@tuned-tensor/local 0.2.9 → 0.4.0

package/dist/index.js

@@ -1,39 +1,34 @@
 #!/usr/bin/env node
 import { readFileSync, realpathSync } from "node:fs";
 import { createHash } from "node:crypto";
-import { mkdir, open, readFile, stat } from "node:fs/promises";
-import { spawn } from "node:child_process";
+import { readFile, stat } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { cwd } from "node:process";
 import { fileURLToPath } from "node:url";
 import { compareRuns } from "./compare.js";
-import { assertArtifactManifest, claimRunArtifactDirectory, defaultArtifactPrefix, resolveRunArtifacts } from "./artifacts.js";
-import { fineTuneRunRequestSchema, localBehaviorSpecFileSchema, localRunnerConfigSchema, specSnapshotSchema } from "./contracts.js";
+import { assertArtifactManifest } from "./artifacts.js";
+import { fineTuneRunRequestSchema, localBehaviorSpecFileSchema, localRunnerConfigSchema } from "./contracts.js";
 import { buildSystemMessage } from "./dataset.js";
-import { assertEvaluationScoringReady } from "./evaluation.js";
-import { runLocalLabelingJob } from "./labeling.js";
-import { loadLocalRunnerConfig, fingerprintLocalBaseModel, runLocalFineTuneStage, } from "./orchestrator.js";
+import { loadLocalRunnerConfig, fingerprintLocalBaseModel, runLocalFineTune, validateLocalFineTuneInput, } from "./orchestrator.js";
 import { runDoctor } from "./doctor.js";
-import { assertUsableModelArtifact, resolveTrainingModel } from "./model-registry.js";
-import { buildLocalModelServerLaunch, serveLocalModel } from "./model-server.js";
+import { assertUsableModelArtifact } from "./model-registry.js";
+import { buildLocalBaseModelServerLaunch, buildLocalModelServerLaunch, serveLocalModel, } from "./model-server.js";
 import { prefetchBaseModel } from "./prefetch.js";
-import { createLocalStore, isTerminalRunState } from "./store.js";
-import { serveLocalDashboard } from "./server.js";
-import { DEFAULT_LOCAL_SPEC_PATH, assertLocalRunInputReady, initLocalRunnerConfigFile, initLocalSpecFile, loadLocalRunInput, runRequestFromLocalSpec, } from "./local-project.js";
+import { createLocalStore } from "./store.js";
+import { DEFAULT_LOCAL_SPEC_PATH, assertLocalRunInputReady, initLocalRunnerConfigFile, initLocalSpecFile, loadLocalRunInput, } from "./local-project.js";
 import { sanitizeLogLine } from "./run-reporter.js";
+import { activateModel, getActiveModel, rollbackActiveModel } from "./active-model.js";
 export * from "./compare.js";
 export * from "./contracts.js";
 export * from "./dataset.js";
-export * from "./labeling.js";
-export * from "./labeling-sanitize.js";
 export * from "./model-server.js";
 export * from "./orchestrator.js";
 export * from "./local-project.js";
-export * from "./openrouter.js";
 export * from "./prefetch.js";
 export * from "./run-reporter.js";
-export * from "./server.js";
 export * from "./store.js";
+export * from "./general-regression.js";
+export * from "./active-model.js";
 function packageVersion() {
     try {
         const packageJson = JSON.parse(readFileSync(fileURLToPath(new URL("../package.json", import.meta.url)), "utf8"));
@@ -48,54 +43,10 @@ export function getLocalRunnerInfo() {
     return {
         name: "tuned-tensor-local",
         status: "local-runner-preview",
-        description: "Local-first fine-tuning with baseline-vs-tuned evaluation for small open-weight models.",
+        description: "Local CUDA LoRA fine-tuning with held-out base-versus-tuned evaluation.",
         version: TT_LOCAL_VERSION,
     };
 }
-/**
- * Parses simple KEY=VALUE lines from .env content. Supports comments, blank
- * lines, an optional `export ` prefix, and single/double quoted values. Does
- * not support multiline values or variable expansion.
- */
-export function parseDotEnv(content) {
-    const values = {};
-    for (const rawLine of content.split(/\r?\n/)) {
-        const line = rawLine.trim();
-        if (!line || line.startsWith("#"))
-            continue;
-        const match = line.match(/^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/);
-        if (!match)
-            continue;
-        let value = match[2].trim();
-        if ((value.startsWith("\"") && value.endsWith("\"")) || (value.startsWith("'") && value.endsWith("'"))) {
-            value = value.slice(1, -1);
-        }
-        values[match[1]] = value;
-    }
-    return values;
-}
-/**
- * Loads .env from the working directory into process.env without overriding
- * variables that are already set, so `OPENROUTER_API_KEY` and friends work
- * out of the box in project directories. Returns the names that were loaded.
- */
-async function loadDotEnvFromCwd() {
-    let content;
-    try {
-        content = await readFile(resolve(cwd(), ".env"), "utf8");
-    }
-    catch {
-        return [];
-    }
-    const loaded = [];
-    for (const [key, value] of Object.entries(parseDotEnv(content))) {
-        if (process.env[key] === undefined) {
-            process.env[key] = value;
-            loaded.push(key);
-        }
-    }
-    return loaded;
-}
 function readOption(argv, name) {
     const index = argv.indexOf(name);
     if (index !== -1)
@@ -112,18 +63,12 @@ function printHelp() {
 Commands:
   info                              Show package and runner information
   init [--name "My Local Model"] [--model Qwen/Qwen3.5-2B] [--output tunedtensor.json] [--profile spark] [--force]
-  doctor [tunedtensor.json|request.json] [--config local-runner.json]
-  validate [tunedtensor.json|request.json] [--config local-runner.json]
-  run [tunedtensor.json|request.json] [--config local-runner.json] [--stage all|prepare|baseline|train|candidate|score|report]
-      [--run-id uuid] [--parent-model local-model-id] [--parent-model-artifact path-or-file-uri]
-      [--model-artifact path-or-file-uri] [--force] [--dry-run] [--detach] [--verbose] [--quiet]
-  label <input.jsonl|input.csv> [--input-column col] [--spec tunedtensor.json] [--system-prompt "..."]
