Panel macOS

Panel macOS

Use the native macOS screens to inspect platform support, install and control services, estimate unified-memory needs, review network and storage roles, and inspect power or crash evidence. They are server-rendered and work without browser scripting. The pages describe macOS capabilities when viewed from another operating system; this does not prove that physical hardware was qualified.

Set up the Panel and serve with Metal

1. Open macOS platform (/rust/macos) and inspect Feature availability. Confirm that the host reports macOS; the reference target is an Apple Silicon Mac.
2. Open macOS install & services (/rust/macos/install). Install with lexipanel-installer macos-install, then inspect the user service status with lexipanel-service panel status. Installation does not require a package manager, but signing and notarization are separate tasks.
3. Open macOS engines (/rust/macos/engines). Select the Metal-capable runtime; ensure the executable is installed and its recorded SHA-256 checksum is verified. A runtime without a matching checksum must not be promoted active.
4. Open the Models page and select a compatible local GGUF file. Configure an instance to use that file and the Metal-capable runtime on the Instances page. The model path must be absolute and the file must exist.
5. Open macOS unified memory (/rust/macos/memory). Review current pressure, swap, required memory and the safe wired limit ceiling. The planner is an estimate, not a hardware benchmark.
6. Open Set up Metal serving (/rust/macos/setup) as an administrator. The guided task now has a separate Check instance readiness step before Confirm service startup. Select the currently active Instance ID and choose Check readiness to verify host, runtime, checksum, instance engine and local model. A failure blocks start; the check itself does not change state.
7. Tick the confirmation box and choose Start serving. The action uses the same instance-control route as the existing start control. Review the returned result and check instance health from the Engines page; a successful dispatch is not independent proof of a healthy service.
8. To undo the start, return to Set up Metal serving, confirm, and choose Stop serving (undo). This uses the normal instance stop route. The guided task entry macos.serve-metal also describes these steps.

The installation screen also documents lexipanel-service panel start|stop|restart|status|logs and lexipanel-service instance <id> start|stop|restart|status|logs. Those commands are instructions, not actions automatically run by visiting the page.

Memory changes

On macOS unified memory, view the current model and context plan before changing a limit. Administrators see Apply recommended limit and Restore previous limit only when the host supports the planner and it returns a plan. Supply Wired limit (MiB) as an integer, optionally check Reapply this limit after reboot (opt in), then check the confirmation box and choose Apply wired limit. A change outside the validated host or plan ceiling is rejected. To undo a successful application, confirm and choose Revert wired limit; the privileged helper attempts to restore the previous recorded value and persistence preference. Viewers do not see the forms.

Network and storage

On macOS network, storage and fleet (/rust/macos/network), the Network inventory table displays detected ports and interfaces. Network mutation is deliberately unavailable because backup and automatic commit-confirm rollback are not yet provided. Peer discovery is off by default; use Discover peers (JSON) for the opt-in read-only request GET /api/macos/network?bonjour=1.

Administrators may use Mount storage role or Unmount storage role. Enter Role, Kind (nfs or smb), Server, NFS export or SMB share, and Mountpoint. SMB configuration can also require SMB username, SMB domain and SMB password. The Mount read-only checkbox requests a read-only mount. Check the confirmation box before pressing the form submit control. The server verifies allowed roles, dedicated mountpoint layout and active-instance blockers; it then delegates to a narrowly scoped privileged helper. Missing or invalid settings produce errors, not a success result. Unmount also refuses any role still used by a running instance.

Telemetry

Open macOS telemetry (/rust/macos/telemetry) to inspect CPU, graphics, thermal, battery and memory signals when they are supported. Job sleep prevention shows whether scoped assertions are available; visiting the page never creates one. Panic and crash reports lists report metadata, not report contents. Probe warnings and unavailable sensors are shown without inventing a measurement.

