}

Boundary: The host owns conversation formatting and must ensure that continuation prompts and special-token settings match the model template.

Inspect the facade execution boundary before loading a model

Read the immutable capability surface so the host does not mistake installed backend metadata for active GPU execution.

CapabilityBoundary.cs
using UAIX.LmRuntime.LocalEndpoint;

var runtime = new LocalGgufRuntime();
LocalGgufRuntimeCapabilities capabilities = runtime.Capabilities;

Console.WriteLine($"Managed execution: {capabilities.IsManagedExecution}");
Console.WriteLine($"Native inference: {capabilities.UsesNativeInference}");
Console.WriteLine($"GPU acceleration: {capabilities.UsesGpuAcceleration}");
Console.WriteLine($"Network access: {capabilities.UsesNetworkAccess}");
Console.WriteLine($"Telemetry: {capabilities.UsesTelemetry}");

if (!capabilities.IsManagedExecution ||
    capabilities.UsesNativeInference ||
    capabilities.UsesGpuAcceleration ||
    capabilities.UsesNetworkAccess ||
    capabilities.UsesTelemetry)
{
    throw new InvalidOperationException("The active facade does not match the required local managed boundary.");
}

Boundary: The acceleration registry and GPU compatibility packages are explicit diagnostics and selection surfaces. They do not silently replace LocalEndpoint generation with native or GPU execution.

Generated API reference

Expand a type to review its documented public fields, properties, constructors, methods, parameter descriptions, and return descriptions.

LocalGgufRuntimeScopeUAIX.LmRuntime.LocalEndpoint 2 members

Identifies one caller-owned LocalEndpoint application scope and optional legacy UAIX package correlation label.

The values are opaque compatibility labels. They do not identify the active profile or per-application-instance load session; that evidence is supplied to . The runtime never opens, interprets, persists, or synchronizes UAIX content.

Property ApplicationInstanceId

Gets the LocalEndpoint application instance identifier.

Property UaixPackageId

Gets an optional caller-owned legacy UAIX package correlation identifier.

LocalGgufRuntimeCapabilitiesUAIX.LmRuntime.LocalEndpoint 17 members

Declares the fixed local-only capabilities of the LocalEndpoint integration facade.

Property SupportsExplicitFileVerification

Gets a value indicating whether callers can explicitly re-verify current model-file bytes before reuse.

Property SupportsAssociatedArtifactVerification

Gets a value indicating whether callers can bind reviewed companion artifacts to path-free evidence.

Property UsesAssociatedArtifactsForGeneration

Gets a value indicating whether associated artifacts alter managed token generation.

Property SupportsSynchronousTokenObservation

Gets a value indicating whether caller-owned synchronous token observation is supported.

Property UsesSubprocesses

Gets a value indicating whether the integration starts subprocesses.

Property UsesNetworkAccess

Gets a value indicating whether the integration performs network access.

Property PersistsRuntimeContent

Gets a value indicating whether the integration persists prompts, generated text, or session state.

Property IsManagedExecution

Gets a value indicating whether model execution is implemented by managed project code.

Property UsesNativeInference

Gets a value indicating whether model execution delegates to a native inference library.

Property UsesGpuAcceleration

Gets a value indicating whether the integration uses GPU or CUDA execution.

Property UsesTelemetry

Gets a value indicating whether the integration emits telemetry.

Property HostsServer

Gets a value indicating whether the integration hosts a server or public listener.

Property SupportsUaixRuntimeContextValidation

Gets a value indicating whether the facade validates LocalEndpoint-supplied UAIX runtime context metadata.

Property UsesGlobalUaixProfile

Gets a value indicating whether the runtime assumes one process-global active UAIX profile.

Property ParsesUaixPackages

Gets a value indicating whether the runtime opens or parses .uaix package containers.

Property UaixMemoryGrantsAuthority

Gets a value indicating whether UAIX memory metadata can grant runtime or external authority.

Property EmitsWorkerJsonlEvents

Gets a value indicating whether this managed facade emits LocalEndpoint worker JSONL events.