-        [--model teacher-model] [--output labeled.jsonl] [--config local-runner.json] [--dry-run]
-  serve [--config local-runner.json] [--host 127.0.0.1] [--port 8787]
-  runs list|get|events|watch|report|compare|cancel|reconcile [args] [--config local-runner.json]
-  models list|get|verify|prefetch|verify-base|serve [args] [--config local-runner.json]
-  specs list|get|import [args] [--config local-runner.json]
-  store rebuild-index [--config local-runner.json]
+  doctor [tunedtensor.json] [--config local-runner.json]
+  validate [tunedtensor.json] [--config local-runner.json]
+  run [tunedtensor.json] [--config local-runner.json] [--dry-run] [--verbose] [--quiet]
+  serve <model-id|active|base> [--config local-runner.json] [--host 127.0.0.1] [--port 8000]
+  runs list|get|events|report|compare [args] [--config local-runner.json]
+  models list|get|verify|prefetch|verify-base|active|activate|rollback|serve [args] [--config local-runner.json]
 
 Global options:
   -h, --help                       Show help
@@ -134,10 +79,23 @@ The run command writes local artifacts under config.artifactRoot, defaulting to
 ~/.tuned-tensor-local unless config.storeRoot or TT_LOCAL_HOME is set.`);
 }
 const CONFIG_OPTION = { name: "--config", value: "path", description: "Local runner config JSON path" };
-const USER_ID_OPTION = { name: "--user-id", value: "id", description: "Override the local user ID" };
-const RUN_NUMBER_OPTION = { name: "--run-number", value: "number", description: "Override the local run number" };
 const VERBOSE_OPTION = { name: "--verbose", description: "Stream subprocess output" };
 const QUIET_OPTION = { name: "--quiet", description: "Suppress progress output on stderr" };
+const MODEL_SERVE_OPTIONS = [
+    CONFIG_OPTION,
+    { name: "--host", value: "host", description: "Bind host (localhost by default)" },
+    { name: "--port", value: "port", description: "Bind port" },
+    { name: "--device", value: "device", description: "cuda or cpu" },
+    { name: "--max-tokens", value: "count", description: "Default response token limit" },
+    { name: "--temperature", value: "number", description: "Default sampling temperature" },
+    { name: "--top-p", value: "number", description: "Default nucleus sampling threshold" },
+    { name: "--max-concurrent-requests", value: "count", description: "Concurrent generation limit" },
+    { name: "--spec", value: "path", description: "Behavior spec whose instructions are enforced" },
+    { name: "--no-spec-prompt", description: "Do not enforce the stored behavior-spec prompt" },
+    { name: "--allow-remote", description: "Allow a non-loopback bind" },
+    { name: "--api-key-env", value: "name", description: "Environment variable containing a bearer token" },
+    { name: "--print-command", description: "Validate and print the launch plan without starting" },
+];
 const COMMAND_DEFINITIONS = {
     info: {
         usage: "tt-local info",
@@ -153,86 +111,53 @@ const COMMAND_DEFINITIONS = {
             { name: "--model", value: "model", description: "Base model ID" },
             { name: "--output", value: "path", description: "Output spec path" },
             { name: "--profile", value: "profile", description: "Write a durable runner config (spark)" },
-            { name: "--config-output", value: "path", description: "Profile config output path" },
+            { name: "--config", value: "path", description: "Runner config path (written with --profile)" },
             { name: "--force", description: "Overwrite an existing output file" },
         ],
         maxPositionals: 0,
     },
     doctor: {
-        usage: "tt-local doctor [tunedtensor.json|request.json] [--config path]",
+        usage: "tt-local doctor [tunedtensor.json] [--config path]",
         description: "Check the host and optional run input before starting work.",
         options: [CONFIG_OPTION],
         maxPositionals: 1,
     },
     validate: {
-        usage: "tt-local validate [tunedtensor.json|request.json] [options]",
-        description: "Validate a behavior spec or run request without executing it.",
-        options: [CONFIG_OPTION, USER_ID_OPTION, RUN_NUMBER_OPTION],
+        usage: "tt-local validate [tunedtensor.json] [options]",
+        description: "Validate a local behavior spec without executing it.",
+        options: [CONFIG_OPTION],
         maxPositionals: 1,
     },
     run: {
-        usage: "tt-local run [tunedtensor.json|request.json] [options]",
+        usage: "tt-local run [tunedtensor.json] [options]",
         description: "Run the baseline, fine-tuning, tuned evaluation, and report workflow.",
         options: [
             CONFIG_OPTION,
-            USER_ID_OPTION,
-            RUN_NUMBER_OPTION,
-            { name: "--run-id", value: "uuid", description: "Resume or override a run ID" },
-            { name: "--stage", value: "stage", description: "Run through a specific workflow stage" },
-            { name: "--model-artifact", value: "uri", description: "Use an existing model artifact" },
-            { name: "--parent-model", value: "model-id", description: "Continue training a stored local model" },
-            { name: "--parent-model-artifact", value: "uri", description: "Continue training a model artifact" },
-            { name: "--force", description: "Recompute the selected stage" },
             { name: "--dry-run", description: "Write representative artifacts without GPU work" },
-            { name: "--detach", description: "Run in the background and return the run ID immediately" },
             VERBOSE_OPTION,
             QUIET_OPTION,
         ],
         maxPositionals: 1,
     },
-    label: {
-        usage: "tt-local label <input.jsonl|input.csv> [options]",
-        description: "Label local rows with a teacher model.",
-        options: [
-            CONFIG_OPTION,
-            { name: "--input-column", value: "column", description: "CSV input column" },
-            { name: "--spec", value: "path", description: "Behavior spec path" },
-            { name: "--system-prompt", value: "text", description: "Explicit teacher system prompt" },
-            { name: "--model", value: "model", description: "Teacher model ID" },
-            { name: "--output", value: "path", description: "Output JSONL path" },
-            { name: "--format", value: "jsonl|csv", description: "Force the source format" },
-            { name: "--dry-run", description: "Parse and sanitize without teacher calls" },
-            VERBOSE_OPTION,
-            QUIET_OPTION,
-        ],
+    serve: {
+        usage: "tt-local serve <model-id|active|base> [options]",
+        description: "Serve a verified adapter, the active model, or the protected base.",
+        options: MODEL_SERVE_OPTIONS,
         minPositionals: 1,
         maxPositionals: 1,
-        missingPositionalsMessage: "label requires <input.jsonl|input.csv>",
-    },
-    serve: {
-        usage: "tt-local serve [--config path] [--host host] [--port port]",
-        description: "Serve the local runs dashboard.",
-        options: [
-            CONFIG_OPTION,
-            { name: "--host", value: "host", description: "Dashboard bind host" },
-            { name: "--port", value: "port", description: "Dashboard bind port" },
-        ],
-        maxPositionals: 0,
+        missingPositionalsMessage: "serve requires <model-id>",
     },
 };
 const COMMAND_GROUPS = {
     runs: {
-        description: "Inspect and manage locally stored runs.",
+        description: "Inspect locally stored runs.",
         defaultSubcommand: "list",
         subcommands: {
             list: { usage: "tt-local runs list [--config path]", description: "List local runs.", options: [CONFIG_OPTION], maxPositionals: 0 },
             get: { usage: "tt-local runs get <run-id> [--config path]", description: "Get a local run.", options: [CONFIG_OPTION], minPositionals: 1, maxPositionals: 1, missingPositionalsMessage: "runs get requires <run-id>" },
             events: { usage: "tt-local runs events <run-id> [--config path]", description: "List run events.", options: [CONFIG_OPTION], minPositionals: 1, maxPositionals: 1, missingPositionalsMessage: "runs events requires <run-id>" },
