fak

module

v0.34.0 Latest Latest Go to latest Published: Jun 25, 2026 License: Apache-2.0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/anthony-chaudhary/fak

Links

Open Source Insights

README ¶

fak - Fused Agent Kernel

What It Is

fak is one Go binary you put in front of the AI agent you already run: Claude Code, Codex, Cursor, or any OpenAI / Anthropic / MCP client. You keep your model, your IDE, and your tools. You point one base URL at fak, and it gives you a handle on the parts of a real agent loop that get expensive or go wrong:

Cheaper long sessions. A 100k-token Claude Code conversation re-sends its whole transcript every turn. fak sheds the old turns while keeping the provider's prompt-cache prefix byte-identical, so the discount survives instead of breaking.
The right model per call. Send an easy read to a cheap model and a write-shaped call to a careful one, chosen per tool call rather than per whole request.
Fewer wasted turns. A repeated read served locally, a malformed call repaired in place, a dead-end branch refused before the agent spends a turn on it.
A trail you can audit. Every decision is a plain verdict: ALLOW, DENY, TRANSFORM, or QUARANTINE. It lands in JSON logs, an optional hash-chained journal, and Prometheus metrics.

fak in one line: Put fak in front of the agent you already run. It makes long sessions cheaper, routes each call to the right model, keeps unsafe tool results out of context, and records every verdict. One binary, no rewrite, no key to start.

It does this by sitting on the tool-call path as a kernel. The model proposes a call. fak decides whether that call exists, whether its arguments are allowed, whether the result may enter context, and what gets reused. The same boundary that saves you tokens is also where a dangerous call gets refused. That is why teams who need a hard security floor reach for it too (see For security teams).

agent --> proposed tool call --> fak kernel --> allowed tool / denied call
tool  --> raw result          --> fak kernel --> admitted context / quarantine

Start Here

No key, no model, no GPU. Pick the line that matches how you got fak.

Installed the binary (curl ... install.sh | sh, see Install)? These run from the bare binary anywhere — no clone, no Go, no examples/ dir. They use the built-in default floor:

fak preflight --tool refund_payment --args "{}"     # -> DENY  (DEFAULT_DENY): unknown tool, fail-closed
fak preflight --tool search_kb      --args "{}"     # -> ALLOW: a read-shaped name is not blanket-blocked
fak preflight --tool shell_rm_rf    --args "{}"     # -> DENY  (POLICY_BLOCK): refused by structure
fak preflight --tool exfiltrate     --args "{}"     # -> DENY  (SECRET_EXFIL)
fak agent --offline                                 # the injection / destructive-op A/B, fully offline

Cloned the repo (you have the Go source tree + examples/)? The same proof against a named example floor, where the deny is by argument value:

go run ./cmd/fak preflight --policy examples/customer-support-readonly-policy.json --tool refund_payment --args "{}"   # -> DENY (POLICY_BLOCK)
go run ./cmd/fak preflight --policy examples/customer-support-readonly-policy.json --tool search_kb     --args "{}"   # -> ALLOW
go run ./cmd/fak agent --offline
go run ./cmd/guarddemo -selfcheck                                                                                      # -> WITH fak: 0 breaches

Either way, the core proof is the same: the dangerous action is refused by structure before a model interpretation matters.

Use It With Your Agent

Claude Code, OpenCode, Aider-style CLIs

fak guard -- claude
fak guard --provider openai -- opencode

fak guard starts the gateway on loopback and injects the base URL into the child process only. It loads a built-in secure floor, forwards the real upstream credential, and prints the kernel's decisions when the agent exits. For Claude Code it can use your logged-in Claude subscription by default; no API key is required.

See docs/integrations/claude.md.

Long sessions: shed history, keep the cache hit

A long session re-sends its whole transcript every turn, so a 100k-token conversation gets expensive fast. The same wrap fixes that with one flag:

fak guard --compact-history-budget 8000 -- claude

fak drops the old middle turns while copying the provider's cache prefix through byte-for-byte, so the prompt-cache discount survives instead of breaking. The obvious fix, summarizing the old turns, rewrites the prompt and busts the cache, so it costs more. On any doubt fak forwards the original prompt unchanged, so it never breaks a turn. It guarantees the prefix is byte-identical, then relays the provider's own cache_read number rather than claiming the hit.

