Changelog¶

All notable changes to vacancyd are recorded here. The format follows Keep a Changelog, and versions follow Semantic Versioning.

[Unreleased]¶

[1.0.0] - 2026-10-21¶

First public release. vacancyd gates borrowed AI requests on owner policy and sampled resources before forwarding them to a dedicated inference server. A refused admission returns HTTP 503 with a reason and Retry-After; gateway failover remains adapter-specific. Accepted work follows its configured cancel, drain or finish policy, so refusal does not promise immediate computation stop or memory recovery.

Added¶

• Reverse-proxy adapters for Ollama, OpenAI-compatible routes, llama.cpp, ComfyUI and Chatterbox TTS, with explicit route tables, streamed replies and bounded request bodies. Unsupported work routes, background Responses requests and management/private-data routes are refused unless the documented contract permits them. Durable Chatterbox synthesis using an existing voice holds its reservation until the upstream response finishes; capability, bounded execution lookup and audio replay reads pass without admission.
• Per-model and per-resource admission for NVIDIA GPU memory, system memory and CPU. Reservations account for borrowed work across shared dependencies; measured residency can reduce the load charge only when the adapter establishes reuse. Unknown or stale required observations refuse admission. Compatible voice servers retain engine identity, so switching engines cannot reuse another engine's resident-memory credit or configured budget.
• Host-scoped owner policy by default. A resource-scoped upstream can keep lending while the owner is present; GPU pressure can reclaim affected work, while memory and CPU capacity checks do not reclaim an accepted request. Status, the console, logs and metrics expose exemptions.
• Windows presence from session state and the per-session reporter, with opt-in idle lending, process policy, media detection, sign-in-screen policy and a release hold. Lending can recover after sign-out when two consecutive successful session inventories confirm that a retained Down session has no signed-in user. Active unlocked sessions still need fresh reporters and follow owner policy; failed queries and conflicting evidence refuse lending. Linux presence uses systemd-logind; headless mode is an explicit operator choice.
• Windows attributed GPU pressure with calibrated and fixed modes. Calibrated thresholds learn from separate attended/unattended histograms, with bounded rise, a floor and a cap. Saved learning is tied to device identity and the ignore-name set. A GPU selected by UUID keeps its calibration when its PCI address changes. Older supported cache schemas migrate; missing measurements remain unavailable.
• Adapter-specific reclaim with cancel, drain and finish policies. ComfyUI cancellation names borrowed prompt IDs and uses the narrowest route the reported version supports. Automatic unloading is separate; it can be skipped when the queue establishes foreign work, and an acknowledgement is not measured VRAM recovery.
• Durable admission records for work with uncertain completion. Restart restores unresolved work as held reservations. An administrator releases held work only after stopping the upstream job or verifying completion; fresh capacity is required before reuse. vacancyd status names each held entry, its age, upstream and resources.
• Scoped bearer authentication for borrowing, status and administration, credential-file/environment support, per-upstream credentials, bounded HTTP listeners and direct-loopback checks. The daemon supplies no TLS and does not enforce LAN confinement.
• Native Windows service, windowless session reporter and owner console in one MSI or ZIP. MSI setup starts with an inert configuration. Guided Windows setup validates a dedicated upstream and writes protected configuration and borrow credentials without activating it or changing the firewall. All three executables carry the package version in their Windows file metadata.
• Owner console with Overview, Hardware, Workloads, Installation and Settings views; tray controls, confirmed pause/resume and resource switches, advanced permissions and capacity tuning. Local administrative changes use kernel-identified accounts. Capacity saves apply to new admissions; other policy changes require restart.
• Bounded service logs, configurable log level, temporary debug logging and a diagnostics export with recent pressure samples and reclaim explanations. Export diagnostics opens in your Documents folder, with your user folder as fallback. Diagnostics omit credential values but contain presence and process information that must be reviewed before sharing.
• Linux x86-64 systemd archive and Linux ARM64 preview archive. Container images for amd64 and arm64 are assembled from those archives and qualified by digest before the release path signs and promotes them. The container CA bundle includes the CVE-2026-111943 fix. Configuration and durable admission state remain operator-owned. Source builds require Rust 1.89 or newer; Linux session detection uses zbus 6.
• Package checksums, retained third-party licenses and covered source, CycloneDX dependency inventory, source-bound release manifest and SLSA-format provenance. The release contract signs Windows packages and release checksums and signs container images and attestations. These checks do not constitute an independent SLSA build-level certification.