LocalGgufExecutionLimitsUAIX.LmRuntime.LocalEndpoint 3 members

Defines caller-visible resource ceilings for one verified model owner.

The limits are enforced before large generation buffers are allocated. They supplement, but do not replace, the model context-window checks performed by the underlying deterministic runtime.

Property MaximumPromptCharacters

Gets the maximum accepted prepared-prompt length in .NET UTF-16 code units.

Property MaximumGeneratedTokens

Gets the maximum generated-token buffer length permitted for one operation.

Property MaximumStopTokenCount

Gets the maximum number of caller-defined stop-token identifiers permitted for one operation.

LocalGgufModelLoadOptionsUAIX.LmRuntime.LocalEndpoint 7 members

Configures loading of one trusted local GGUF artifact through the LocalEndpoint-facing managed runtime surface.

The options govern local file validation and bounded managed execution only. They do not enable downloading, remote inference, process launch, telemetry, server hosting, or persistent runtime state.

Property MaximumModelBytes

Gets the maximum accepted model file length in bytes.

Property RejectReparsePoints

Gets a value indicating whether symbolic links and reparse points are rejected before the file is opened.

Property AllowedRootDirectory

Gets the optional normalized directory that must contain the resolved GGUF file.

Property MaximumReferenceMaterializationBytes

Gets the maximum number of bytes that compatibility-only float32 materialization may allocate.

Property ParseOptions

Gets GGUF parser safety limits.

Property BindingOptions

Gets semantic LLaMA tensor-binding validation controls.

Property ExecutionLimits

Gets the prompt, generated-token, and stop-token ceilings enforced by sessions created from the model.

LocalGgufModelMetadataUAIX.LmRuntime.LocalEndpoint 11 members

Describes the verified model and execution metadata exposed to the LocalEndpoint worker adapter.

Property ModelSha256

Gets the lowercase SHA-256 digest verified before model loading.

Property ModelByteCount

Gets the verified model file length in bytes.

Property AssociatedArtifacts

Gets the verified path-free identities of associated model artifacts supplied by LocalEndpoint.

Property GgufVersion

Gets the GGUF container version.

Property Architecture

Gets the model architecture identifier.

Property ModelName

Gets the optional model display name from GGUF metadata.

Property Tokenizer

Gets the exact tokenizer implementation name selected from GGUF metadata.

Property ContextLength

Gets the configured context length in tokens.

Property VocabularySize

Gets the configured vocabulary size.

Property BoundTensorCount

Gets the number of tensors accepted by semantic binding.

Property StorageSummary

Gets the mapped storage summary used by the managed reference runtime.

LocalGgufFileExpectationUAIX.LmRuntime.LocalEndpoint 2 members

Declares the path-free model-file evidence that LocalEndpoint requires before loading or reusing a model.

The contract contains only a SHA-256 digest and byte count. It intentionally excludes the private model path, model bytes, prompt content, generated content, registry state, audit state, and UAIX package data. Runtime entry points validate both values against current file bytes before model parsing or cached-model reuse.

Property ModelSha256

Gets the required SHA-256 digest for the current local model file.

Property ModelByteCount

Gets the required current model file length in bytes.

LocalGgufFileIdentityUAIX.LmRuntime.LocalEndpoint 2 members

Represents the verified content identity of one current local GGUF file.

The result contains only a digest and byte count. It deliberately omits the local path, model bytes, prompt content, generated content, UAIX state, and caller policy so it can be copied into LocalEndpoint evidence without expanding the runtime's persistence or trust responsibilities.

Property ModelSha256

Gets the normalized lowercase SHA-256 digest verified from current file bytes.

Property ModelByteCount

Gets the verified current file length in bytes.

LocalGgufAssociatedArtifactLoadInputUAIX.LmRuntime.LocalEndpoint 5 members

Supplies one LocalEndpoint-reviewed associated artifact for verification by the managed runtime facade.

The private path is accepted only as an input needed to verify current local bytes. The returned verification identity omits the path and contains only display-safe role, file name, SHA-256, and byte-count evidence.