How and why, with the metrics: Long sessions: keep the cache hit. Tracking: #745.

Codex, Cursor, MCP hosts

For current Codex CLI/IDE sessions, use the MCP path first:

go build -o fak ./cmd/fak
codex mcp add fak -- ./fak serve --stdio --policy examples/dev-agent-policy.json

For any MCP host:

fak serve --stdio --policy examples/dev-agent-policy.json

The MCP surface gives an agent five kernel tools:

fak_adjudicate (decide before dispatch): get a verdict for a proposed call.
fak_syscall: run a checked call through the kernel.
fak_admit: screen a result before it enters context.
fak_context_change: notify the kernel that context changed.
Session reset tools: start clean when the host cooperates.

Use this when your agent should keep its normal model wire but still ask the kernel for verdicts.

See docs/integrations/openai-codex.md, docs/integrations/cursor.md, and examples/mcp.

Any OpenAI-compatible or Anthropic-compatible client

Put fak serve in front of the model endpoint:

fak serve --addr 127.0.0.1:8080 \
  --base-url http://localhost:11434/v1 \
  --model qwen2.5:1.5b \
  --policy examples/dev-agent-policy.json

Then point the client at http://127.0.0.1:8080/v1 for OpenAI-compatible traffic, or at http://127.0.0.1:8080 for Anthropic Messages traffic. Harden it with --require-key-env FAK_TOKEN and scrape /metrics.

See GETTING-STARTED.md and docs/fak/api-reference.md.

Why Now

The agent stack has moved from demos into operations. Coding agents now have plugins and background agents. They also have MCP servers, prompt caches, long sessions, and live tool permissions.

Recent public tooling points in the same direction. MCP reliability, auth, and observability work is active. Claude Code is shipping MCP and sandbox permission fixes. Security writing has moved toward runtime tool poisoning alongside prompt wording.

That changes the useful first screen for fak. The value is:

Make prompt-cache and routing decisions explicit enough to test — and keep the cache discount alive across a long session instead of busting it.
Preserve a traceable, privacy-conscious audit trail of every tool call.
Put a default-deny floor under the tools your agent already has.
Keep poisoned tool output and secret-shaped results out of model context.

Relevant external signals: Claude Code changelog, MCP stateless/auth discussion, and MCP tool-poisoning/security analysis.

What The Kernel Does

Surface	What it gives you	Status
`fak guard`	Drop-in guard around an existing CLI agent	shipped
`fak serve`	OpenAI, Anthropic, fak-native HTTP, plus MCP over HTTP/stdio	shipped
Policy floor	JSON allow/deny manifest with closed refusal reasons	shipped
Result quarantine	Secret, poison, oversize, and pollution results held out of context	shipped
Audit/metrics	JSON logs, optional hash-chained journal, Prometheus, `/debug/vars`	shipped
Session control	Budgets, reset directives, cooperative MCP reset, live session state	shipped
vCache proof tools	Planned and observed provider-cache savings/refutation	shipped as proof/control plane
Model routing	Per-aspect routing, ensembles, routebench, gateway seam	shipped spine; deploy with current flags/docs checked
In-kernel model	Pure-Go reference model, kernel-owned KV cache, GPU/backend witnesses	correctness/reference path

Every claim in CLAIMS.md carries exactly one tag: [SHIPPED], [SIMULATED], or [STUB]. The lint gate enforces that honesty ledger.

For security teams

If a hard capability floor is why you're here — not just a nice-to-have — this section is for you. The same boundary that sheds tokens above is, for your purposes, the lock around tool execution.

Most agent security tries to recognize bad text. Recognizers help. They are not the floor. Prompt injection is a text game. Attackers get turns too. fak moves the load-bearing decision to the capability floor: a dangerous tool outside the allow-list cannot be called, no matter what the model was told.

Two independent gates matter:

Call-side gate: tool names and selected arguments are checked before dispatch. A denied call never reaches the tool runner.
Result-side gate: tool output is screened before it enters context. A poisoned or secret-bearing result is paged out or quarantined instead of being handed back to the model as trusted text.

The capability floor is the guarantee. The detector can miss, and the docs say so. Irreversible effects are unwired by default. Untrusted bytes have to pass a gate before they become model context.