State and permissions¶

• Diagnostics use bounded regular-file reads for configuration and calibration state. Symlinks and special files are refused, and a custom calibration cache must satisfy the same directory checks as the active collector.
• Host-scoped admission and /readyz refuse when the last owner-presence sample is older than four polls, with a minimum freshness window of 15 seconds. Expiry engages the owner veto and starts reclaim under the configured cancel, drain or finish policy. Pressure learning pauses while presence is stale, and samples completed past their freshness bound are discarded.
• Windows setup and migrate-config destinations, the service log, admission recovery and an explicitly configured GPU pressure cache must be inside the protected ProgramData\vacancyd folder. The MSI creates that root for Administrators and LocalSystem. Junctions, other reparse points and paths that grant other accounts access are refused. An out-of-root recovery directory or service log stops startup; an out-of-root pressure cache is skipped with a warning and calibration remains in memory for that run.
• Setup, migration, Windows service logging and default admission recovery check paths before creating missing directories. New directories are private from creation: mode 0700 on Unix, or a protected owner and ACL for Administrators and LocalSystem on Windows. Configured recovery locations other than the default must already exist. Linux additionally checks the recovery directory's owner, and Unix syncs a newly created directory's parent before admitting work.
• Moving a configuration must preserve held work. migrate-config refuses a copy that would look elsewhere for unfinished recovery records. Set server.admission_state_dir to the existing directory's absolute path before copying. If relocating Windows state, stop every daemon, move the complete recovery directory without emptying it, keep sibling credentials with the configuration, and update the service's configuration and log paths. Migration does not move recovery records or rewrite settings. See Windows service paths.
• Calibration cache reads and writes check that other accounts cannot replace the path. Writes use a new private staging file; an unsafe cache is skipped with a warning, leaving calibration in memory. On Linux, check-config also checks state paths against the systemd write sandbox and names the required ReadWritePaths= override. Status reports an unavailable local admin channel.
• Cancellation caused by resource pressure alone reports resource_pressured and the resource name. If GPU pressure may not see an upstream's borrowed work, logs, status and the console report that observation limit. Pressure can count unseen borrowed work as owner load and reclaim it; the warning does not subtract extra work from pressure or weaken owner protection.

Known limitations¶

• Owner-return detection follows sampling, and accepted work can continue through a drain or finish window. Closing the proxy does not guarantee upstream cancellation. Direct upstream requests bypass admission.
• On ComfyUI 0.3.45 or later, a submission whose connection failed before any reply is held for five minutes, then released if two consecutive checks find it neither queued, running nor in history. These checks do not establish that validation finished: validation lasting longer than five minutes could start a prompt after its reservation was released. Older or unversioned servers keep the reservation for administrator reconciliation. A prompt known to have been queued is followed to its end.
• Linux lacks Windows media/foreground detection and attributed GPU pressure. ARM64 is a build/package-verified preview without a physical-runtime support claim. macOS is unsupported and has no release package.
• Windows Home acceptance covers one local interactive session. RDP reconnect and simultaneous active sessions require separate Windows Server evidence.
• Container logind integration is qualified on the documented dbus-daemon/AppArmor hosts. Rootless engines, user-namespace remapping, dbus-broker and SELinux hosts remain unqualified.
• Real NVIDIA behavior and the final signed candidate require their own native evidence. No latency, savings, adoption or universal owner-priority guarantee is made.