JustVugg/colibri v1.10.2

colibri 1.10.2

on GitHub

Patch release. Three of these fixes answer reports made against 1.10.1 in the days after it shipped. No new engine; one behaviour change, opt-in.

If you hit one of these on 1.10.1, this is the fix

coli convert produced a GLM-5.3-Flash container the engine refused (#1368). It ran GLM-5.2's converter on everything; Flash nests its language model under the vision wrapper, so the embedding matched no rule, fell through to the generic fallback, and was quantized. The engine was right to refuse it, hours later, inside coli web. coli convert now reads the checkpoint's config.json and picks the converter from it. GLM-5.2's path is unchanged. An option the target converter does not take is refused, not silently dropped (#1369). And tools/convert_glm53.py, the right tool for Flash, is in the archive for the first time (#1364).

coli doctor said two core tensors were missing from a healthy GLM-5.3-Flash (#1365). The check held three literal tensor names taken from GLM-5.2. It now matches roles, prefix-agnostically, so it holds for any family that nests, including ones not written yet (#1366). Nothing was ever missing from those downloads.

The archive was missing files coli reaches (#1359): iq3_pack.py and its grid, reachable only through a subprocess-launched script. The packer follows that edge now, and data files next to a module (#1364).

Also fixed

• RSS guard counts the memory the process owns, not page cache the kernel can reclaim, so a mapped container no longer evicts experts to free memory it was not using (#1350)

• serve honors CANCEL mid-turn (#1336); the disconnect scenario is built, not hoped for (#1329)

• Metal: bit-exact fp8-e4m3 decode (#1346)

• Qwen3.6: tokenizer merges in both spellings (#1319)

• macOS: Homebrew prefixes found when brew is off the PATH (#1320); DeepSeek V4 reports real CPU and memory on macOS (#1308)

• doctor omits the GPU plan for a CPU-only engine (#1322); a missing core tensor explains itself on every fatal path (#1318)

• GLM-5.3-Flash --no-think is the template's lowest effort level, not a prompt shape of ours (#1327)

• The converter refuses a checkpoint it cannot serve, with a per-family pointer (#1305)

• GLM-5.3-Flash serve can use the 16 KV slots the engine has; the registry declared 1 (#1283)

• Security: image_url local reads refuse .., and with COLI_IMAGE_ROOT set the path must resolve inside it, so an authenticated client of a non-loopback server cannot read arbitrary files through the image API; errors no longer confirm a path exists (#1354, dmoraesrs). CI runs with contents: read and third-party actions are pinned by SHA

Supported checkpoints, stated plainly

• GLM-5.3 (744B-class) runs on the colibri engine. It is the same base model as GLM-5.2 (Z.ai say so; the configs differ only by the transformers version that wrote them), so the family is now named GLM-5.2/5.3 rather than announcing one as the other (#1367).
• DeepSeek V4 Flash REAP-150B (puwaer/DeepSeek-V4-Flash-0731-reap-150b, 85 GB, 132 of 256 experts) loads with the same engine and no conversion (#1310), confirmed by a second user. It is documented, and the banner reports it by its measured geometry, 43L x 132E, not as 284B (#1371).

Changed

• qwen36 VRAM tier promotes int8 experts instead of reserving for nothing (#1334)
• ...and the three tier bugs that surfaced with it are fixed: an is_x overrun with two or more GPUs, a shutdown that could hang, and a use-after-free on int8 containers (#1339, #1340, #1341; fix #1344 by crichalchemist)
• Kimi K3 stops loading a DSA indexer nothing reads (#1335)
• Opt-in COLI_MAP_EXPERTS=1: experts served through a per-shard file mapping (#1325). Off by default; output byte-identical either way

Docs

• Windows DeepSeek V4 users are led to the release launcher, coli.cmd, instead of a source build (#1291)

Build

• Makefile lists the headers each engine includes as prerequisites (#1284, #1349)
• Site and READMEs carry the eight families with real RAM figures under a contract test (#1302)