Read POLICY.md, docs/fak/security.md, and docs/integrations/agent-memory.md.

vCache: Provider Cache As A Budget Signal

A provider's prompt cache is not memory you control. You cannot ask it to evict a span or prove a prefix is resident. You just get telemetry after the request. So fak vcache treats a cache hit as a realized rebate, never something the answer depends on. It proves or refutes each saving from the provider's own usage counters.

go run ./cmd/fak vcache status
go run ./cmd/fak vcache prove

Evidence from two live traces:

Claude Code prefix probe: 13,141.5 input-token equivalents saved over four sibling turns, 4.73%.
Codex/OpenAI session telemetry: 9,147,340.8 token equivalents saved over 68 token-count events, 85.98%.

Those are provider-cache accounting proofs on those traces: fak supplies the accounting and control plane. The design contract, the full command set, and the causality fences are on the vCache page; the Codex/OpenAI probe is written up in the probe note.

Model Routing And Router Fusion

Most routers pick one model for a whole request. fak route routes an aspect instead. The unit can be the request or one tool call. It can also be a sub-query, reasoning step, or tagged stage.

An ensemble is a first-class plan. Supported reductions include vote and best_of. They also include first, concat, and scalar all_reduce.

Try it offline:

go run ./cmd/fak route --aspect tool_call --tool write_file --simulate "approve,deny,deny"
go run ./cmd/fak route --aspect step --complexity high
go run ./cmd/fak routebench

The router is useful because it sits at the same point as the security floor. A write-shaped call can route to a guard ensemble. An easy read can route to a cheap model. A tenant-sensitive payload bound for a remote route is denied by the residency floor.

Read docs/model-routing.md and docs/integrations/litellm.md.

Benchmarks, In One Page

The benchmark rule is simple: every number must trace to BENCHMARK-AUTHORITY.md.

The numbers worth remembering:

guarddemo -selfcheck: frozen attack traces reproduce zero breaches behind fak.
WebVoyager geometry model: 8-worker fleet prefill is 1.10x less work than tuned per-agent KV (and 9.7x less than the naive re-prefill floor). This is modeled prefill-token work, separate from wall-clock.
50-turn x 5-agent Qwen2.5-1.5B authority row: 4.1x vs tuned warm-cache. Larger numbers are fenced as vs-naive.
vCache telemetry proofs above are provider-cache accounting proofs, separate from serving throughput claims.

Use vLLM or SGLang for raw token serving. Put fak on the agent boundary. Use it for policy and quarantine. Use it for audit, routing, and controlled reuse.

Install

From source:

go install github.com/anthony-chaudhary/fak/cmd/fak@latest

From a clone:

git clone https://github.com/anthony-chaudhary/fak
cd fak
go build -o fak ./cmd/fak

Go 1.26+ is required. With GOTOOLCHAIN=auto, Go can fetch the toolchain on first build. There are no external Go dependencies and no go.sum.

Prebuilt archives and container guidance are in INSTALL.md and GETTING-STARTED.md.

Build And Test

Run from the repository root:

go build ./cmd/fak
make test-fast
make ci

On native Windows, go build and go vet work normally, but native go test can be blocked by OS Application Control on freshly compiled test binaries. Use ./test.ps1 under WSL for the full suite on that host.

Boundaries

Token serving: use vLLM or SGLang for raw throughput. fak is the agent kernel around them.
Prompt injection: classifiers are useful, but policy carries the load.
Provider prompt caches: provider hits are rebates. Treat cache state as telemetry until you control the memory.
In-kernel model: the shipped path is a correctness/reference witness with real tests. Use a tuned serving stack for production throughput.
Dangerous tools: keep irreversible and exfil-shaped tools off the allow-list.

Docs Map

If you want...	Read
First real run	GETTING-STARTED.md
Claude Code / guard path	docs/integrations/claude.md
Codex	docs/integrations/openai-codex.md
MCP examples	examples/mcp
Policy manifests	POLICY.md
CLI verbs	docs/cli-reference.md
Security model	docs/fak/security.md
API reference	docs/fak/api-reference.md
vCache	docs/notes/VCACHE-VIRTUAL-API-CACHE-2026-06-24.md
Model routing	docs/model-routing.md
Benchmark authority	BENCHMARK-AUTHORITY.md
Honesty ledger	CLAIMS.md
Machine-readable map	llms.txt
Old README snapshot	docs/archive/README-2026-06-25-before-fresh-start.md

License: Apache-2.0.

