docs: correct sec-seat lineage — M.O.G.-SEC/mog-sec is an offense+defense SFT finetune, not a persona-on-stock

The sentinel-r3 header and two memory notes described mog-sec (Blackfrost
M.O.G.-SEC / Qwentium) as 'a persona system prompt on stock weights'. Its card
is explicit that it is NOT: base_model_relation: finetune on Qwen/Qwen3.8-27B,
a refusal-free offense+defense cybersecurity SFT with YaRN 1M context ('not a
system-prompt sticker on a stock Qwen'). So all three sec-seat candidates are
Qwen3.8-27B SFT finetunes and differ in training focus, not in kind:
mog-sec = broad offense+defense SFT; sentinel-r3 = pentest agent-trajectory SFT;
cyberprev = cyber tool-calling LoRA SFT on an abliterated base.

persistent-memory.d/2026-09-14-fv-seat-reorg-and-orca-blocker.md

@@ -30,7 +30,9 @@ here is on the running box; regenerate the authoritative view with
    (:8021, the 26B MoE) is the deliberate speed tier — the throughput answer, so
    char-rp stays the quality seat. `stacks/meromero-charrp/`.
 4. **Sentinel-R3 A/B + dflash.** `glyphsoftware/sentinel-r3` (proprietary license —
-   operator's call) is a REAL SFT pentest finetune vs mog-sec's persona-on-stock.
+   operator's call) is a REAL SFT pentest finetune vs mog-sec (M.O.G.-SEC), which is
+   ALSO a finetune — a refusal-free offense+defense cyber SFT, NOT a persona-on-stock as
+   earlier notes claimed. All three sec seats are Qwen3.8-27B finetunes; they differ in focus.
    Served alongside mog-sec for A/B. Then measured dflash vs MTP on Sentinel's
    finetuned body: **dflash 2.40 vs MTP 2.18 mean acceptance length (+11%)**, warm
    decode ~121 tok/s (faster than sec ~102). dflash k=7 cut over. `stacks/sentinel-r3/`.

persistent-memory.md

@@ -214,7 +214,7 @@ restore, Sentinel dflash cutover, the orca blocker, cyberprev quant crash, open
 
 - `[2026-09-11]` **Beszel priority 1 complete: all six installed and verified.** After Anaheim recovery, live Synology samples and alerts verified; fleet 13/14 up, only known ana-ml2 outage remains. Configs not committed. → `persistent-memory.d/2026-09-11-beszel-priority1.md`
 