-            watch: { usage: "tt-local runs watch <run-id> [--config path]", description: "Watch a run until it finishes.", options: [CONFIG_OPTION], minPositionals: 1, maxPositionals: 1, missingPositionalsMessage: "runs watch requires <run-id>" },
             report: { usage: "tt-local runs report <run-id> [--config path]", description: "Show the baseline-vs-tuned report, including deltas and regressions.", options: [CONFIG_OPTION], minPositionals: 1, maxPositionals: 1, missingPositionalsMessage: "runs report requires <run-id>" },
             compare: { usage: "tt-local runs compare <run-id-a> <run-id-b> [--config path]", description: "Compare two run reports.", options: [CONFIG_OPTION], minPositionals: 2, maxPositionals: 2, missingPositionalsMessage: "runs compare requires <run-id-a> <run-id-b>" },
-            cancel: { usage: "tt-local runs cancel <run-id> [--config path]", description: "Request cancellation of a run.", options: [CONFIG_OPTION], minPositionals: 1, maxPositionals: 1, missingPositionalsMessage: "runs cancel requires <run-id>" },
-            reconcile: { usage: "tt-local runs reconcile [--config path]", description: "Rebuild local store indexes.", options: [CONFIG_OPTION], maxPositionals: 0 },
         },
     },
     models: {
@@ -250,63 +175,47 @@ const COMMAND_GROUPS = {
                 missingPositionalsMessage: "models verify requires <model-id-or-artifact-path>",
             },
             prefetch: {
-                usage: "tt-local models prefetch [tunedtensor.json|request.json] [options]",
+                usage: "tt-local models prefetch [tunedtensor.json] [options]",
                 description: "Download the configured base model before a run.",
-                options: [CONFIG_OPTION, USER_ID_OPTION, RUN_NUMBER_OPTION, VERBOSE_OPTION, QUIET_OPTION],
+                options: [CONFIG_OPTION, VERBOSE_OPTION, QUIET_OPTION],
                 maxPositionals: 1,
             },
             "verify-base": {
-                usage: "tt-local models verify-base [tunedtensor.json|request.json] [options]",
+                usage: "tt-local models verify-base [tunedtensor.json] [options]",
                 description: "Verify that the configured base-model snapshot is complete and locally available.",
-                options: [CONFIG_OPTION, USER_ID_OPTION, RUN_NUMBER_OPTION, VERBOSE_OPTION, QUIET_OPTION],
+                options: [CONFIG_OPTION, VERBOSE_OPTION, QUIET_OPTION],
                 maxPositionals: 1,
             },
-            serve: {
-                usage: "tt-local models serve <model-id> [options]",
-                description: "Serve a verified adapter through an OpenAI-compatible local API.",
-                options: [
-                    CONFIG_OPTION,
-                    { name: "--host", value: "host", description: "Bind host (localhost by default)" },
-                    { name: "--port", value: "port", description: "Bind port" },
-                    { name: "--device", value: "device", description: "auto, cpu, cuda, or mps" },
-                    { name: "--max-tokens", value: "count", description: "Default response token limit" },
-                    { name: "--temperature", value: "number", description: "Default sampling temperature" },
-                    { name: "--top-p", value: "number", description: "Default nucleus sampling threshold" },
-                    { name: "--max-concurrent-requests", value: "count", description: "Concurrent generation limit" },
-                    { name: "--spec", value: "path", description: "Behavior spec whose instructions are enforced" },
-                    { name: "--no-spec-prompt", description: "Do not enforce the stored behavior-spec prompt" },
-                    { name: "--allow-remote", description: "Allow a non-loopback bind" },
-                    { name: "--api-key-env", value: "name", description: "Environment variable containing a bearer token" },
-                    { name: "--print-command", description: "Validate and print the launch plan without starting" },
-                ],
+            active: {
+                usage: "tt-local models active [--config path]",
+                description: "Show the active adapter, or the protected base when none is active.",
+                options: [CONFIG_OPTION],
+                maxPositionals: 0,
+            },
+            activate: {
+                usage: "tt-local models activate <model-id> [--config path]",
+                description: "Activate a verified model whose general regression gate passed.",
+                options: [CONFIG_OPTION],
                 minPositionals: 1,
                 maxPositionals: 1,
-                missingPositionalsMessage: "models serve requires <model-id>",
+                missingPositionalsMessage: "models activate requires <model-id>",
             },
-        },
-    },
-    specs: {
-        description: "Inspect and import local behavior specs.",
-        defaultSubcommand: "list",
-        subcommands: {
-            list: { usage: "tt-local specs list [--config path]", description: "List local behavior specs.", options: [CONFIG_OPTION], maxPositionals: 0 },
-            get: { usage: "tt-local specs get <spec-id> [--config path]", description: "Get a local behavior spec.", options: [CONFIG_OPTION], minPositionals: 1, maxPositionals: 1, missingPositionalsMessage: "specs get requires <spec-id>" },
-            import: {
-                usage: "tt-local specs import <spec-or-request.json> [options]",
-                description: "Import a behavior spec into the local store.",
-                options: [CONFIG_OPTION, USER_ID_OPTION, RUN_NUMBER_OPTION, { name: "--id", value: "id", description: "ID for a raw spec snapshot" }],
+            rollback: {
+                usage: "tt-local models rollback [--config path]",
+                description: "Restore the previously active adapter or protected base.",
+                options: [CONFIG_OPTION],
+                maxPositionals: 0,
+            },
+            serve: {
+                usage: "tt-local models serve <model-id|active|base> [options]",
+                description: "Alias for `tt-local serve`.",
+                options: MODEL_SERVE_OPTIONS,
                 minPositionals: 1,
                 maxPositionals: 1,
-                missingPositionalsMessage: "specs import requires <spec-or-request.json>",
+                missingPositionalsMessage: "models serve requires <model-id>",
             },
         },
     },
-    store: {
-        description: "Maintain the local file-backed store.",
-        subcommands: {
-            "rebuild-index": { usage: "tt-local store rebuild-index [--config path]", description: "Rebuild store indexes from durable records.", options: [CONFIG_OPTION], maxPositionals: 0 },
-        },
-    },
 };
 function hasHelpFlag(argv) {
     return argv.includes("--help") || argv.includes("-h");
@@ -439,22 +348,32 @@ function readNumberOption(argv, name) {
     const value = readOption(argv, name);
     return value ? Number(value) : undefined;
 }
-function readRunStage(argv) {
-    const value = readOption(argv, "--stage") ?? "all";
-    if (value === "prepare"
-        || value === "baseline"
-        || value === "train"
-        || value === "candidate"
-        || value === "score"
-        || value === "report"
-        || value === "all") {
-        return value;
-    }
-    throw new Error(`--stage must be one of prepare, baseline, train, candidate, score, report, all; got: ${value}`);
+async function selectedConfigPath(argv, adjacentTo) {
+    const explicitPath = readOption(argv, "--config");
+    if (explicitPath)
+        return resolve(explicitPath);
+    const candidate = join(adjacentTo ? dirname(resolve(adjacentTo)) : cwd(), "local-runner.json");
+    const metadata = await stat(candidate).catch(() => null);
+    return metadata?.isFile() ? candidate : undefined;
 }
-async function configFromArgv(argv) {
-    const configPath = readOption(argv, "--config");