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
a2ademo command Command a2ademo is a no-key, no-model proof of fak's in-kernel agent-to-agent message channel (internal/a2achan): one capability-floored, Ref-backed mailbox delivering an addressed value from one agent to another — adjudicated by the SAME default-deny floor that gates a tool call.	Command a2ademo is a no-key, no-model proof of fak's in-kernel agent-to-agent message channel (internal/a2achan): one capability-floored, Ref-backed mailbox delivering an addressed value from one agent to another — adjudicated by the SAME default-deny floor that gates a tool call.
agentdojoredteam command Command agentdojoredteam runs the dynamic AgentDojo-style red-team battery (internal/agentdojo) against the stacked defense and prints the PER-ATTACK verdict stream, then folds every outcome into a frozen harvest LabelRow corpus.	Command agentdojoredteam runs the dynamic AgentDojo-style red-team battery (internal/agentdojo) against the stacked defense and prints the PER-ATTACK verdict stream, then folds every outcome into a frozen harvest LabelRow corpus.
batchbench command Command batchbench measures the AGGREGATE decode throughput of the multi-user batched decode (internal/model.BatchSession) as a function of batch size B — the "continuous batching" / multi-user serving regime MODEL-BASELINE-RESULTS.md scoped out as "vLLM's claim, not fak's".	Command batchbench measures the AGGREGATE decode throughput of the multi-user batched decode (internal/model.BatchSession) as a function of batch size B — the "continuous batching" / multi-user serving regime MODEL-BASELINE-RESULTS.md scoped out as "vLLM's claim, not fak's".
causalbench command Command causalbench is the end-to-end demonstrator for fak's CAUSAL invalidation-on-external-write: a tool RESULT cached under an external world-state witness (a git commit / blob hash / etag) is evicted byte-exact — and only it — the moment a later external write REFUTES that witness, while every sibling cached under an unrefuted witness stays warm.	Command causalbench is the end-to-end demonstrator for fak's CAUSAL invalidation-on-external-write: a tool RESULT cached under an external world-state witness (a git commit / blob hash / etag) is evicted byte-exact — and only it — the moment a later external write REFUTES that witness, while every sibling cached under an unrefuted witness stays warm.
ctxbench command Command ctxbench runs the fak security gates over a corpus of tool calls and tool results.	Command ctxbench runs the fak security gates over a corpus of tool calls and tool results.
ctxdemo command Command ctxdemo is the live, on-box demo of fak's value in the MULTI-AGENT, MULTI-TURN, LONG-CONTEXT regime — the one where the context CHANGES every turn as tool calls land heterogeneous, variable-sized results.	Command ctxdemo is the live, on-box demo of fak's value in the MULTI-AGENT, MULTI-TURN, LONG-CONTEXT regime — the one where the context CHANGES every turn as tool calls land heterogeneous, variable-sized results.
ctxplanbench command Command ctxplanbench measures the ctxplan planned VIEW over REAL Claude Code session transcripts — the empirical counterpart to internal/ctxplan/scaling.go's synthetic Params model (issue #559).	Command ctxplanbench measures the ctxplan planned VIEW over REAL Claude Code session transcripts — the empirical counterpart to internal/ctxplan/scaling.go's synthetic Params model (issue #559).
ctxplandemo command Command ctxplandemo is the runnable demonstrator for the context PLANNER: it treats the current turn as an O(1) materialized VIEW over a lossless history store, and shows the three things that make that more than a slogan —	Command ctxplandemo is the runnable demonstrator for the context PLANNER: it treats the current turn as an O(1) materialized VIEW over a lossless history store, and shows the three things that make that more than a slogan —
cxlpooldemo command Command cxlpooldemo is a no-model, no-GPU proof of the value a SWITCH-POOLED, multi-host shared memory tier (a CXL.mem / CXL-switch pool) adds to fak's hardware-aware cache once a KV cache is shared across a FLEET of tenants — the multi-tenant counterpart of cmd/hwcachedemo's single-stream demote-not-evict proof.	Command cxlpooldemo is a no-model, no-GPU proof of the value a SWITCH-POOLED, multi-host shared memory tier (a CXL.mem / CXL-switch pool) adds to fak's hardware-aware cache once a KV cache is shared across a FLEET of tenants — the multi-tenant counterpart of cmd/hwcachedemo's single-stream demote-not-evict proof.
