Summary
Harden LLooM's multi-node availability and operational lifecycle so a healthy inference data plane is not taken offline by a temporary control-plane failure.
A two-node DGX Spark deployment exposed an important boundary problem: the distributed inference engine remained healthy, but one node's LLooM management gateway stopped with its user session. The leader then treated missing management telemetry as model unavailability and rejected inference requests.
This tracker intentionally contains only public product-level information. It does not include private hostnames, addresses, credentials, request contents, downstream application identity, or user data.
Desired architecture
LLooM should distinguish:
- Serving health: can the configured inference endpoint successfully serve the distributed runtime?
- Control health: are all node management gateways reachable?
- Lifecycle authority: can LLooM safely start, stop, or reconfigure every member?
- Optional federation: which nodes are useful but not required for a particular runtime?
A serving runtime may be management-degraded without being unavailable. Lifecycle mutations must continue to fail closed when required control endpoints are absent.
Workstreams
Completion criteria
- Killing or logging out a worker management gateway does not interrupt inference while the distributed engine's serving health remains green.
- Start, stop, admission, and reconfiguration still require the appropriate node control plane.
- Doctor output distinguishes healthy, degraded, optional-offline, and unavailable states.
- Service installation verifies persistence across logout/reboot.
- A coordinated release can stage, verify, and roll back the same artifact across all required nodes.
- Failure-injection coverage exercises gateway death, stale telemetry, optional-node absence, authentication failure, and recovery reconciliation.
Non-goals
- Exposing raw backend ports publicly.
- Making every gateway an independent lifecycle leader.
- Moving entity continuity, autonomy, or application policy into LLooM.
- Treating optional federated hardware as required cluster quorum.
Summary
Harden LLooM's multi-node availability and operational lifecycle so a healthy inference data plane is not taken offline by a temporary control-plane failure.
A two-node DGX Spark deployment exposed an important boundary problem: the distributed inference engine remained healthy, but one node's LLooM management gateway stopped with its user session. The leader then treated missing management telemetry as model unavailability and rejected inference requests.
This tracker intentionally contains only public product-level information. It does not include private hostnames, addresses, credentials, request contents, downstream application identity, or user data.
Desired architecture
LLooM should distinguish:
A serving runtime may be management-degraded without being unavailable. Lifecycle mutations must continue to fail closed when required control endpoints are absent.
Workstreams
Completion criteria
Non-goals