-    return loadLocalRunnerConfig(configPath ? resolve(configPath) : undefined);
+async function configSelectionFromArgv(argv, adjacentTo) {
+    const path = await selectedConfigPath(argv, adjacentTo);
+    return {
+        config: await loadLocalRunnerConfig(path),
+        ...(path ? { path } : {}),
+    };
+}
+async function configFromArgv(argv, adjacentTo) {
+    return (await configSelectionFromArgv(argv, adjacentTo)).config;
+}
+async function loadCliBehaviorSpec(inputPath, runId) {
+    const input = await loadLocalRunInput(inputPath, {
+        ...(runId ? { runId } : {}),
+    });
+    if (input.kind !== "spec") {
+        throw new Error(`TT Local CLI expects a tunedtensor.json behavior spec, not a full run request: ${input.path}`);
+    }
+    return input;
 }
 function printJson(value) {
     console.log(JSON.stringify(value, null, 2));
@@ -503,162 +422,7 @@ function createConsoleReporter(options) {
         },
     };
 }
-function assertSupportedValidateShape(request, config) {
-    if (request.training_method !== "dpo" || config.training.backend === "command")
-        return;
-    const model = resolveTrainingModel(request.spec_snapshot.base_model);
-    if (model.loader === "image_text_to_text") {
-        throw new Error("Bundled DPO training supports text causal-LM models only in v1. Use a causal_lm base model or training.backend=command for a custom DPO trainer.");
-    }
-}
-async function parentModelSelectionFromArgv(argv, config) {
-    const parentModel = readOption(argv, "--parent-model");
-    const parentModelArtifact = readOption(argv, "--parent-model-artifact");
-    if (parentModel && parentModelArtifact) {
-        throw new Error("Use only one of --parent-model or --parent-model-artifact.");
-    }
-    if (parentModelArtifact)
-        return { artifactUri: parentModelArtifact };
-    if (!parentModel)
-        return undefined;
-    const store = createLocalStore(config.storeRoot);
-    const record = await store.getModel(parentModel);
-    const verified = await verifyStoredModel(record, { requireServable: true });
-    const contract = verified.contract;
-    const baseModelRevision = typeof contract.base_model_revision === "string"
-        ? contract.base_model_revision
-        : undefined;
-    const baseModelArtifactUri = typeof contract.base_model_artifact_uri === "string"
-        ? contract.base_model_artifact_uri
-        : undefined;
-    const baseModelFingerprint = typeof contract.base_model_fingerprint === "string"
-        ? contract.base_model_fingerprint
-        : undefined;
-    if (baseModelArtifactUri && baseModelFingerprint) {
-        if (!config.paths.baseModel) {
-            throw new Error(`Parent model ${record.id} was trained from a local base snapshot. Configure paths.baseModel to the same `
-                + "snapshot before continuing it.");
-        }
-        const configuredFingerprint = await fingerprintLocalBaseModel(config.paths.baseModel);
-        if (configuredFingerprint !== baseModelFingerprint) {
-            throw new Error(`Configured paths.baseModel content does not match parent model ${record.id}.`);
-        }
-    }
-    else if (!baseModelRevision) {
-        throw new Error(`Parent model ${record.id} does not record an immutable base-model revision or local snapshot fingerprint. `
-            + "Use --parent-model-artifact only if you intentionally accept responsibility for that unpinned artifact.");
-    }
-    if (baseModelRevision && config.paths.baseModel) {
-        const snapshotRevision = resolve(config.paths.baseModel).match(/[\\/]snapshots[\\/]([^\\/]+)(?:[\\/]|$)/)?.[1];
-        if (!baseModelFingerprint && snapshotRevision !== baseModelRevision) {
-            throw new Error(`Parent model ${record.id} requires base revision ${baseModelRevision}; configured paths.baseModel does not `
-                + "identify that snapshot revision.");
-        }
-    }
-    return {
-        artifactUri: record.artifact_uri,
-        modelId: record.id,
-        baseModel: record.base_model,
-        baseModelRevision,
-        baseModelArtifactUri,
-        baseModelFingerprint,
-    };
-}
-function withParentModelArtifact(request, parentModel) {
-    if (!parentModel)
-        return request;
-    if (parentModel.baseModel && parentModel.baseModel !== request.spec_snapshot.base_model) {
-        throw new Error(`Parent model ${parentModel.modelId ?? ""} uses base model ${parentModel.baseModel}, `
-            + `but this run uses ${request.spec_snapshot.base_model}. Continue from a model with the same base model.`);
-    }
-    const requestedRevision = request.hyperparameters.base_model_revision;
-    if (parentModel.baseModelRevision && requestedRevision && parentModel.baseModelRevision !== requestedRevision) {
-        throw new Error(`Parent model ${parentModel.modelId ?? ""} uses base revision ${parentModel.baseModelRevision}, `
-            + `but this run requests ${requestedRevision}.`);
-    }
-    return fineTuneRunRequestSchema.parse({
-        ...request,
-        hyperparameters: {
-            ...request.hyperparameters,
-            ...(parentModel.baseModelRevision ? { base_model_revision: parentModel.baseModelRevision } : {}),
-            parent_model_artifact: parentModel.artifactUri,
-        },
-    });
-}
-async function sleep(ms) {
-    await new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
-}
-function detachedRunArgv(argv, runId) {
-    const tokens = argv.slice(3);
-    const output = [];
-    for (let index = 0; index < tokens.length; index += 1) {
-        const token = tokens[index];
-        if (token === "--detach")
-            continue;
-        if (token === "--run-id") {
-            index += 1;
-            continue;
-        }
-        if (token.startsWith("--run-id="))
-            continue;
-        output.push(token);
-    }
-    return ["run", ...output, "--run-id", runId];
-}
-async function launchDetachedRun(args) {
-    if (!process.argv[1])
-        throw new Error("Cannot determine the tt-local CLI entrypoint for --detach.");
-    const prefix = args.request.artifacts?.prefix ?? defaultArtifactPrefix({
-        userId: args.request.user_id,
-        behaviorSpecId: args.request.behavior_spec_id,
-        runId: args.request.run_id,
-    });
-    const artifacts = resolveRunArtifacts({ artifactRoot: args.config.artifactRoot, prefix });
-    await claimRunArtifactDirectory({
-        artifacts,
-        runId: args.request.run_id,
-        userId: args.request.user_id,
-        behaviorSpecId: args.request.behavior_spec_id,
-    });
-    const store = createLocalStore(args.config.storeRoot);
-    const existing = await store.getRun(args.request.run_id).catch(() => null);
-    if (existing) {
-        await store.syncRunRequest(args.request);
-    }
-    else {
-        await store.startRun({ request: args.request, artifactDir: artifacts.runDir });
-    }
-    const logPath = resolve(artifacts.runDir, "detached.log");
-    await mkdir(dirname(logPath), { recursive: true });
-    const log = await open(logPath, "a");
-    try {
-        const child = spawn(process.execPath, [
-            ...process.execArgv,
-            process.argv[1],
-            ...detachedRunArgv(args.argv, args.request.run_id),
-        ], {
-            detached: true,
-            stdio: ["ignore", log.fd, log.fd],
-            env: { ...process.env, TT_LOCAL_DETACHED: "1" },
-        });
-        await new Promise((resolveSpawn, reject) => {
-            child.once("spawn", resolveSpawn);
-            child.once("error", reject);
-        });
-        if (!child.pid)
-            throw new Error("Detached tt-local process did not report a PID.");
-        child.unref();
-        return { pid: child.pid, logPath, artifactDir: artifacts.runDir };
-    }
-    catch (error) {
-        await store.failRun(args.request.run_id, `Failed to launch detached workflow: ${error instanceof Error ? error.message : String(error)}`).catch(() => undefined);
-        throw error;
-    }
-    finally {
-        await log.close();
-    }
-}
-async function verifyStoredModel(model, options = {}) {
+async function verifyStoredModel(model) {