API routes

These screens use their existing owners, with no duplicate API handlers:

HTTP route	Screen	Behavior
GET /api/macos/platform	macOS platform	Host and target feature matrix
GET /api/macos/engines	macOS engines	Runtime inventory and checksum status
GET /api/macos/install	macOS install & services	Installation and service availability
GET /api/macos/memory	macOS unified memory	Read-only pressure and fit estimate
POST /api/macos/memory	macOS unified memory	Confirmed apply or revert using the helper
GET /api/macos/network	macOS network, storage and fleet	Read-only ports, interfaces, storage and optional discovery
POST /api/macos/network	macOS network, storage and fleet	Confirmed storage mount/unmount; network apply refused
GET /api/macos/telemetry	macOS telemetry	Read-only monitoring and diagnostic metadata

The setup control also reads /api/macos/platform, /api/macos/engines, /api/macos/memory and /api/instances; start and undo call POST /api/start and POST /api/stop for the selected instance. Only administrators may use these controls.

Control reference

Each marker below comes from the live feature registry and uses the same tooltip sentence.

Control	Help text	Screen
macOS platform (macos.platform)	Shows platform support, installation paths and limits; this view changes no settings.	/rust/macos
Feature availability (macos.feature-matrix)	Shows which platform features are available and explains unsupported features.	/rust/macos
macOS engines (macos.engines)	Checks installed inference runtimes, Metal support and the verified checksum before use.	/rust/macos/engines
Managed MLX pins (macos.engine-pins)	Displays versions pinned for the managed runtime; viewing these does not install software.	/rust/macos/engines
macOS install & services (macos.install)	Shows installer and service commands; copying these commands does not run them.	/rust/macos/install
Service inventory (macos.install-status)	Shows which service and helper components are installed; no service is started by viewing the status.	/rust/macos/install
macOS unified memory (macos.memory)	Shows memory pressure, swap and a model-fit estimate for shared system and graphics memory.	/rust/macos/memory
Wired limit (MiB) (macos.wired-limit)	Sets the requested graphics working-set limit in MiB; the server rejects values outside the safe range.	/rust/macos/memory
Reapply this limit after reboot (opt in) (macos.wired-persistent)	Opt in to restoring this graphics memory limit automatically after the next reboot.	/rust/macos/memory
Confirm wired limit change (macos.wired-confirm)	Confirms that the privileged memory change or restore is intentional; the box is required.	/rust/macos/memory
Apply wired limit (macos.wired-apply)	Applies a confirmed GPU memory limit using the privileged helper; optional persistence survives reboot.	/rust/macos/memory
Revert wired limit (macos.wired-revert)	Restores the previously recorded GPU memory limit and its persistence setting.	/rust/macos/memory
Network inventory (macos.network)	Displays network ports and addresses without changing connectivity.	/rust/macos/network
Storage role parameters (macos.storage-parameters)	Choose the role, share type, server and mountpoint for the storage action; invalid paths are rejected.	/rust/macos/network
Mount read-only (macos.storage-readonly)	Mounts the selected share without permitting writes when checked.	/rust/macos/network
Confirm storage change (macos.storage-confirm)	Requires explicit approval before the privileged helper mounts or unmounts a storage role.	/rust/macos/network
Mount storage role (macos.storage-mount)	Mounts a reviewed storage share through the privileged helper; active roles cannot be replaced.	/rust/macos/network
Unmount storage role (macos.storage-unmount)	Unmounts a confirmed storage role only when no running instance uses it.	/rust/macos/network
Fleet member (macos.fleet)	Explains optional local discovery and fleet integration; discovery is off by default.	/rust/macos/network
Discover peers (JSON) (macos.discovery)	Runs an opt-in peer discovery read and shows its network inventory response without changing settings.	/rust/macos/network
macOS telemetry (macos.telemetry)	Shows available processor, graphics, temperature, power and crash-report metadata without changing them.	/rust/macos/telemetry
Job sleep prevention (macos.sleep)	Shows whether running jobs can prevent system sleep; this page creates no sleep assertion.	/rust/macos/telemetry
Panic and crash reports (macos.crashes)	Lists diagnostic-report metadata only; report contents remain unopened.	/rust/macos/telemetry
Instance ID (macos.setup-instance)	Selects the currently active instance; starting or stopping a different instance is refused.	/rust/macos/setup
Confirm service change (macos.setup-confirm)	Confirms that an administrator intends to start or stop the selected instance's service.	/rust/macos/setup
Check readiness (macos.setup-check)	Checks host, verified runtime, selected instance and local model before startup without changing state.	/rust/macos/setup
Start serving (macos.setup-start)	Requests the selected instance to start only after Metal runtime and model checks succeed.	/rust/macos/setup
Stop serving (undo) (macos.setup-stop)	Requests the selected instance to stop; it does not remove saved models or configuration.	/rust/macos/setup
Set up Metal serving (macos.serve-metal)	Guides an administrator through installation, model selection, verified Metal serving and rollback.	/rust/macos/setup