deletioncert command Command deletioncert is the end-to-end demonstrator for fak's provable-deletion receipt.	Command deletioncert is the end-to-end demonstrator for fak's provable-deletion receipt.
demorace command Command demorace is the live, on-box demo of fak's value point: REUSE.	Command demorace is the live, on-box demo of fak's value point: REUSE.
diagtok command Command diagtok is a throwaway diagnostic: it loads a GGUF via the same path simpledemo uses, then (1) round-trips a known string through the embedded tokenizer and (2) greedily decodes a ChatML prompt while printing each raw token id next to its decode.	Command diagtok is a throwaway diagnostic: it loads a GGUF via the same path simpledemo uses, then (1) round-trips a known string through the embedded tokenizer and (2) greedily decodes a ChatML prompt while printing each raw token id next to its decode.
dispatchworker command Command dispatchworker launches one DOS dispatch worker on a selected backend — the Go port of tools/dispatch_worker.py, compiled to a single binary so the supervisor (`dos loop --enact`, or the watchdog canary) spawns a worker WITHOUT a Python interpreter (and without the bare-`python` token that ENOENTs on a python3-only node — the #22 residual).	Command dispatchworker launches one DOS dispatch worker on a selected backend — the Go port of tools/dispatch_worker.py, compiled to a single binary so the supervisor (`dos loop --enact`, or the watchdog canary) spawns a worker WITHOUT a Python interpreter (and without the bare-`python` token that ENOENTs on a python3-only node — the #22 residual).
dropindemo command Command dropindemo is the splashy, on-box demo of fak's DISTRIBUTION story — the "drop-in" entry point.	Command dropindemo is the splashy, on-box demo of fak's DISTRIBUTION story — the "drop-in" entry point.
fak command Command fak is the Fused Agent Kernel: one statically-linked Go binary that runs an agentic tool loop where every tool call passes through one in-process policy and quarantine boundary (adjudicate -> vDSO -> pre-flight/grammar -> dispatch -> context-MMU admit).	Command fak is the Fused Agent Kernel: one statically-linked Go binary that runs an agentic tool loop where every tool call passes through one in-process policy and quarantine boundary (adjudicate -> vDSO -> pre-flight/grammar -> dispatch -> context-MMU admit).
fakchat command Command fakchat runs an end-to-end chat completion with fak's OWN in-kernel engine — no llama-server, no external proxy.	Command fakchat runs an end-to-end chat completion with fak's OWN in-kernel engine — no llama-server, no external proxy.
fanbench command Command fanbench runs the ONE-MASTER-GOAL → N-SUBAGENT fan-out sweep — the orchestrator-worker topology (one lead decomposes a goal, spawns N sub-agents, folds their results) swept from N=1 to N=1000+, the regime no public benchmark maps (see experiments/fanout/RESEARCH-BRIEF-fanout-2026-06-17.md).	Command fanbench runs the ONE-MASTER-GOAL → N-SUBAGENT fan-out sweep — the orchestrator-worker topology (one lead decomposes a goal, spawns N sub-agents, folds their results) swept from N=1 to N=1000+, the regime no public benchmark maps (see experiments/fanout/RESEARCH-BRIEF-fanout-2026-06-17.md).
fleetbench command Command fleetbench runs the 2-D turn-tax sweep — turns-per-agent (T) × fleet size (A) — over the REAL kernel and writes the surface as JSON + CSV for curve fitting.	Command fleetbench runs the 2-D turn-tax sweep — turns-per-agent (T) × fleet size (A) — over the REAL kernel and writes the surface as JSON + CSV for curve fitting.
fleetserve command Command fleetserve measures the CROSS-AGENT SHARED-PREFIX fleet workload — the regime where fak's kernel-owned KV cache structurally beats a per-slot serving engine (llama.cpp) by more than 2×, not by a faster kernel but by NOT REDOING WORK.	Command fleetserve measures the CROSS-AGENT SHARED-PREFIX fleet workload — the regime where fak's kernel-owned KV cache structurally beats a per-slot serving engine (llama.cpp) by more than 2×, not by a faster kernel but by NOT REDOING WORK.