     const manifestPath = join(model.artifact_dir, "artifact-manifest.json");
     const integrity = await assertArtifactManifest(manifestPath, {
         requiredPaths: ["stage-metadata.json", "training-report.json"],
@@ -669,11 +433,7 @@ async function verifyStoredModel(model, options = {}) {
     if (!manifest.model) {
         throw new Error(`Artifact manifest does not contain a model contract: ${manifestPath}`);
     }
-    const customNonServable = manifest.model.framework !== "transformers-peft"
-        && manifest.model.servable === false;
-    const artifact = await assertUsableModelArtifact(model.artifact_uri, {
-        allowUnrecognizedPayload: customNonServable && !options.requireServable,
-    });
+    const artifact = await assertUsableModelArtifact(model.artifact_uri);
     if (typeof manifest.model.base_model_artifact_uri === "string"
         && typeof manifest.model.base_model_fingerprint === "string") {
         const actualBaseFingerprint = await fingerprintLocalBaseModel(manifest.model.base_model_artifact_uri);
@@ -688,9 +448,6 @@ async function verifyStoredModel(model, options = {}) {
     if (manifest.model.base_model !== model.base_model) {
         throw new Error("Stored model base model does not match its artifact manifest.");
     }
-    if (options.requireServable && manifest.model.servable !== true) {
-        throw new Error(`Model ${model.id} is valid but its artifact contract does not mark it as locally servable.`);
-    }
     return {
         manifest_path: manifestPath,
         integrity,
@@ -698,6 +455,17 @@ async function verifyStoredModel(model, options = {}) {
         contract: manifest.model,
     };
 }
+async function verifyActivationEvidence(model) {
+    await assertArtifactManifest(join(model.artifact_dir, "artifact-manifest.json"), {
+        requiredPaths: [
+            "run-report.json",
+            "general-baseline-eval.json",
+            "general-candidate-eval.json",
+        ],
+        scopeToRequired: true,
+        verifyModel: true,
+    });
+}
 async function verifyModelArtifactPath(input) {
     const inputPath = resolve(input);
     let manifestPath;
@@ -743,11 +511,7 @@ async function verifyModelArtifactPath(input) {
     const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
     if (!manifest.model)
         throw new Error(`Artifact manifest does not contain a model contract: ${manifestPath}`);
-    const customNonServable = manifest.model.framework !== "transformers-peft"
-        && manifest.model.servable === false;
-    const artifact = await assertUsableModelArtifact(artifactUri, {
-        allowUnrecognizedPayload: customNonServable,
-    });
+    const artifact = await assertUsableModelArtifact(artifactUri);
     if (typeof manifest.model.base_model_artifact_uri === "string"
         && typeof manifest.model.base_model_fingerprint === "string") {
         const actualBaseFingerprint = await fingerprintLocalBaseModel(manifest.model.base_model_artifact_uri);
@@ -772,12 +536,10 @@ async function modelSystemPrompt(args) {
     if (specPath) {
         const input = JSON.parse(await readFile(resolve(specPath), "utf8"));
         const local = localBehaviorSpecFileSchema.safeParse(input);
-        const request = fineTuneRunRequestSchema.safeParse(input);
-        const snapshot = specSnapshotSchema.safeParse(input);
-        const parsedSpec = local.success ? local.data : request.success ? request.data.spec_snapshot : snapshot.success ? snapshot.data : null;
-        if (!parsedSpec)
-            throw new Error(`--spec must contain a TT Local behavior spec or run request: ${resolve(specPath)}`);
-        spec = parsedSpec;
+        if (!local.success) {
+            throw new Error(`--spec must contain a tunedtensor.json behavior spec: ${resolve(specPath)}`);
+        }
+        spec = local.data;
     }
     else {
         const runRequestPath = join(args.store.paths.runsDir, args.model.run_id, "request.json");
@@ -806,10 +568,140 @@ async function modelSystemPrompt(args) {
 }
 function modelServeDevice(argv) {
     const value = readOption(argv, "--device");
-    if (value === undefined || value === "auto" || value === "cpu" || value === "cuda" || value === "mps") {
+    if (value === undefined || value === "cpu" || value === "cuda") {
         return value;
     }
-    throw new Error(`--device must be one of auto, cpu, cuda, mps; got: ${value}`);
+    throw new Error(`--device must be cuda or cpu; got: ${value}`);
+}
+async function serveStoredModelFromCli(args) {
+    const store = createLocalStore(args.config.storeRoot);
+    const model = await store.getModel(args.modelId);
+    const verified = await verifyStoredModel(model);
+    const launch = buildLocalModelServerLaunch({
+        model,
+        config: args.config,
+        options: {
+            host: readOption(args.argv, "--host"),
+            port: readNumberOption(args.argv, "--port"),
+            device: modelServeDevice(args.argv),
+            maxTokens: readNumberOption(args.argv, "--max-tokens"),
+            temperature: readNumberOption(args.argv, "--temperature"),
+            topP: readNumberOption(args.argv, "--top-p"),
+            maxConcurrentRequests: readNumberOption(args.argv, "--max-concurrent-requests"),
+            systemPrompt: await modelSystemPrompt({ argv: args.argv, model, store }),
+            allowRemote: hasFlag(args.argv, "--allow-remote"),
+            apiKeyEnv: readOption(args.argv, "--api-key-env"),
+            baseModelRevision: (() => {
+                const contract = verified.contract;
+                return typeof contract.base_model_revision === "string" ? contract.base_model_revision : undefined;
+            })(),
+            baseModelArtifactUri: (() => {
+                const contract = verified.contract;
+                return typeof contract.base_model_artifact_uri === "string" ? contract.base_model_artifact_uri : undefined;
+            })(),
+        },
+    });
+    if (hasFlag(args.argv, "--print-command")) {
+        printJson({
+            ok: true,
+            model_id: model.id,
+            url: launch.url,
+            command: launch.displayCommand,
+            artifact_path: launch.artifactPath,
+            manifest_path: verified.manifest_path,
+            integrity: verified.integrity,
+        });
+        return;
+    }
+    process.stderr.write(`[tt-local] verified ${verified.integrity.checked} artifact file(s)\n`);
+    process.stderr.write(`[tt-local] model API: ${launch.url}\n`);
+    await serveLocalModel(launch);
+}
+function serveOptionsFromArgv(argv) {
+    return {
+        host: readOption(argv, "--host"),
+        port: readNumberOption(argv, "--port"),
+        device: modelServeDevice(argv),
+        maxTokens: readNumberOption(argv, "--max-tokens"),
+        temperature: readNumberOption(argv, "--temperature"),
+        topP: readNumberOption(argv, "--top-p"),
+        maxConcurrentRequests: readNumberOption(argv, "--max-concurrent-requests"),
+        allowRemote: hasFlag(argv, "--allow-remote"),
+        apiKeyEnv: readOption(argv, "--api-key-env"),
+    };
+}
+async function serveBaseModelFromCli(args) {
+    const explicitSpecPath = readOption(args.argv, "--spec");
+    if (explicitSpecPath && hasFlag(args.argv, "--no-spec-prompt")) {
+        throw new Error("Use only one of --spec or --no-spec-prompt.");
+    }
+    const defaultSpecPath = resolve(DEFAULT_LOCAL_SPEC_PATH);
+    const specPath = explicitSpecPath
+        ? resolve(explicitSpecPath)
+        : (await stat(defaultSpecPath).catch(() => null))?.isFile()
+            ? defaultSpecPath
+            : undefined;
+    const spec = specPath
+        ? localBehaviorSpecFileSchema.parse(JSON.parse(await readFile(specPath, "utf8")))
+        : undefined;
+    let baseModel = spec?.base_model;
+    if (!baseModel) {
+        const store = createLocalStore(args.config.storeRoot);
+        const active = await getActiveModel(store);
+        const referenceModel = active.model
+            ?? (active.pointer?.previous_model_id
+                ? await store.getModel(active.pointer.previous_model_id)