Native VM hosting and engine backend preference (G2-13)

The Linux KVM guest supervisor is not a macOS or Windows facility. On those hosts the Panel's VM controls and guided VM help registry are not available; there is no VM start, stop, guest configuration, VFIO selection, or console control. Requests to the existing /api/system/vms route family and the VM guide API receive HTTP 409, with a reason derived from the platform feature matrix (or the explicit KVM-only fallback when the matrix does not yet list VMs). The global System navigation and its subsection bar now omit VM hosting on systems without the virtual machines feature; the Linux KVM link is retained. Direct links to the classic VM hosting page display the unavailability reason without exposing any guest action forms. VM support on macOS would require a separately designed non-KVM supervisor, not an emulation of VFIO.

On Apple Silicon, the Panel prefers Metal over CPU only when an installed engine advertises a Metal backend and a usable Metal device. On Intel macOS, or if a Metal device is not reported, CPU remains preferred. An explicit user backend choice is never silently replaced. The launch planner does not double count Metal's reported unified GPU memory as separate VRAM; its macOS preflight also consults the existing pressure-aware unified-memory planner. This is a lower-bound preflight: the Engine must still admit its actual model, KV cache, and scratch allocation. Applying or reverting a wired-memory limit remains an explicit administrator action on the unified-memory page.

Metal GGUF preflight and limitations (G3-08)

The engine now has a bounded, read-only GGUF tensor index preflight for dense Qwen3 metadata. On Apple Silicon macOS, an explicit lexi-engine serve -m model.gguf --backend metal --memory-plan can report a lower bound comprising serialized GGUF weights and full-capacity F32 K/V storage. This is diagnostic output only: it does not allocate a device buffer, start an HTTP listener, or certify that the model can run.

The preflight recognizes F32, F16, Q4_0 and Q8_0 tensor storage. Its no-copy eligibility markers are only candidates; the low-level Metal importer rechecks the actual mapping and device. The native Metal weight importer accepts retained, sealed memory mappings, validates all tensor ranges and names before allocating, and frees all allocations if loading stops early. Separately, the Apple tuning code computes page-envelope allocation lengths, per-slot F32 KV reservations and required graph scratch against observed physical/available/wired memory and the Metal recommended working set. It never treats unified GPU memory as additional physical RAM. A model's actual working-set peak, pressure, and runtime memory reservations must be supplied before an admission result can be used for serving.

End-to-end serving remains unavailable in this packet. There is no registered native Metal DeviceModelRuntime with an executable full-model transformer, native attention/KV ownership and sampling. Therefore no GGUF architecture is currently qualified for end-to-end Metal serving—not even Qwen3, which is the preflight-only architecture. Normal --backend metal startup reports this missing runtime and does not silently run the CPU or open a listener. The server's dependency and registration wiring also requires a separately owned manifest/feature update; the lower- level Metal kernels alone do not provide a working inference service. The Panel must continue to gate "Start serving" on actual compiled, loaded backend support and should offer CPU or an explicitly chosen qualified engine as alternatives.

Portability checks

The repository's macos.yml checks both the Panel and Engine workspaces for aarch64-apple-darwin and x86_64-apple-darwin, then builds and tests both workspaces on the native macOS runner. windows.yml performs locked MSVC checks for both workspaces on windows-latest. These workflows are compilation checks, not GPU or end-to-end serving qualification. The Windows and macOS jobs depend on the shared portable OS foundation being merged into their baseline first; a green check cannot be assumed from these source changes.