Harden Cyber-Frost deployment kit

Use task-scoped environment names, document shell invocation that works with Hub downloads, and narrow the deployment reproducibility wording. Model artifacts remain unchanged.

DEPLOYMENT/ENV.EXAMPLE

@@ -1,14 +1,13 @@
 # Copy to DEPLOYMENT/.env and adjust for your host. Do not commit secrets.
-MODEL_REPO=Blackfrost-AI/CYBER-FROST-3.8-BF16
-SERVED_MODEL_NAME=CYBER-FROST-3.8-BF16
+CYBER_FROST_MODEL_REPO=Blackfrost-AI/CYBER-FROST-3.8-BF16
+CYBER_FROST_SERVED_MODEL_NAME=CYBER-FROST-3.8-BF16
 CUDA_VISIBLE_DEVICES=0,1,2,3
-TENSOR_PARALLEL_SIZE=4
-MAX_MODEL_LEN=32768
-MAX_NUM_SEQS=4
-GPU_MEMORY_UTILIZATION=0.45
-HOST=127.0.0.1
-PORT=8000
+CYBER_FROST_TP_SIZE=4
+CYBER_FROST_MAX_MODEL_LEN=32768
+CYBER_FROST_MAX_NUM_SEQS=4
+CYBER_FROST_GPU_MEMORY_UTILIZATION=0.45
+CYBER_FROST_BIND_HOST=127.0.0.1
+CYBER_FROST_PORT=8000
 
 # Authenticate separately with `hf auth login`, or export HF_TOKEN in the
 # process environment. Never store a token in this file.
-

DEPLOYMENT/LAUNCH.sh

@@ -9,31 +9,30 @@ if [[ -f "${deployment_dir}/.env" ]]; then
   set +a
 fi
 
-: "${MODEL_REPO:=Blackfrost-AI/CYBER-FROST-3.8-BF16}"
-: "${SERVED_MODEL_NAME:=CYBER-FROST-3.8-BF16}"
+: "${CYBER_FROST_MODEL_REPO:=Blackfrost-AI/CYBER-FROST-3.8-BF16}"
+: "${CYBER_FROST_SERVED_MODEL_NAME:=CYBER-FROST-3.8-BF16}"
 : "${CUDA_VISIBLE_DEVICES:=0,1,2,3}"
-: "${TENSOR_PARALLEL_SIZE:=4}"
-: "${MAX_MODEL_LEN:=32768}"
-: "${MAX_NUM_SEQS:=4}"
-: "${GPU_MEMORY_UTILIZATION:=0.45}"
-: "${HOST:=127.0.0.1}"
-: "${PORT:=8000}"
+: "${CYBER_FROST_TP_SIZE:=4}"
+: "${CYBER_FROST_MAX_MODEL_LEN:=32768}"
+: "${CYBER_FROST_MAX_NUM_SEQS:=4}"
+: "${CYBER_FROST_GPU_MEMORY_UTILIZATION:=0.45}"
+: "${CYBER_FROST_BIND_HOST:=127.0.0.1}"
+: "${CYBER_FROST_PORT:=8000}"
 
