October23 verification: see current readiness package. No real GPU or public alpha validation is claimed.

Untracked pod names are not ownership: watchdog now audits instead of deleting untracked prefix matches. GPU private experiments use a separate reviewed gate; keep public beta and Stripe disabled. Worker traces exclude prompts/results/credentials; vLLM request logging and optional usage telemetry are disabled in the proposed launcher. Remote TLS/OIDC, key rotation, image/dependency security review and restore drills remain required.

API keys are random 256-bit secrets, displayed once, stored only as prefix plus HMAC-SHA256 keyed digest, immediately revocable. Cookie sessions are HttpOnly/SameSite strict, Secure outside development; CSRF token required for dashboard mutations. Production uses an authorization-code flow with PKCE, signed state and nonce cookies, then verifies RS256 identity tokens against configured JWKS, issuer, audience, nonce and expiry. Local email login and credit seed must never be enabled on a public deployment.

All resource reads/actions use tenant predicates; other tenant IDs return 404. Worker credentials are separate, hashed, scoped to internal routes and expire hourly; old epochs cannot finalize. Worker bootstrap secret must be tightly controlled and rotated. Job payloads/results and webhook secrets are Fernet encrypted; versioned encryption keys support staged re-encryption independently of session signing and credential HMAC keys. See the audit remediation guide for the rotation procedure. Configure TLS, encrypted disks/backups and DB least privilege; migrations use a separate role. Do not give the application role rights to drop ledger triggers.

Webhooks only use HTTPS port 443; public DNS/IP validation, registration IP pinning, direct IP connection with original Host/TLS SNI, no proxies or redirects, and retry limits mitigate SSRF and rebinding. Infrastructure egress rules should additionally deny internal/metadata ranges. DNS changes require re-registration. Test real TLS and egress paths before launch.

Body size is enforced from streamed bytes, message and token caps apply, tenant queue/concurrency caps protect workers, and API keys and dashboard sessions share a PostgreSQL-backed fixed-window limit of 120 authenticated requests per tenant per minute across replicas. Logs contain request ID/method/status only; never prompts, outputs, headers, keys or Stripe details. vLLM logs require independent redaction/disablement. Content purge runs every scheduler tick after 7-day retention; minimum financial metadata remains.

Threats: stolen keys -> revocation/quotas; cross-tenant access -> predicates/tests; duplicate executions -> fencing/unique accounting; payment replay -> signature+session/intent dedupe; SSRF -> pinned public destination; GPU billing leak -> watchdog/provider limits; untrusted model code -> curated pinned tokenizer/weights, trust_remote_code=false. No arbitrary models, shell code, tools or external fetching.

Before limited public beta: external OIDC integration validation, independent penetration/security review, terms/AUP/privacy, prepaid/refund/tax review, model license attribution, GPU provider processing disclosure, backup restore drill, worker credential renewal, monitored billing_pending reconciliation and real TLS webhook tests. No compliance certification is claimed.

Production startup rejects default/weak worker bootstrap credentials, missing metrics credentials, missing independent credential HMAC keys, and missing versioned encryption keys. Public dashboard proxying is restricted to customer and authentication routes; worker/Stripe/metrics routes require a separate ingress path. Keep Stripe's signature-verified webhook reachable only at its explicitly configured API URL. Metrics require their own bearer secret. GPU worker containers receive no control-plane database/payment/signing/encryption/provider secrets.

Worker generations fence restarts. Heartbeats renew only explicitly listed active request IDs and epochs. Worker enrollment and dispatch check repository, immutable revision, tokenizer revision and execution mode. The revision-derived served-model alias is verified by the engine adapter. GPU hosts and the process that launches vLLM remain trusted: this is configured identity checking, not hardware attestation or proof that a malicious model server loaded specified weights.