Property ArtifactPath

Gets the private direct-local path to the associated artifact file that LocalEndpoint already reviewed.

Property Role

Gets the caller-owned role label for the associated artifact.

Property FileName

Gets the reviewed leaf file name expected at .

Property ArtifactSha256

Gets the required SHA-256 digest for the current associated artifact file.

Property ArtifactByteCount

Gets the required current associated artifact file length in bytes.

LocalGgufAssociatedArtifactIdentityUAIX.LmRuntime.LocalEndpoint 4 members

Represents the path-free verified identity of one associated model artifact.

The identity is constructed only after the runtime verifies the current associated artifact file under the same local path, containment, reparse-point, stable-length, byte-count, and SHA-256 rules used for primary model admission. It deliberately omits private paths, file bytes, prompt content, generated content, UAIX content, registry state, and audit state.

Property Role

Gets the caller-owned artifact role label copied into path-free evidence.

Property FileName

Gets the reviewed associated-artifact leaf file name.

Property ArtifactSha256

Gets the normalized lowercase SHA-256 digest verified from current associated-artifact bytes.

Property ArtifactByteCount

Gets the verified current associated-artifact file length in bytes.

LocalGgufTokenizerMetadataUAIX.LmRuntime.LocalEndpoint 9 members

Provides a bounded tokenizer metadata projection for LocalEndpoint runtime readiness and diagnostics.

Property TokenizerModel

Gets the tokenizer family declared by GGUF metadata.

Property PreTokenizer

Gets the optional pre-tokenizer identifier.

Property VocabularySize

Gets the vocabulary size.

Property BosTokenId

Gets the beginning-of-sequence token identifier when defined.

Property EosTokenId

Gets the end-of-sequence token identifier when defined.

Property UnknownTokenId

Gets the unknown-token identifier when defined.

Property AddBos

Gets whether model metadata requests automatic beginning-of-sequence insertion.

Property AddEos

Gets whether model metadata requests automatic end-of-sequence insertion.

Property ChatTemplate

Gets the optional chat template declared by the model.

LocalGgufGenerationRequestUAIX.LmRuntime.LocalEndpoint 12 members

Defines one bounded deterministic greedy-generation request.

The request contains only in-memory generation controls. It does not define persistence, network, provider, process, server, telemetry, or model-download behavior.

Property Prompt

Gets the exact prepared prompt to tokenize in memory.

Property MaximumTokens

Gets the positive maximum number of tokens to generate.

Property ResetSession

Gets whether the session is reset before prompt prefill.

Property AddSpecialTokens

Gets whether model-defined special-token insertion is enabled for the prompt.

Property ParseSpecialTokens

Gets whether special-token text embedded in the prompt is parsed as a special token.

Property EmitTokenizerTrace

Gets whether tokenizer trace entries are captured for the prompt.

Property InvalidUtf16Policy

Gets the invalid UTF-16 handling policy used during tokenization.

Property EndOfSequenceTokenId

Gets the optional explicit end-of-sequence token identifier; when omitted, model metadata is used.

Property StopTokenIds

Gets additional token identifiers that terminate generation after being emitted.

Property RemoveSpecialTokens

Gets whether special tokens are removed from decoded generated text.

Property UnparseSpecialTokens

Gets whether special tokens are emitted as their raw token text when they are not removed.

Property CleanSpaces

Gets whether tokenizer-defined spacing cleanup is applied during detokenization.

LocalGgufGeneratedTokenUAIX.LmRuntime.LocalEndpoint 4 members

Describes one generated token selected by the managed runtime for caller-owned streaming.

The value intentionally excludes prompt text, decoded output, model paths, UAIX content, registry state, audit state, and transport details. LocalEndpoint remains responsible for detokenization policy, worker-event mapping, terminal-event policy, and persistence boundaries.