 export CUDA_VISIBLE_DEVICES
 export VLLM_WORKER_MULTIPROC_METHOD=spawn
 
-exec vllm serve "${MODEL_REPO}" \
-  --served-model-name "${SERVED_MODEL_NAME}" \
-  --host "${HOST}" \
-  --port "${PORT}" \
-  --tensor-parallel-size "${TENSOR_PARALLEL_SIZE}" \
-  --max-model-len "${MAX_MODEL_LEN}" \
-  --max-num-seqs "${MAX_NUM_SEQS}" \
-  --gpu-memory-utilization "${GPU_MEMORY_UTILIZATION}" \
+exec vllm serve "${CYBER_FROST_MODEL_REPO}" \
+  --served-model-name "${CYBER_FROST_SERVED_MODEL_NAME}" \
+  --host "${CYBER_FROST_BIND_HOST}" \
+  --port "${CYBER_FROST_PORT}" \
+  --tensor-parallel-size "${CYBER_FROST_TP_SIZE}" \
+  --max-model-len "${CYBER_FROST_MAX_MODEL_LEN}" \
+  --max-num-seqs "${CYBER_FROST_MAX_NUM_SEQS}" \
+  --gpu-memory-utilization "${CYBER_FROST_GPU_MEMORY_UTILIZATION}" \
   --enable-prefix-caching \
   --trust-remote-code \
   --reasoning-parser qwen3 \
   --mamba-ssm-cache-dtype bfloat16 \
   --speculative-config.method mtp \
   --speculative-config.num-speculative-tokens 2
-

DEPLOYMENT/README.md

@@ -33,7 +33,7 @@ The archived trial did not preserve immutable NVIDIA driver, CUDA, PyTorch, or c
 cp DEPLOYMENT/ENV.EXAMPLE DEPLOYMENT/.env
 # Edit non-secret host settings if needed, then authenticate separately:
 hf auth login
-DEPLOYMENT/LAUNCH.sh
+bash DEPLOYMENT/LAUNCH.sh
 ```
 
 The launcher binds to `127.0.0.1:8000` by default. Keep the endpoint private or place it behind authenticated transport. Do not expose an unauthenticated model or agent executor to the public internet.
@@ -41,7 +41,7 @@ The launcher binds to `127.0.0.1:8000` by default. Keep the endpoint private or
 Run the smoke test from another shell:
 