-- `[2026-09-11]` **Sentinel-R3 pulled, MTP-grafted, and quantized as a M.O.G.-SEC seat candidate — quant DONE, acceptance UNVERIFIED (blocked on GPU space).** Operator got access to `glyphsoftware/sentinel-r3` and asked to compare vs the running M.O.G.-SEC seat + pull if promising, then "quant it with a grafted mtp head". **It is promising and a better FIT**: same base (stock Qwen3.8-27B), same `qwen3_5` hybrid arch, same 262K, vision-intact — but M.O.G.-SEC is a persona on stock weights while Sentinel-R3 is a REAL SFT finetune on 1,230 authorized-pentest agent trajectories over a 19-tool surface that **matches our own harness** (Bash/Read/Write/Edit/Grep/Glob/Agent/Task*/Monitor/…). Card is unusually honest (flags its own mmlu-cybersec 0.88 as within-noise of base). **HF check: M.O.G.-SEC repo unchanged** (sha still our pinned `deede6779…`). **MTP: Sentinel ships ZERO mtp tensors**; grafted the verbatim base head from `qwen38-27b-uncensored-bf16` (compare_mtp_head → IDENTICAL) — lineage correct since Sentinel's base is stock Qwen3.8-27B and that head is a verbatim base graft. ⚠ **Acceptance is UNVERIFIED and may differ from the 47.7% the head hits on STOCK weights** — it now reads hidden states from an SFT-finetuned body (the exact Stage-1b residual risk). Quant = the standard mixed NVFP4-W4A4(MLP 0-55) + FP8-W8A8(attn/linear_attn/lm_head/MLP 56-63) recipe, ran CUDA_VISIBLE_DEVICES=1 on GPU1 free space, no seat downtime, 51→22 GB. post_quant carried the head forward + re-injected `re:^mtp.*` (llm-compressor prunes it → the 0%-accept bug). Structural verify clean: 1968 tensors, 0 unresolved, 15 mtp, 333 visual, ignore has mtp+visual. **Artifact `/tank/aimodels/sentinel-r3-nvfp4-mixed` (+ `.PROVENANCE.txt`).** ⚠ **License is PROPRIETARY** (Glyph Proprietary v1.0, all-rights-reserved) — operator's fair-use/licensee call, not apache like M.O.G.-SEC. ⚠ **Serving/A-B is BLOCKED on GPU space**: weights are 22 GB, GPU0 has 7.6 free / GPU1 19.9 — a probe serve needs a freed co-tenant slot (~25 GB), which is a material-consequence call. Serve with the PROSE system prompt (trained on prose tools, not structured `tools=`). → `/tank/aimodels/sentinel-r3-nvfp4-mixed.PROVENANCE.txt`
+- `[2026-09-11]` **Sentinel-R3 pulled, MTP-grafted, and quantized as a M.O.G.-SEC seat candidate — quant DONE, acceptance UNVERIFIED (blocked on GPU space).** Operator got access to `glyphsoftware/sentinel-r3` and asked to compare vs the running M.O.G.-SEC seat + pull if promising, then "quant it with a grafted mtp head". **It is promising and a better FIT**: same base (stock Qwen3.8-27B), same `qwen3_5` hybrid arch, same 262K, vision-intact — but M.O.G.-SEC is ALSO an SFT finetune (refusal-free offense+defense cyber SFT — its card: "not a system-prompt sticker on a stock Qwen"; the "persona on stock" wording here is WRONG, corrected 2026-09-14) while Sentinel-R3 is an SFT finetune on 1,230 authorized-pentest agent trajectories over a 19-tool surface that **matches our own harness** (Bash/Read/Write/Edit/Grep/Glob/Agent/Task*/Monitor/…). Card is unusually honest (flags its own mmlu-cybersec 0.88 as within-noise of base). **HF check: M.O.G.-SEC repo unchanged** (sha still our pinned `deede6779…`). **MTP: Sentinel ships ZERO mtp tensors**; grafted the verbatim base head from `qwen38-27b-uncensored-bf16` (compare_mtp_head → IDENTICAL) — lineage correct since Sentinel's base is stock Qwen3.8-27B and that head is a verbatim base graft. ⚠ **Acceptance is UNVERIFIED and may differ from the 47.7% the head hits on STOCK weights** — it now reads hidden states from an SFT-finetuned body (the exact Stage-1b residual risk). Quant = the standard mixed NVFP4-W4A4(MLP 0-55) + FP8-W8A8(attn/linear_attn/lm_head/MLP 56-63) recipe, ran CUDA_VISIBLE_DEVICES=1 on GPU1 free space, no seat downtime, 51→22 GB. post_quant carried the head forward + re-injected `re:^mtp.*` (llm-compressor prunes it → the 0%-accept bug). Structural verify clean: 1968 tensors, 0 unresolved, 15 mtp, 333 visual, ignore has mtp+visual. **Artifact `/tank/aimodels/sentinel-r3-nvfp4-mixed` (+ `.PROVENANCE.txt`).** ⚠ **License is PROPRIETARY** (Glyph Proprietary v1.0, all-rights-reserved) — operator's fair-use/licensee call, not apache like M.O.G.-SEC. ⚠ **Serving/A-B is BLOCKED on GPU space**: weights are 22 GB, GPU0 has 7.6 free / GPU1 19.9 — a probe serve needs a freed co-tenant slot (~25 GB), which is a material-consequence call. Serve with the PROSE system prompt (trained on prose tools, not structured `tools=`). → `/tank/aimodels/sentinel-r3-nvfp4-mixed.PROVENANCE.txt`
 - `[2026-09-11]` ⭐ **MEASURED: two concurrent training jobs on pfi-gx10 are 13% NET SLOWER than running them back to back — VRAM is not the constraint and never was.** Operator asked to run the two BabyYarros arms in parallel if VRAM allowed. It does, comfortably: **18.4 GiB per 4B LoRA job, 36 of 121 GiB with both up, 98 GiB free.** But the GB10 is a *capacity* box, not a throughput box, and the binding constraint is memory bandwidth. Solo baseline **37.10 s/it (n=6, 0.05% spread)**; with a second job both arms settled at **~85 s/it — 2.29x each**, so combined throughput 0.0235 vs 0.0270 steps/s solo. Not a clean 2x split: the box is *past* its roofline and pays a contention penalty on top. ⭐ **Control: killing the second job returned the first to 37 s/it on the very next step**, so the slowdown tracked contention and reversed with it. Chaining finished both arms ~43 min earlier than concurrency would have. **General form: on this box, `nvidia-smi` free memory tells you nothing about whether a second job is affordable.** Decision rule was pre-registered before the numbers were read (<55 s/it keep both, ≥2x chain). `scripts/yarros-corpus/{launch-yarros-4b-base,chain-yarros-4b-base}.sh`; the shared-GPU bypass is an explicit argument, never a default.
 - `[2026-09-11]` ⭐ **ana-ml2 → fv-ml1: relocating to a NEW Fountain Valley colo TOMORROW (operator decision). Its power draw (dual Blackwell PRO 6000, ~1.5 kW peak) is the ROOT CAUSE of the repeated Anaheim rack-breaker trips (2026-08-26, 2026-09-11) — moving it to its own circuit fixes the recurring whole-site outage.** New site `fv`, same shape as Anaheim: server subnet **10.251.50.0/24** (fv-ml1 = **10.251.50.54**, mirroring the old host octet), mgmt/BMC **10.251.250.0/24** (fv-ml1-bmc = **10.251.250.50**). **OPNsense firewall is the multi-homed gateway** (`.1` in every FV VLAN) **AND the tailscale/headscale subnet-router advertising 10.251.0.0/16** — chosen over ana-ml2-as-endpoint specifically because the firewall stays up when the GPU box is down, giving out-of-band BMC access over the mesh — the exact thing the fleet LACKED during today's outage (no OOB path, BMC islanded). **Rename to `fv-ml1`, full `fv.internal` DNS name.** DNS approach: **PIGGYBACK** — `dns-sync` builds `name.site.zone` with no check that the site is in the `sites:` block, so `fv-ml1`/`fv-ml1-bmc` records with `site: fv` resolve fleet-wide from the existing ana/esh/nh3 resolvers immediately; add a real `fv` resolver only when FV needs LOCAL resolution (OPNsense can't host the AdGuard the sync targets — it's FreeBSD/Unbound). **Clean cutover: the box is already down (BMC dark, no power since the outage), and `/tank` is LOCAL ZFS with NO NFS from ana-nas, so data travels with the chassis.** ⚠ Load-bearing repoint = `stacks/litellm/conf/config.yaml` (~10 `api_base: 10.250.50.54:{8015,8016,8018,8019}` → `10.251.50.54`; darkens every inference alias if missed) — gateway STAYS on ana-docker so fv-ml1 serves cross-site (FV↔Anaheim metro, fine). Everything staged, nothing deployed: **runbook `docs/runbooks/fv-ml1-cutover.md`** (commit `ce04f9d`; exact DNS + LiteLLM commands) + **`scripts/fv-ml1-rename-sweep.sh`** (`8400f3a`; scoped, dry-run default, history/provenance-safe, manual-review list for judgement calls).
 - `[2026-09-11]` **Anaheim rack LEFT DARK until the move (operator decision).** ana-ml2 is the ONLY host still down post-recovery (BMC dark = no power); rather than power it on tonight just to shut it down for the truck tomorrow, it stays off. I hold vaulted IPMI creds (`ana-ml2/bmc-{infra-ops,password}`) but there is nothing to bring up — the box relocates as fv-ml1.