Method LocalGgufGeneratedToken(int,int,float)

Initializes a new LocalGgufGeneratedToken instance with validated dependencies and operational bounds.

sequence
The zero-based selection sequence within the current generation operation.
tokenId
The token identifier to process; it must fall within the validated vocabulary and operation-specific range.
selectedLogit
The deterministic argmax logit associated with the selected token. NaN is rejected; positive and negative infinity are retained because the lower-level greedy sampler compares infinities deterministically and the runtime verifies the exact observed value against the completed generation result.
Property Sequence

Gets the zero-based selection sequence.

Property TokenId

Gets the selected model vocabulary identifier.

Property SelectedLogit

Gets the deterministic argmax logit associated with the selected token.

LocalGgufGenerationResultUAIX.LmRuntime.LocalEndpoint 6 members

Represents deterministic generated token identifiers and their decoded text.

Property PromptTokenCount

Gets the number of prompt tokens evaluated for the operation.

Property GeneratedTokenIds

Gets the generated token identifiers in selection order.

Property GeneratedText

Gets the decoded generated text.

Property StopReason

Gets the deterministic generation stop reason.

Property Position

Gets the next sequence position retained by the isolated session.

Property FinalSelectedLogit

Gets the selected logit of the final generated token, or negative infinity when no token was generated.

LocalGgufVerificationExceptionUAIX.LmRuntime.LocalEndpoint 5 members

Represents a local GGUF artifact verification failure.

Method LocalGgufVerificationException(string,string,string,System.Exception,System.Nullable<long>,System.Nullable<long>)

Initializes a new LocalGgufVerificationException instance with validated dependencies and operational bounds.

message
The display-safe diagnostic message describing the failure without embedding prompt text, generated text, credentials, or private file contents.
expectedSha256
The expected lowercase or uppercase 64-character SHA-256 digest used to authenticate the complete artifact; a mismatch fails the operation before a trusted result is published.
actualSha256
The observed SHA-256 digest retained as path-free diagnostic evidence when available, or null when hashing did not complete.
innerException
The optional lower-level failure used only to select a bounded, path-free diagnostic category. The original exception object, message, stack trace, data, and file-name properties are never retained because they can contain private model paths or other caller-owned content.
expectedByteCount
The required file length when byte-count evidence is supplied.
actualByteCount
The actual byte count used to bound this operation; it must be nonnegative and within the supported range.
Property ExpectedSha256

Gets the normalized expected SHA-256 value when available.

Property ActualSha256

Gets the normalized observed SHA-256 value when available.

Property ExpectedByteCount

Gets the required model byte count when supplied by caller-owned evidence.

Property ActualByteCount

Gets the observed current model byte count when available.

LocalGgufModelUAIX.LmRuntime.LocalEndpoint 11 members

Owns one verified mapped GGUF model and creates isolated deterministic inference sessions.

Property Scope

Gets the opaque application scope and optional legacy package label associated with this model owner.

Property Metadata

Gets verified model and runtime metadata.

Property TokenizerMetadata

Gets the bounded tokenizer metadata projection.

Property ExecutionLimits

Gets the immutable prompt and generation ceilings copied when this model was loaded.

Property ActiveSessionCount

Gets the number of caller-owned sessions that have not yet been disposed.

Property IsDisposed

Gets a value indicating whether this model owner has been disposed.

Method Tokenize(string,UAIX.LmRuntime.Tokenization.TokenizationOptions)

Tokenizes text using exact metadata loaded from the verified GGUF artifact.

text
The text processed by the configured encoding or normalization rules; it must satisfy the declared nullability contract.
options
The optional TokenizationOptions controlling Tokenize; null selects the documented defaults, supplied limits are validated before allocation, and the instance is not mutated.

Returns: The exact integer token identifiers and optional trace.

Method Decode(System.Collections.Generic.IReadOnlyList<int>,UAIX.LmRuntime.Tokenization.MetadataDrivenGgufTokenizerDetokenizationOptions)

Decodes token identifiers using the tokenizer metadata from the verified GGUF artifact.

tokenIds
The token identifiers to decode in sequence order.
options
The optional MetadataDrivenGgufTokenizerDetokenizationOptions controlling Decode; null selects the documented defaults, supplied limits are validated before allocation, and the instance is not mutated.