+                : null);
+        baseModel = referenceModel?.base_model;
+    }
+    if (!baseModel) {
+        throw new Error("Cannot identify the protected base model. Pass --spec <tunedtensor.json> "
+            + "or activate a model first.");
+    }
+    const launch = buildLocalBaseModelServerLaunch({
+        baseModel,
+        config: args.config,
+        options: {
+            ...serveOptionsFromArgv(args.argv),
+            systemPrompt: explicitSpecPath && !hasFlag(args.argv, "--no-spec-prompt")
+                ? buildSystemMessage(spec)
+                : undefined,
+            baseModelRevision: spec?.hyperparameters?.base_model_revision,
+        },
+    });
+    if (hasFlag(args.argv, "--print-command")) {
+        printJson({
+            ok: true,
+            model_id: null,
+            base_model: baseModel,
+            url: launch.url,
+            command: launch.displayCommand,
+        });
+        return;
+    }
+    process.stderr.write(`[tt-local] protected base model API: ${launch.url}\n`);
+    await serveLocalModel(launch);
+}
+async function serveModelTargetFromCli(args) {
+    if (args.target === "base") {
+        return serveBaseModelFromCli(args);
+    }
+    if (args.target === "active") {
+        const store = createLocalStore(args.config.storeRoot);
+        const active = await getActiveModel(store);
+        if (!active.model)
+            return serveBaseModelFromCli(args);
+        return serveStoredModelFromCli({
+            argv: args.argv,
+            modelId: active.model.id,
+            config: args.config,
+        });
+    }
+    return serveStoredModelFromCli({
+        argv: args.argv,
+        modelId: args.target,
+        config: args.config,
+    });
 }
 async function main(argv) {
     const cli = parseCli(argv);
@@ -830,10 +722,6 @@ async function main(argv) {
         printCommandHelp(cli.definition);
         return;
     }
-    const loadedEnv = await loadDotEnvFromCwd();
-    if (loadedEnv.length > 0 && !hasFlag(argv, "--quiet")) {
-        process.stderr.write(`[tt-local] loaded ${loadedEnv.join(", ")} from .env\n`);
-    }
     if (command === "info") {
         const info = getLocalRunnerInfo();
         console.log(`${info.name}: ${info.description}`);
@@ -842,13 +730,21 @@ async function main(argv) {
         return;
     }
     if (command === "doctor") {
-        const config = await configFromArgv(argv);
-        const request = cli.positionals[0]
-            ? (await loadLocalRunInput(resolve(cli.positionals[0]))).request
+        const inputPath = resolve(cli.positionals[0] ?? DEFAULT_LOCAL_SPEC_PATH);
+        const configSelection = await configSelectionFromArgv(argv, inputPath);
+        const hasDefaultSpec = cli.positionals[0]
+            ? true
+            : Boolean((await stat(inputPath).catch(() => null))?.isFile());
+        const request = hasDefaultSpec
+            ? (await loadCliBehaviorSpec(inputPath)).request
             : undefined;
-        const checks = await runDoctor(config, request);
+        const checks = await runDoctor(configSelection.config, request);
         const ok = checks.every((check) => check.ok);
-        printJson({ ok, checks });
+        printJson({
+            ok,
+            config_path: configSelection.path ?? null,
+            checks,
+        });
         if (!ok)
             process.exitCode = 1;
         return;
@@ -866,15 +762,18 @@ async function main(argv) {
             force: hasFlag(argv, "--force"),
         });
         const configPath = profile
-            ? resolve(readOption(argv, "--config-output") ?? resolve(dirname(outputPath), "local-runner.json"))
-            : undefined;
-        if (profile && configPath) {
+            ? resolve(readOption(argv, "--config") ?? resolve(dirname(outputPath), "local-runner.json"))
+            : await selectedConfigPath(argv, outputPath);
+        if (profile) {
             await initLocalRunnerConfigFile({
                 outputPath: configPath,
                 profile,
                 force: hasFlag(argv, "--force"),
             });
         }
+        else if (configPath) {
+            await loadLocalRunnerConfig(configPath);
+        }
         printJson({
             ok: true,
             path: outputPath,
@@ -887,174 +786,95 @@ async function main(argv) {
     }
     if (command === "validate") {
         const inputPath = resolve(cli.positionals[0] ?? DEFAULT_LOCAL_SPEC_PATH);
-        const input = await loadLocalRunInput(inputPath, {
-            userId: readOption(argv, "--user-id"),
-            runNumber: readNumberOption(argv, "--run-number"),
+        const input = await loadCliBehaviorSpec(inputPath);
+        assertLocalRunInputReady(input.request);
+        const configSelection = await configSelectionFromArgv(argv, inputPath);
+        const validated = await validateLocalFineTuneInput({
+            request: input.request,
+            config: configSelection.config,
         });
-        const request = input.request;
-        const config = await configFromArgv(argv);
-        assertLocalRunInputReady(request);
-        assertSupportedValidateShape(request, config);
-        assertEvaluationScoringReady(config);
+        const request = validated.request;
+        const config = validated.config;
         printJson({
             ok: true,
-            input_kind: input.kind,
             input_path: input.path,
-            run_id: input.kind === "request" ? request.run_id : null,
+            config_path: configSelection.path ?? null,
             behavior_spec_id: request.behavior_spec_id,
-            training_method: request.training_method,
             base_model: request.spec_snapshot.base_model,
             dataset_format: request.dataset_prebuilt?.format ?? null,
             artifact_root: config.artifactRoot,
             store_root: config.storeRoot,
             dry_run: config.dryRun,
-            ...(input.warnings.length > 0 ? { warnings: input.warnings } : {}),
         });
         return;
     }
     if (command === "run") {
         const inputPath = resolve(cli.positionals[0] ?? DEFAULT_LOCAL_SPEC_PATH);
-        const configInput = await configFromArgv(argv);
+        const configSelection = await configSelectionFromArgv(argv, inputPath);
+        const configInput = configSelection.config;
         const config = localRunnerConfigSchema.parse({
             ...configInput,
             dryRun: hasFlag(argv, "--dry-run") ? true : configInput.dryRun,
         });
-        const input = await loadLocalRunInput(inputPath, {
-            runId: readOption(argv, "--run-id"),
-            userId: readOption(argv, "--user-id"),
-            runNumber: readNumberOption(argv, "--run-number"),
+        const input = await loadCliBehaviorSpec(inputPath);
+        assertLocalRunInputReady(input.request);
+        const validated = await validateLocalFineTuneInput({
+            request: input.request,
+            config,
+        });
+        let request = validated.request;
+        const reporter = createConsoleReporter({
+            verbose: hasFlag(argv, "--verbose"),
+            quiet: hasFlag(argv, "--quiet"),
         });
-        if (!hasFlag(argv, "--quiet")) {
-            for (const warning of input.warnings) {
-                process.stderr.write(`[tt-local] warning: ${warning}\n`);
+        if (!config.dryRun
+            && !config.paths.baseModel
+            && !request.hyperparameters.base_model_revision) {
+            const prefetch = await prefetchBaseModel({
+                request,
+                config,
+                reporter,
+            });
+            if (!prefetch.snapshot_revision) {
+                throw new Error("Base-model prefetch did not return an immutable snapshot revision.");
             }
-        }
-        const runId = readOption(argv, "--run-id");
-        const baseRequest = runId && input.kind === "request"
-            ? fineTuneRunRequestSchema.parse({ ...input.request, run_id: runId })
-            : input.request;
-        const request = withParentModelArtifact(baseRequest, await parentModelSelectionFromArgv(argv, config));