stacks/sentinel-r3/compose.yaml

@@ -2,8 +2,10 @@
 #
 # glyphsoftware/sentinel-r3: a REAL SFT finetune of stock Qwen/Qwen3.8-27B on 1,230
 # authorized-pentest agent trajectories (recon -> foothold -> privesc -> writeup) over a
-# 19-tool surface that matches our own harness. Contrast mog-sec, which is a persona
-# system prompt on stock weights. Quantized in-house to the same mixed NVFP4 W4A4(MLP
+# 19-tool surface that matches our own harness. Contrast mog-sec (M.O.G.-SEC/Qwentium),
+# which is a refusal-free OFFENSE+DEFENSE cyber SFT of Qwen3.8-27B — its card explicitly says
+# "not a system-prompt sticker on a stock Qwen" (an earlier note here called it that; wrong).
+# So all three sec seats are Qwen3.8-27B finetunes, differing in training focus. Quantized in-house to the same mixed NVFP4 W4A4(MLP
 # 0-55) + FP8 W8A8(attn/lm_head/MLP 56-63) recipe as mog-sec/gen. → sentinel-r3-nvfp4-mixed.PROVENANCE.txt
 #
 # ⚠ PROPRIETARY LICENSE (Glyph Proprietary v1.0) — operator's fair-use/licensee call, unlike