Returns: The decoded text produced from the validated token sequence in the original sequence order.

Method CreateSession

Rejects creation of a LocalEndpoint inference session when required UAIX load-session context is absent.

Returns: No value is returned; this compatibility member always throws to require an explicit session-scoped UAIX context.

Method CreateSession(UAIX.LmRuntime.LocalEndpoint.LocalGgufSessionContext)

Creates a new inference session with independent sequence state and validated UAIX load-session evidence.

sessionContext
The LocalEndpoint worker session identifier and display-safe UAIX context.

Returns: An isolated deterministic session owned by the caller.

Method Dispose

Releases the memory-mapped model after all child sessions have been disposed.

LocalGgufRuntimeUAIX.LmRuntime.LocalEndpoint 11 members

Loads verified local GGUF files into isolated pure-managed LLaMA runtime models.

This type performs local file validation and direct managed model loading only. It contains no subprocess, network, provider, telemetry, server, downloader, command-dispatch, or persistent-profile behavior. The type holds no static mutable model, session, profile, or wiki state. Separate application instances can therefore load independent models and bind each inference session to a distinct LocalEndpoint-owned UAIX load session.

Method LocalGgufRuntime

Initializes an unscoped model facade for compatibility with callers that do not require application labels.

Method LocalGgufRuntime(UAIX.LmRuntime.LocalEndpoint.LocalGgufRuntimeScope)

Initializes a runtime facade for one LocalEndpoint application instance and optional legacy package label.

scope
The immutable runtime scope whose name and instance identifier are validated once and then retained as path-free correlation evidence for model verification operations.
Property Scope

Gets the opaque caller-owned runtime scope.

Property Capabilities

Gets the fixed local-only capability declaration.

Method VerifyUaixRuntimeContext(UAIX.LmRuntime.LocalEndpoint.LocalUaixRuntimeContext)

Validates LocalEndpoint-supplied uaixRuntimeContext metadata without opening package or wiki files.

context
The display-safe profile, load-session, and long-term memory routing metadata.

Returns: An immutable path-relative evidence projection with a canonical context SHA-256.

Method VerifyLocalModelFile(string,string,UAIX.LmRuntime.LocalEndpoint.LocalGgufModelLoadOptions)

Verifies the current bytes and file-policy boundaries of one local GGUF artifact without loading a model.

modelPath
The local file-system model path processed by this operation; it must satisfy the containing component's path and scope policy.
expectedSha256
The expected lowercase or uppercase 64-character SHA-256 digest used to authenticate the complete artifact; a mismatch fails the operation before a trusted result is published.
options
The optional LocalGgufModelLoadOptions controlling VerifyLocalModelFile; null selects the documented defaults, supplied limits are validated before allocation, and the instance is not mutated.

Returns: A path-free identity containing the verified digest and current byte count.

Method VerifyAssociatedArtifacts(System.Collections.Generic.IReadOnlyList<UAIX.LmRuntime.LocalEndpoint.LocalGgufAssociatedArtifactLoadInput>,UAIX.LmRuntime.LocalEndpoint.LocalGgufModelLoadOptions)

Verifies LocalEndpoint-reviewed associated artifacts without exposing private local paths.

associatedArtifacts
The LocalEndpoint-reviewed associated artifact load inputs to verify before model publication or worker execution proceeds.
options
Optional bounded parser, binding, containment, and file-validation controls shared with primary model verification.

Returns: Path-free associated-artifact identities sorted by role, file name, and SHA-256 digest.

Method VerifyLocalModelFile(string,UAIX.LmRuntime.LocalEndpoint.LocalGgufFileExpectation,UAIX.LmRuntime.LocalEndpoint.LocalGgufModelLoadOptions)

Verifies current local model bytes against caller-owned digest and byte-count evidence without loading a model.

modelPath
The local file-system model path processed by this operation; it must satisfy the containing component's path and scope policy.
expectation
The path-free digest and byte-count evidence required by LocalEndpoint.
options
The optional LocalGgufModelLoadOptions controlling VerifyLocalModelFile; null selects the documented defaults, supplied limits are validated before allocation, and the instance is not mutated.