gemma4diag command Command gemma4diag loads a gemma4 GGUF ONCE and sweeps the uncertain forward axes (softmax scale 1.0 vs 1/sqrt(d), rope_freqs on/off, decoder-norm plain vs (1+w)), printing the top-k next-token predictions for a fixed prompt under each.	Command gemma4diag loads a gemma4 GGUF ONCE and sweeps the uncertain forward axes (softmax scale 1.0 vs 1/sqrt(d), rope_freqs on/off, decoder-norm plain vs (1+w)), printing the top-k next-token predictions for a fixed prompt under each.
ggufprobe command Command ggufprobe dumps a GGUF file's architecture using fak's own internal/ggufload parser — no llama.cpp.	Command ggufprobe dumps a GGUF file's architecture using fak's own internal/ggufload parser — no llama.cpp.
glmdsatput command Command glmdsatput measures fak's NATIVE GLM-5.2 (glm_moe_dsa) decode throughput on a real compute backend (e.g.	Command glmdsatput measures fak's NATIVE GLM-5.2 (glm_moe_dsa) decode throughput on a real compute backend (e.g.
gpucheck command Command gpucheck is the real-model correctness witness for the GPU backend: it loads a HuggingFace safetensors checkpoint (e.g.	Command gpucheck is the real-model correctness witness for the GPU backend: it loads a HuggingFace safetensors checkpoint (e.g.
guarddemo command Command guarddemo is the live, on-box demo of fak's SAFETY FLOOR — the moat — shown as a TRUE side-by-side: the SAME adversarial tool-call trace replayed down two columns at once, WITHOUT fak (left) and WITH fak (right), so the divergence lands in one glance.	Command guarddemo is the live, on-box demo of fak's SAFETY FLOOR — the moat — shown as a TRUE side-by-side: the SAME adversarial tool-call trace replayed down two columns at once, WITHOUT fak (left) and WITH fak (right), so the divergence lands in one glance.
hwcachedemo command Command hwcachedemo is a no-model, no-GPU proof that fak's cache is hardware-aware: it shows the residency-tier ladder with each tier's physical character, which tiers can be shared ZERO-COPY, and — the headline — how the placement policy DEMOTES a hot KV prefix to CXL far memory under pressure instead of EVICTING it and paying a full re-prefill later.	Command hwcachedemo is a no-model, no-GPU proof that fak's cache is hardware-aware: it shows the residency-tier ladder with each tier's physical character, which tiers can be shared ZERO-COPY, and — the headline — how the placement policy DEMOTES a hot KV prefix to CXL far memory under pressure instead of EVICTING it and paying a full re-prefill later.
kpiprobe command Command kpiprobe prints the RSI loop's demo KPI — the deterministic LRU hit-rate (internal/rsiloop.HitRate) over a fixed reference trace — as a single `KPI=<float>` line the loop's worktree Measurer parses.	Command kpiprobe prints the RSI loop's demo KPI — the deterministic LRU hit-rate (internal/rsiloop.HitRate) over a fixed reference trace — as a single `KPI=<float>` line the loop's worktree Measurer parses.
lensviz command Command lensviz is a visual next-token debugger for fak's own in-kernel engine.	Command lensviz is a visual next-token debugger for fak's own in-kernel engine.
loadgen command loadgen drives an OpenAI-compatible /v1/chat/completions endpoint at a sweep of concurrency levels and reports throughput.	loadgen drives an OpenAI-compatible /v1/chat/completions endpoint at a sweep of concurrency levels and reports throughput.
longctxbench command Command longctxbench renders the EXACT, contention-free work floor for the ULTRA-LONG-CONTEXT regime (per-agent context > 100k tokens) — the proof that the fused agent kernel's reread-elimination win holds (and grows) where it matters most, computed as closed-form arithmetic from the session shape and the model geometry.	Command longctxbench renders the EXACT, contention-free work floor for the ULTRA-LONG-CONTEXT regime (per-agent context > 100k tokens) — the proof that the fused agent kernel's reread-elimination win holds (and grows) where it matters most, computed as closed-form arithmetic from the session shape and the model geometry.
