v0.7.0-rc.2 — unsigned macOS arm64 candidate

Personal AI Router 0.7.0-rc.2 — macOS Apple Silicon candidate

Release candidate for the JaredP94 fork. Unsigned and not notarized. Not a production-ready or NVIDIA-signed distribution. It targets macOS arm64 only; Windows, Linux desktop and Intel Mac packages are not included. Privileged-helper registration and automatic firewall setup stay unavailable in unsigned builds: instead of prompting, PAIR shows Firewall setup: manual guidance under Settings → Service.

It is the fork's Latest release, so 0.7.0-rc.1 installs are offered it through the in-app updater, and scripts/install-mac.sh installs it by default.

Upgrade notes

• Desktop 0.7.0-rc.2 ships service product 2.2.0. The relay envelope protocol stays v2, but some JSON-RPC methods were removed (six legacy telemetry settings methods, telemetry/check-update and telemetry/update), so upgrade desktop/TUI and services together.
• Settings migrate to schema 2. Tracing and content capture are turned off and must be re-enabled in Settings → Service; content capture requires explicit consent. Proxies no longer read PAIR_TELEMETRY_* / OTEL_* environment variables.
• Mixed clusters: an rc.1 node polls node-info without the new sampling header, which keeps upgraded nodes sampling their GPU every 2 seconds. Idle backoff applies once every node is upgraded.

Changes since 0.7.0-rc.1

Reliability

• Worker health: every worker answers a health check. The broker checks every 30 s, marks a worker degraded after 2 missed checks, and restarts eight workers that run no child processes after 3. Engine manager and the three proxies are never restarted automatically on a hang (crash recovery still applies); they show as "Not responding — restart manually". Optional workers whose first launch fails are retried, and missing binaries are reported as missing. Settings → Service and the terminal interface Overview show every worker's state, with Restart.
• A worker that stops reading its input no longer blocks the broker or the restart that would recover it.

Engines

• nvpair engine <engine> [args…] runs an installed engine's own command line without changing PATH.
• Engine manager reports what each engine supports (model list, download, delete, port change, install, uninstall); the desktop and terminal interface offer only those actions.
• oMLX counts as installed only when the command line PAIR runs exists (~/.omlx/bin/omlx, /opt/homebrew/bin/omlx or /usr/local/bin/omlx), so starting it no longer fails with "no such file or directory". Uninstall is offered only when it would remove that installation.
• Changing an engine's port keeps the rest of a custom engine override. A model download the engine rejects is reported as a failure.

Terminal interface

• Lists, downloads and deletes models, changes a local engine's port, updates an engine, starts, stops and installs engines on cluster peers, shows which node ran each workload, and confirms every destructive action.

GPU readings

• Each GPU reports its memory as dedicated, unified, shared or unavailable. Unknown readings show as "—" instead of 0, and charts leave gaps. Windows reports shared memory separately; Intel integrated GPUs on Macs are reported as shared. Linux AMD/Intel GPUs remain "Memory unavailable" (no new driver support).

Tracing and privacy

• Tracing is per node, local-only and off by default, with explicit consent for content capture, a loopback-only managed Phoenix pinned by digest, on-device trace storage size, and a confirmed Clear stored traces action. Serving nodes record nothing for peer-originated requests.

Idle work and protocol

• GPU sampling relaxes to 10 s when nothing needs fresh data, including tray-only sessions, while keeping the scheduler's 10 s freshness budget.
• The desktop validates relay envelopes the same way as the Go services, against a shared test corpus.

Packaging

• The app ships Chromium's LICENSES.chromium.html and Electron's license, and packaging fails if they are missing.

Full list: CHANGELOG.

Validation

Built from 99051fc3bf068f79e31e07f0ae32f619526a6e88 on a clean tree.

• On 8e5713e (before the last fixes): make check, dead-code, make licenses-check, installer tests, and go test -race in every Go module passed. Skipped: four engine-manager process-ownership tests (this Mac cannot resolve which process owns a port) and one test needing a live oMLX engine.
• Later fixes (#10–#15) each passed make check, dead-code and the race suites of the modules they changed; make check and dead-code passed again before the release build.
• Package checks:
  • The app reports 0.7.0-rc.2, and all 14 service binaries report their services/versions.json versions and are arm64-only.
  • LICENSE, THIRD_PARTY_NOTICES.md and the Electron/Chromium license files are byte-identical to their sources.
  • The DMG checksum is valid, and the app inside the DMG and the ZIP is identical to the built bundle.
  • The update feed points at this fork.
  • Code signing is ad-hoc only.
• Same-artifact evidence: no source file changed between the upgrade-tested and profiled build (86214bd) and this one (only docs). The bundles differ only in 16 Go binaries (14 services, collectlogs, inference-dispatcher), which embed the source commit and build time, and the two manifests recording build metadata; the services source fingerprint (73c1e004…) is unchanged.
• Upgrade: a backed-up macOS arm64 machine in a live three-node cluster was upgraded from rc.1 to the 86214bd build with scripts/install-mac.sh --dmg. It kept its node ID and cluster membership, migrated settings (tracing off), started all 12 workers, and its oMLX engine started. It was then restored to rc.1.
• Profiling: about 30 sandboxed launches of rc.2 and of rc.1 (with only its privileged-helper control tool removed so it skips its first-launch dialog) each quit cleanly with no leftover processes. Tray-only and Overview profiles show CPU and memory in line with rc.1; package idle wakeups rose from about 0.4 to 2.3 per second (cause not established). See Performance and energy. No percentage improvement is claimed.

Assets

NVPAIR-Setup-0.7.0-rc.2-arm64.dmg and .zip with their blockmaps, service-binaries-mac-arm64.zip (the packaged service binaries), SHA256SUMS, and the macOS update feeds latest-mac.yml / latest-arm64-mac.yml.

Not validated

• Windows, Linux desktop and Intel Mac runtime; Windows worker-hang recovery, GPU readings and nvpair engine console behaviour.
• Inference through the packaged candidate, tracing-enabled profiling, and profiling of a clustered node with engines.
• Fresh install on a new machine, uninstall, purge, and corrupt- or interrupted-download handling of this build.
• Apple trust: no Developer ID signing or notarization; Gatekeeper may block first launch.
• macOS may stop answering LAN connections after a long time unclustered (known issue; restart PAIR).