Returns: A path-free identity containing the verified digest and current byte count.

Method LoadVerifiedModel(string,string,UAIX.LmRuntime.LocalEndpoint.LocalGgufModelLoadOptions)

Loads a local GGUF model only after its exact SHA-256 digest and file-policy constraints are verified.

modelPath
The local file-system model path processed by this operation; it must satisfy the containing component's path and scope policy.
expectedSha256
The expected lowercase or uppercase 64-character SHA-256 digest used to authenticate the complete artifact; a mismatch fails the operation before a trusted result is published.
options
Optional bounded parser, binding, containment, and file-validation controls.

Returns: An owned mapped model that must be disposed after all child sessions are disposed.

Method LoadVerifiedModel(string,UAIX.LmRuntime.LocalEndpoint.LocalGgufFileExpectation,UAIX.LmRuntime.LocalEndpoint.LocalGgufModelLoadOptions)

Loads a local GGUF model after binding current file bytes to caller-owned digest and byte-count evidence.

modelPath
The local file-system model path processed by this operation; it must satisfy the containing component's path and scope policy.
expectation
The path-free digest and byte-count evidence required by LocalEndpoint.
options
Optional bounded parser, binding, containment, and file-validation controls.

Returns: An owned mapped model that must be disposed after all child sessions are disposed.

Method LoadVerifiedModel(string,UAIX.LmRuntime.LocalEndpoint.LocalGgufFileExpectation,System.Collections.Generic.IReadOnlyList<UAIX.LmRuntime.LocalEndpoint.LocalGgufAssociatedArtifactLoadInput>,UAIX.LmRuntime.LocalEndpoint.LocalGgufModelLoadOptions)

Loads a local GGUF model after binding the primary artifact and associated artifacts to caller-owned evidence.

modelPath
The local file-system model path processed by this operation; it must satisfy the containing component's path and scope policy.
expectation
The path-free digest and byte-count evidence required by LocalEndpoint for the primary GGUF artifact.
associatedArtifacts
The LocalEndpoint-reviewed associated artifacts to verify before the model is published.
options
Optional bounded parser, binding, containment, and file-validation controls.

Returns: An owned mapped model that must be disposed after all child sessions are disposed.

LocalGgufSessionUAIX.LmRuntime.LocalEndpoint 8 members

Owns isolated deterministic sequence and key/value-cache state for one verified local model.

A session serializes generation, reset, and disposal transitions through one lifecycle authority. It stores no prompt, generated text, audit record, registry record, UAIX content, provider state, or network state.

Property SessionId

Gets the validated LocalEndpoint worker session identifier preserved for this inference session.

Property UaixRuntimeContextEvidence

Gets immutable, path-relative evidence for the profile and UAIX load session bound to this inference session.

Property Position

Gets the next sequence position retained by this isolated session.

Property IsDisposed

Gets a value indicating whether this session has been disposed.

Method GenerateGreedy(UAIX.LmRuntime.LocalEndpoint.LocalGgufGenerationRequest,System.Threading.CancellationToken)

Runs bounded deterministic greedy generation and returns exact token identifiers with decoded text.

request
The LocalGgufGenerationRequest containing the complete caller-owned inputs for GenerateGreedy; required fields are validated and mutable collections are snapshotted before state changes or large allocations.
cancellationToken
A token observed before work and between committed model steps.

Returns: The generated token identifiers, text, stop reason, position, and final selected logit.

Method GenerateGreedy(UAIX.LmRuntime.LocalEndpoint.LocalGgufGenerationRequest,System.Action<UAIX.LmRuntime.LocalEndpoint.LocalGgufGeneratedToken>,System.Threading.CancellationToken)

Runs bounded deterministic greedy generation and synchronously reports each selected token.

request
The LocalGgufGenerationRequest containing the complete caller-owned inputs for GenerateGreedy; required fields are validated and mutable collections are snapshotted before state changes or large allocations.
tokenObserver
The caller-owned observer invoked once for each selected token.
cancellationToken
A token observed before work and between committed model steps.