memqdemo command Command memqdemo is a no-model, deterministic walkthrough of the memq memory- operation algebra: the substrate that lets an agent author its OWN memory strategy (render / clean / compact / dream / a novel one) instead of the kernel hardcoding a single compaction path.	Command memqdemo is a no-model, deterministic walkthrough of the memq memory- operation algebra: the substrate that lets an agent author its OWN memory strategy (render / clean / compact / dream / a novel one) instead of the kernel hardcoding a single compaction path.
modelbench command Command modelbench measures the in-kernel pure-Go forward pass latency so the fusion lane has a HONEST throughput baseline to set against the next-best ways to run the same model (HF transformers; see bench_hf.py for the witness side).	Command modelbench measures the in-kernel pure-Go forward pass latency so the fusion lane has a HONEST throughput baseline to set against the next-best ways to run the same model (HF transformers; see bench_hf.py for the witness side).
modelprof command Command modelprof is the in-kernel forward pass inspecting ITSELF: it runs the modular bottleneck profiler (internal/model/profile.go) over a real decode and a real prefill, plus an uninstrumented Session.Step decode measurement.	Command modelprof is the in-kernel forward pass inspecting ITSELF: it runs the modular bottleneck profiler (internal/model/profile.go) over a real decode and a real prefill, plus an uninstrumented Session.Step decode measurement.
paritybench command Command paritybench assembles the CROSS-MODEL parity artifact: it ingests the live fak-agent A/B reports for a ladder of LOCAL models (produced by tools/run_local_model.sh via the OpenAI-compatible shim) plus the committed FRONTIER reference cards (hosted Claude Haiku/Sonnet, measured + graded on the same frozen task), scores every card on the three never-blended axes (capability / safety / cost), and emits the parity table.	Command paritybench assembles the CROSS-MODEL parity artifact: it ingests the live fak-agent A/B reports for a ladder of LOCAL models (produced by tools/run_local_model.sh via the OpenAI-compatible shim) plus the committed FRONTIER reference cards (hosted Claude Haiku/Sonnet, measured + graded on the same frozen task), scores every card on the three never-blended axes (capability / safety / cost), and emits the parity table.
pipelinegen command Command pipelinegen runs fak's NATIVE engine generating tokens across pipeline-parallel stages — the runnable form of the cross-device transport contract (internal/model/pipeline.go).	Command pipelinegen runs fak's NATIVE engine generating tokens across pipeline-parallel stages — the runnable form of the cross-device transport contract (internal/model/pipeline.go).
poisonedmcpdemo command Command poisonedmcpdemo is the runnable A/B for issue #573: it proves fak walls a tool-poisoning MCP server off the model by STRUCTURE, with no model/key/network.	Command poisonedmcpdemo is the runnable A/B for issue #573: it proves fak walls a tool-poisoning MCP server off the model by STRUCTURE, with no model/key/network.
polymodelbench command bench.go is the measured-numbers half of polymodelbench — the runnable artifact for issue #535 ("bench(polymodel): measured numbers for the poly-model lane").	bench.go is the measured-numbers half of polymodelbench — the runnable artifact for issue #535 ("bench(polymodel): measured numbers for the poly-model lane").
prefixlint command Command prefixlint is the §A3 prefix-stability devtool (GLM52-HOSTED-CACHE- COHERENCE): it reads a recorded conversation and reports the provider-cache consequence — how many prompt tokens are cacheable across the session, how many are re-billed, the specific turn where the prefix broke, and the recoverable uplift from fixing volatile-ahead-of-stable ordering.	Command prefixlint is the §A3 prefix-stability devtool (GLM52-HOSTED-CACHE- COHERENCE): it reads a recorded conversation and reports the provider-cache consequence — how many prompt tokens are cacheable across the session, how many are re-billed, the specific turn where the prefix broke, and the recoverable uplift from fixing volatile-ahead-of-stable ordering.
q4kdiag command
q8bench command Command q8bench is an INDEPENDENT verifier for the int8-quantized in-kernel forward path (internal/model: Model.Quantize + Session.Quant).	Command q8bench is an INDEPENDENT verifier for the int8-quantized in-kernel forward path (internal/model: Model.Quantize + Session.Quant).