-        assertLocalRunInputReady(request);
-        assertSupportedValidateShape(request, config);
-        assertEvaluationScoringReady(config);
-        if (hasFlag(argv, "--detach")) {
-            const detached = await launchDetachedRun({ argv, request, config });
-            const configPath = readOption(argv, "--config");
-            const configSuffix = configPath ? ` --config ${JSON.stringify(resolve(configPath))}` : "";
-            printJson({
-                status: "queued",
-                detached: true,
-                run_id: request.run_id,
-                behavior_spec_id: request.behavior_spec_id,
-                pid: detached.pid,
-                log_path: detached.logPath,
-                artifact_dir: detached.artifactDir,
-                next: {
-                    watch: `tt-local runs watch ${request.run_id}${configSuffix}`,
-                    cancel: `tt-local runs cancel ${request.run_id}${configSuffix}`,
+            request = fineTuneRunRequestSchema.parse({
+                ...request,
+                hyperparameters: {
+                    ...request.hyperparameters,
+                    base_model_revision: prefetch.snapshot_revision,
                 },
             });
-            return;
         }
-        const stage = readRunStage(argv);
-        const result = await runLocalFineTuneStage({
+        const result = await runLocalFineTune({
             request,
             config,
-            stage,
-            force: hasFlag(argv, "--force"),
-            modelArtifact: readOption(argv, "--model-artifact"),
-            reporter: createConsoleReporter({
-                verbose: hasFlag(argv, "--verbose"),
-                quiet: hasFlag(argv, "--quiet"),
-            }),
+            reporter,
         });
-        if (result.report) {
-            printJson({
-                status: result.report.status,
-                stage: result.stage,
-                input_kind: input.kind,
-                run_id: result.report.run_id,
-                behavior_spec_id: result.report.behavior_spec_id,
-                report_path: result.reportPath,
-                artifact_dir: result.artifactDir,
+        printJson({
+            status: result.report.status,
+            run_id: result.report.run_id,
+            behavior_spec_id: result.report.behavior_spec_id,
+            report_path: result.reportPath,
+            artifact_dir: result.artifactDir,
+            ...(!config.dryRun ? {
                 model_id: `local-${result.report.run_id}`,
                 fine_tuned_model_id: result.report.fine_tuned_model_id,
-                parent_model_artifact: result.report.run_metadata.parent_model_artifact ?? null,
-                training_log: result.report.training.log_uri,
-                baseline_eval: result.report.artifact_uris.baseline_eval,
-                candidate_eval: result.report.artifact_uris.candidate_eval,
-                comparison: result.report.comparison,
-            });
-        }
-        else {
-            printJson({
-                status: "stage_completed",
-                stage: result.stage,
-                input_kind: input.kind,
-                run_id: result.request.run_id,
-                behavior_spec_id: result.request.behavior_spec_id,
-                artifact_dir: result.artifactDir,
-                parent_model_artifact: result.request.hyperparameters.parent_model_artifact ?? null,
-                artifacts: result.artifacts,
-            });
-        }
-        return;
-    }
-    if (command === "label") {
-        const sourcePath = cli.positionals[0];
-        if (!sourcePath)
-            throw new Error("label requires <input.jsonl|input.csv>");
-        const configInput = await configFromArgv(argv);
-        const config = localRunnerConfigSchema.parse({
-            ...configInput,
-            dryRun: hasFlag(argv, "--dry-run") ? true : configInput.dryRun,
-        });
-        const format = readOption(argv, "--format");
-        if (format !== undefined && format !== "jsonl" && format !== "csv") {
-            throw new Error(`--format must be jsonl or csv, got: ${format}`);
-        }
-        let systemMessage = readOption(argv, "--system-prompt");
-        if (!systemMessage) {
-            const specPath = resolve(readOption(argv, "--spec") ?? DEFAULT_LOCAL_SPEC_PATH);
-            let raw;
-            try {
-                raw = await readFile(specPath, "utf8");
-            }
-            catch {
-                throw new Error(`Cannot read spec at ${specPath}. Pass --spec <tunedtensor.json> or --system-prompt "..." so the teacher labels under the model's instructions.`);
-            }
-            systemMessage = buildSystemMessage(localBehaviorSpecFileSchema.parse(JSON.parse(raw)));
-        }
-        const result = await runLocalLabelingJob({
-            sourcePath: resolve(sourcePath),
-            format,
-            inputColumn: readOption(argv, "--input-column"),
-            systemMessage,
-            config,
-            outputPath: readOption(argv, "--output"),
-            model: readOption(argv, "--model"),
-            reporter: createConsoleReporter({
-                verbose: hasFlag(argv, "--verbose"),
-                quiet: hasFlag(argv, "--quiet"),
-            }),
+            } : {}),
+            training_log: result.report.training.log_uri,
+            baseline_eval: result.report.artifact_uris.baseline_eval,
+            candidate_eval: result.report.artifact_uris.candidate_eval,
+            comparison: result.report.comparison,
+            general_regression: result.report.general_regression,
         });
-        printJson(result.report);
-        if (result.report.status === "failed")
-            process.exitCode = 1;
         return;
     }
     if (command === "serve") {
         const config = await configFromArgv(argv);
-        const host = readOption(argv, "--host") ?? "127.0.0.1";
-        const port = Number(readOption(argv, "--port") ?? "8787");
-        const dashboard = await serveLocalDashboard({ host, port, config });
-        console.log(`TT Local dashboard: ${dashboard.url}`);
-        await new Promise((resolveStop) => {
-            const stop = () => {
-                dashboard.close().then(resolveStop, resolveStop);
-            };
-            process.once("SIGINT", stop);
-            process.once("SIGTERM", stop);
+        await serveModelTargetFromCli({
+            argv,
+            target: cli.positionals[0],
+            config,
         });
         return;
     }
@@ -1093,42 +913,14 @@ async function main(argv) {
             ]);
             return printJson(compareRuns(reportA, reportB));
         }
-        if (subcommand === "cancel") {
-            const id = cli.positionals[0];
-            if (!id)
-                throw new Error("runs cancel requires <run-id>");
-            await store.cancelRun(id);
-            const run = await store.getRun(id);
-            return printJson({ ok: true, run_id: run.id, status: run.status, current_stage: run.current_stage });
-        }
-        if (subcommand === "watch") {
-            const id = cli.positionals[0];
-            if (!id)
-                throw new Error("runs watch requires <run-id>");
-            const printed = new Set();
-            while (true) {
-                const events = await store.getRunEvents(id);
-                for (const event of events) {
-                    if (printed.has(event.id))
-                        continue;
-                    printed.add(event.id);
-                    console.log(`${event.occurred_at} ${event.stage} ${event.status}: ${event.message}`);
-                }
-                const run = await store.getRun(id);
-                if (isTerminalRunState(run))
-                    return;
-                await sleep(1000);
-            }
-        }
-        if (subcommand === "reconcile") {
-            await store.rebuildIndexes();
-            return printJson({ ok: true });
-        }
         throw new Error(`Unknown runs command: ${subcommand}`);
     }