Returns: The generated token identifiers, text, stop reason, position, and final selected logit.

Method Reset

Clears sequence position and key/value-cache state retained by this session.

Method Dispose

Releases isolated session state without disposing the shared model owner.

LocalUaixLongTermMemoryModeUAIX.LmRuntime.LocalEndpoint 1 member

Identifies the supported long-term memory routing modes for one validated UAIX load session.

The value describes a caller-owned memory route only. It does not authorize file access, runtime execution, command execution, network access, provider access, telemetry, export, or any other capability.

Field Isolated

Routes the load session to a profile-owned long-term memory root.

LocalUaixRuntimeContextFailureCodeUAIX.LmRuntime.LocalEndpoint 12 members

Identifies the fail-closed reason produced while validating LocalEndpoint UAIX runtime context metadata.

Codes are stable, display-safe boundary identifiers. They do not include prompt text, generated text, private absolute paths, package bytes, wiki document contents, credentials, or unrestricted exception details.

Field MissingContext

The required runtime context object was absent.

Field ProfileNotLoaded

The caller did not identify a loaded UAIX profile.

Field MissingValue

A required identifier or display-safe value was absent.

Field InvalidIdentifier

An identifier was outside the bounded portable identifier grammar.

Field InvalidDisplayValue

A display-safe value contained unsupported control data or exceeded its limit.

Field InvalidRelativePath

A relative path was absolute, traversing, malformed, or outside the supported portable form.

Field ProfilePathMismatch

The profile-relative path did not match the declared profile identifier.

Field SessionPathMismatch

The load-session-relative path did not match the declared load-session identifier.

Field LongTermMemoryPathMismatch

The long-term memory path did not match its declared mode and root identity.

Field UnsupportedLongTermMemoryMode

The long-term memory mode was not one of the explicitly supported values.

Field AuthorityEscalation

One or more UAIX memory fields attempted to grant execution or external authority.

Field InvalidWorkerSession

The worker session identifier was absent or malformed.

LocalUaixRuntimeContextUAIX.LmRuntime.LocalEndpoint 17 members

Represents display-safe UAIX profile and long-term memory routing metadata supplied by LocalEndpoint.

This type mirrors the uaixRuntimeContext object in localendpoint.worker.request.v1. The runtime does not open or parse a .uaix archive, read .uai files, read wiki documents, expand a profile, choose a profile, or infer authority from this object. LocalEndpoint validates and imports packages, assembles the prompt, and supplies this metadata after its own policy gates. Every authority field must remain .

Property LoadedUaixProfilePresent

Gets a value indicating whether LocalEndpoint supplied one validated and loaded UAIX profile.

Property LoadedUaixProfileId

Gets the portable identifier of the loaded UAIX profile.

Property LoadedUaixProfileDisplayName

Gets the display-safe name of the loaded UAIX profile.

Property LoadedUaixLoadSessionId

Gets the LocalEndpoint load-session identifier that bound this profile to one desktop application instance.

Property LoadedUaixUaiRelativePath

Gets the app-local relative path to the expanded profile .uai root.

Property LoadedUaixSessionRelativePath

Gets the app-local relative path to the LocalEndpoint load-session evidence record.

Property LongTermMemoryRootId

Gets the portable identifier of the selected Documents-backed long-term memory root.

Property LongTermMemoryRootRelativePath

Gets the path relative to Documents/LocalEndpoint/Wikis for the selected long-term memory root.

Property LongTermMemoryMode

Gets whether the selected long-term memory root is profile-isolated or deliberately shared.

Property RuntimeExecutionAllowed

Gets a value that must remain false because UAIX memory does not authorize model runtime execution.

Property MemoryCanOverridePolicy

Gets a value that must remain false because memory cannot override LocalEndpoint policy.