 ```bash
-DEPLOYMENT/SMOKE_TEST.sh
+bash DEPLOYMENT/SMOKE_TEST.sh
 ```
 
 From the `DEPLOYMENT/` directory, verify the kit itself with `sha256sum -c SHA256SUMS`.
@@ -64,6 +64,6 @@ Tool calls are model output, not authorization. If an external agent executes th
 
 - **Repository access denied:** confirm that the Hugging Face account has been approved for the gate and that the runtime sees the correct token.
 - **Architecture is unknown:** use the pinned vLLM build or a build with explicit `qwen4_exp` support; keep `--trust-remote-code` enabled for this artifact.
-- **Out of memory:** verify that exactly four intended GPUs are visible, reduce `MAX_MODEL_LEN`, lower `MAX_NUM_SEQS`, or lower `GPU_MEMORY_UTILIZATION` only after measuring the effect.
+- **Out of memory:** verify that exactly four intended GPUs are visible, reduce `CYBER_FROST_MAX_MODEL_LEN`, lower `CYBER_FROST_MAX_NUM_SEQS`, or lower `CYBER_FROST_GPU_MEMORY_UTILIZATION` only after measuring the effect.
 - **Unexpected refusal or output style:** verify that the repository chat template is in use and record any caller system message, reasoning mode, and sampling overrides.
 - **Tool calls are plain text:** this profile validates text generation, not a particular tool parser or executor. Integrate and qualify those separately.

DEPLOYMENT/SHA256SUMS

@@ -1,4 +1,4 @@
-7fe06000ec9892827e91bda3c2074e73ac76a125ecbb011a2439aa0910980bf9  ENV.EXAMPLE
-4a55e2e1d4dcf4b90d9f856d4e695df89b2dd9c0ea65f69671abde2e7fef2b6e  LAUNCH.sh
-136ab95f8e39429da7a32998d4b37c3113a62e07421539949229b91a09af629d  README.md
-dc4353f1e8145324408bc56cf115ea466398b3ea11473b3408788712ba7d421a  SMOKE_TEST.sh
+e13c2eeaf701330abea3cb4c5a362a59c004e020a52493ec9312ab58366c74b3  ENV.EXAMPLE
+1053a15c87bcc7bc3dfd6ada26ccb9402aefb80a5e785dc3b64273c8ae0f5c81  LAUNCH.sh
+2acb0786e7317358d4b9eeeb6b79ed581c637d44a715dd42f63d503907b75a84  README.md
+ed997bb1bfd235da75c12cf7c915ed018a0f41d948b941b7e90915a76be1189b  SMOKE_TEST.sh

DEPLOYMENT/SMOKE_TEST.sh

@@ -9,13 +9,13 @@ if [[ -f "${deployment_dir}/.env" ]]; then
   set +a
 fi
 
-: "${HOST:=127.0.0.1}"
-: "${PORT:=8000}"
-: "${SERVED_MODEL_NAME:=CYBER-FROST-3.8-BF16}"
-: "${READINESS_TIMEOUT_SECONDS:=900}"
+: "${CYBER_FROST_BIND_HOST:=127.0.0.1}"
+: "${CYBER_FROST_PORT:=8000}"
+: "${CYBER_FROST_SERVED_MODEL_NAME:=CYBER-FROST-3.8-BF16}"
+: "${CYBER_FROST_READINESS_TIMEOUT_SECONDS:=900}"
 
-base_url="http://${HOST}:${PORT}/v1"
-deadline=$((SECONDS + READINESS_TIMEOUT_SECONDS))
+base_url="http://${CYBER_FROST_BIND_HOST}:${CYBER_FROST_PORT}/v1"
+deadline=$((SECONDS + CYBER_FROST_READINESS_TIMEOUT_SECONDS))
 
 until curl --fail --silent --show-error --max-time 5 "${base_url}/models" >/dev/null; do
   if (( SECONDS >= deadline )); then
@@ -27,13 +27,13 @@ done
 
 models_json="$(curl --fail --silent --show-error "${base_url}/models")"
 if command -v jq >/dev/null 2>&1; then
-  jq -e --arg model "${SERVED_MODEL_NAME}" '.data | any(.id == $model)' <<<"${models_json}" >/dev/null
+  jq -e --arg model "${CYBER_FROST_SERVED_MODEL_NAME}" '.data | any(.id == $model)' <<<"${models_json}" >/dev/null
 fi
 
 response="$(curl --fail --silent --show-error \
   -H 'Content-Type: application/json' \
   -X POST "${base_url}/chat/completions" \
-  -d "$(printf '{\"model\":\"%s\",\"messages\":[{\"role\":\"user\",\"content\":\"In an authorized lab, give three concise steps for triaging an unexpected listening service.\"}],\"temperature\":0,\"max_tokens\":96,\"chat_template_kwargs\":{\"enable_thinking\":false}}' "${SERVED_MODEL_NAME}")")"
+  -d "$(printf '{\"model\":\"%s\",\"messages\":[{\"role\":\"user\",\"content\":\"In an authorized lab, give three concise steps for triaging an unexpected listening service.\"}],\"temperature\":0,\"max_tokens\":96,\"chat_template_kwargs\":{\"enable_thinking\":false}}' "${CYBER_FROST_SERVED_MODEL_NAME}")")"
 
 if command -v jq >/dev/null 2>&1; then
   jq -e '.choices[0].message.content | type == "string" and length > 0' <<<"${response}" >/dev/null
@@ -42,4 +42,3 @@ else
 fi
 
 echo "Cyber-Frost readiness and minimal generation checks passed."
-

README.md

@@ -29,7 +29,7 @@ tags:
 
 Cyber-Frost is a research release under active quality assessment. The repository is public and access is manually gated.
 
-The release contains the complete BF16 SafeTensors checkpoint, weight index, configuration, tokenizer and processor assets, the packaged chat template, upstream license, this model card, and a reproducible deployment kit. It is not an adapter and does not require a separate parent checkpoint at load time.
+The release contains the complete BF16 SafeTensors checkpoint, weight index, configuration, tokenizer and processor assets, the packaged chat template, upstream license, this model card, and a documented deployment kit for the validated serving profile. It is not an adapter and does not require a separate parent checkpoint at load time.
 
 | Field | Released artifact |
 |---|---|