     if (command === "models") {
         const subcommand = cli.subcommand;
-        const config = await configFromArgv(argv);
+        const modelInputPath = subcommand === "prefetch" || subcommand === "verify-base"
+            ? resolve(cli.positionals[0] ?? DEFAULT_LOCAL_SPEC_PATH)
+            : undefined;
+        const config = await configFromArgv(argv, modelInputPath);
         const store = createLocalStore(config.storeRoot);
         if (subcommand === "list")
             return printJson(await store.listModels());
@@ -1149,17 +941,41 @@ async function main(argv) {
             const verified = await verifyStoredModel(model);
             return printJson({ ok: true, model, ...verified });
         }
-        if (subcommand === "prefetch" || subcommand === "verify-base") {
-            const inputPath = resolve(cli.positionals[0] ?? DEFAULT_LOCAL_SPEC_PATH);
-            const input = await loadLocalRunInput(inputPath, {
-                userId: readOption(argv, "--user-id"),
-                runNumber: readNumberOption(argv, "--run-number"),
+        if (subcommand === "active") {
+            const active = await getActiveModel(store);
+            return printJson({
+                active: active.model?.id ?? "base",
+                pointer: active.pointer,
+                model: active.model,
             });
-            if (!hasFlag(argv, "--quiet")) {
-                for (const warning of input.warnings) {
-                    process.stderr.write(`[tt-local] warning: ${warning}\n`);
-                }
+        }
+        if (subcommand === "activate") {
+            const id = cli.positionals[0];
+            if (!id)
+                throw new Error("models activate requires <model-id>");
+            const model = await store.getModel(id);
+            const verified = await verifyStoredModel(model);
+            await verifyActivationEvidence(model);
+            const pointer = await activateModel(store, model.id);
+            return printJson({
+                active: pointer.model_id,
+                pointer,
+                manifest_path: verified.manifest_path,
+                integrity: verified.integrity,
+            });
+        }
+        if (subcommand === "rollback") {
+            const current = await getActiveModel(store);
+            if (current.pointer?.previous_model_id) {
+                const previous = await store.getModel(current.pointer.previous_model_id);
+                await verifyStoredModel(previous);
+                await verifyActivationEvidence(previous);
             }
+            const pointer = await rollbackActiveModel(store);
+            return printJson({ active: pointer.model_id ?? "base", pointer });
+        }
+        if (subcommand === "prefetch" || subcommand === "verify-base") {
+            const input = await loadCliBehaviorSpec(modelInputPath);
             const report = await prefetchBaseModel({
                 request: input.request,
                 config,
@@ -1171,7 +987,6 @@ async function main(argv) {
             });
             return printJson({
                 ...report,
-                input_kind: input.kind,
                 input_path: input.path,
             });
         }
@@ -1179,95 +994,11 @@ async function main(argv) {
             const id = cli.positionals[0];
             if (!id)
                 throw new Error("models serve requires <model-id>");
-            const model = await store.getModel(id);
-            const verified = await verifyStoredModel(model, { requireServable: true });
-            const launch = buildLocalModelServerLaunch({
-                model,
-                config,
-                options: {
-                    host: readOption(argv, "--host"),
-                    port: readNumberOption(argv, "--port"),
-                    device: modelServeDevice(argv),
-                    maxTokens: readNumberOption(argv, "--max-tokens"),
-                    temperature: readNumberOption(argv, "--temperature"),
-                    topP: readNumberOption(argv, "--top-p"),
-                    maxConcurrentRequests: readNumberOption(argv, "--max-concurrent-requests"),
-                    systemPrompt: await modelSystemPrompt({ argv, model, store }),
-                    allowRemote: hasFlag(argv, "--allow-remote"),
-                    apiKeyEnv: readOption(argv, "--api-key-env"),
-                    baseModelRevision: (() => {
-                        const contract = verified.contract;
-                        return typeof contract.base_model_revision === "string" ? contract.base_model_revision : undefined;
-                    })(),
-                    baseModelArtifactUri: (() => {
-                        const contract = verified.contract;
-                        return typeof contract.base_model_artifact_uri === "string" ? contract.base_model_artifact_uri : undefined;
-                    })(),
-                },
-            });
-            if (hasFlag(argv, "--print-command")) {
-                return printJson({
-                    ok: true,
-                    model_id: model.id,
-                    url: launch.url,
-                    command: launch.displayCommand,
-                    artifact_path: launch.artifactPath,
-                    manifest_path: verified.manifest_path,
-                    integrity: verified.integrity,
-                });
-            }
-            process.stderr.write(`[tt-local] verified ${verified.integrity.checked} artifact file(s)\n`);
-            process.stderr.write(`[tt-local] model API: ${launch.url}\n`);
-            await serveLocalModel(launch);
+            await serveModelTargetFromCli({ argv, target: id, config });
             return;
         }
         throw new Error(`Unknown models command: ${subcommand}`);
     }
-    if (command === "specs") {
-        const subcommand = cli.subcommand;
-        const config = await configFromArgv(argv);
-        const store = createLocalStore(config.storeRoot);
-        if (subcommand === "list")
-            return printJson(await store.listSpecs());
-        if (subcommand === "get") {
-            const id = cli.positionals[0];
-            if (!id)
-                throw new Error("specs get requires <spec-id>");
-            return printJson(await store.getSpec(id));
-        }
-        if (subcommand === "import") {
-            const path = cli.positionals[0];
-            if (!path)
-                throw new Error("specs import requires <spec-or-request.json>");
-            const input = JSON.parse(await readFile(resolve(path), "utf8"));
-            const request = fineTuneRunRequestSchema.safeParse(input);
-            if (request.success)
-                return printJson(await store.importSpec(request.data.behavior_spec_id, request.data.spec_snapshot));
-            const localSpec = localBehaviorSpecFileSchema.safeParse(input);
-            if (localSpec.success) {
-                const localRequest = runRequestFromLocalSpec(localSpec.data, {
-                    userId: readOption(argv, "--user-id"),
-                    runNumber: readNumberOption(argv, "--run-number"),
-                });
-                return printJson(await store.importSpec(localRequest.behavior_spec_id, localRequest.spec_snapshot));
-            }
-            const id = readOption(argv, "--id");
-            if (!id)
-                throw new Error("specs import requires --id when importing a raw spec snapshot");
-            return printJson(await store.importSpec(id, specSnapshotSchema.parse(input)));
-        }
-        throw new Error(`Unknown specs command: ${subcommand}`);
-    }
-    if (command === "store") {
-        const subcommand = cli.subcommand;
-        const config = await configFromArgv(argv);
-        const store = createLocalStore(config.storeRoot);
-        if (subcommand === "rebuild-index") {
-            await store.rebuildIndexes();
-            return printJson({ ok: true });
-        }
-        throw new Error(`Unknown store command: ${subcommand ?? ""}`);
-    }
     console.error(`Unknown command: ${command}`);
     process.exitCode = 1;
 }