Property CommandExecutionAllowed

Gets a value that must remain false because command execution requires a separate user-approved gate.

Property NetworkAccessAllowed

Gets a value that must remain false because UAIX memory does not authorize network access.

Property ProviderApisAllowed

Gets a value that must remain false because UAIX memory does not authorize provider APIs.

Property WebsitePromptIntakeAllowed

Gets a value that must remain false because UAIX memory does not authorize website prompt intake.

Property TelemetryEnabled

Gets a value that must remain false because UAIX memory does not authorize telemetry.

Property AutoExportAllowed

Gets a value that must remain false because UAIX memory does not authorize automatic export.

LocalGgufSessionContextUAIX.LmRuntime.LocalEndpoint 2 members

Represents one worker session identity and its required UAIX boundary metadata.

LocalEndpoint creates this value after package import, profile loading, prompt assembly, and policy validation. The runtime snapshots the context for one isolated session and retains no global active profile.

Property SessionId

Gets the LocalEndpoint worker session identifier that every mapped event must preserve.

Property UaixRuntimeContext

Gets the required display-safe UAIX profile and wiki routing metadata.

LocalUaixRuntimeContextEvidenceUAIX.LmRuntime.LocalEndpoint 10 members

Represents the immutable, path-relative evidence produced after UAIX runtime context validation.

The evidence contains no prompt, generated text, package bytes, wiki document content, model path, credential, command grant, network grant, provider grant, or execution grant. The SHA-256 binds a canonical field sequence for caller-owned registry and audit evidence without turning the context into authority.

Property LoadedUaixProfileId

Gets the validated loaded profile identifier.

Property LoadedUaixProfileDisplayName

Gets the validated display-safe profile name.

Property LoadedUaixLoadSessionId

Gets the validated LocalEndpoint load-session identifier.

Property LoadedUaixUaiRelativePath

Gets the validated app-local profile .uai relative path.

Property LoadedUaixSessionRelativePath

Gets the validated app-local load-session relative path.

Property LongTermMemoryRootId

Gets the validated long-term memory root identifier.

Property LongTermMemoryRootRelativePath

Gets the validated Documents-backed wiki relative path.

Property LongTermMemoryMode

Gets the validated long-term memory routing mode.

Property ContextSha256

Gets the canonical lowercase SHA-256 for this validated context.

Property AuthorityBoundaryClosed

Gets a value indicating that every UAIX authority field was verified false.

LocalUaixRuntimeContextExceptionUAIX.LmRuntime.LocalEndpoint 2 members

Represents a fail-closed UAIX runtime context validation error.

The exception exposes a stable code and field name for bounded diagnostics. It does not include prompt text, generated text, profile file contents, wiki document contents, credentials, or private absolute paths.

Property FailureCode

Gets the stable fail-closed validation code.

Property FieldName

Gets the display-safe contract field associated with the failure.

Frequently asked questions

Which package should an application install first?

Start with LocalEndpoint when the bounded local GGUF facade matches the application. Install lower-level packages directly only when you need their specific extension or inspection surfaces.

Why does CreateSession require LocalGgufSessionContext?

The explicit context binds a host session ID and immutable UAIX evidence to the runtime session. The parameterless member is a fail-closed compatibility boundary and should not be used for normal integration.

Does the facade read .uaix or .uai files?

No. The host validates and loads those artifacts. The runtime validates a display-safe context object and retains evidence without reading profiles, memory documents, or prompt sources.

Can memory enable commands, network, providers, telemetry, or exports?

No. Those authority flags are required to remain false. Any future capability needs a separate host-owned, user-approved gate.

Does LocalEndpoint host an HTTP server or OpenAI-compatible endpoint?

No. It is an in-process managed facade. Transport, worker protocols, JSONL events, registries, audit, UI, and persistence remain host responsibilities.

How should models be disposed?

Dispose LocalGgufSession before LocalGgufModel. The model owns mapped resources and tracks active sessions; use using declarations or an equivalent deterministic lifetime.