Three very different agent workloads – an interactive cognitive cockpit, an agile software-engineering environment, and an autonomous long-horizon factory – each paired with the framework and open-weight model whose architecture fits the workload’s cost model. Because the smallest viable pair of models already exceeds the 32 GB ceiling, the design is built on strict single-residency: exactly one model resident, a tier switch swaps it.
Design & operator setuparchitecture and fit measured · throughput and swap cost stated as falsifiable criteria
One card. Three workloads.
One model for everything is the wrong optimisation.
Reasoning, repo-scale coding, and unattended automation reward three different architectural properties – and at Q4, no two of the relevant models fit together in 32 GB.
The temptation with a capable local card is to run one large model for everything. That is the wrong optimisation: reasoning-heavy research, repository-scale software engineering, and unattended long-horizon automation reward three different architectural properties, and paying for all of them at once wastes both VRAM and latency. The constraint that shapes everything is memory – at Q4, the relevant open-weight models occupy 15–24 GB each, so no two fit together on 32 GB. The design therefore does not co-locate models; it time-multiplexes a single resident model across three tiers, and spends its engineering budget on choosing the right model per tier and making the swap between them cheap and safe.
The setup operates against three strands of the systems literature: paged-attention local serving and the memory-bandwidth wall, model routing (send each query to the cheapest model that can answer it – here routed across time on one card rather than across a fleet), and the cold-start problem of serverless LLM serving, whose checkpoint-loading latency this design does not solve in general but budgets, honestly. The contribution is not a new serving system: it is a disciplined operator composition a solo operator can actually run and reason about on commodity hardware.
Three tiers, matched to the workload.
Each tier pairs a workload with the agent framework and the open-weight model class whose architecture fits it. Only one model is resident at a time; a tier switch swaps it.
Pick the architecture whose cost model the workload can pay – and never spend VRAM or latency on a property the tier does not use.
Any single model fits.
No two fit together.
The fit envelope that forces the design – and the swap cost it incurs, named honestly rather than elided.
Two honest constraints remain. There is no true cross-tier parallelism: an unattended Tier-3 job holds the card, so interactive work waits unless the operator schedules around it. And CUDA memory fragmentation accumulates over repeated load/unload cycles – free contiguous VRAM must be monitored and the server restarted periodically.
Weights set the floor.
The rest is context budget.
Two numbers decide whether a tier is usable: how fast it generates, and how much context it can hold – and the second constrains the design more than model size suggests.
Two consequences follow. Generation is memory-bandwidth-bound: an MoE that reads only ~3B active weights per token sustains 2–4× the token rate of a dense model of similar total size – exactly why the coding and allrounder tiers use MoE, and why the dense reasoning model is slowest per token. And the earlier “fits with headroom” is refined: every model fits, but usable context per tier differs sharply.
Five acceptance criteria, A1–A5.
A design & operator setup, not a measured benchmark study – so its central claims are stated as falsifiable acceptance criteria with instruments and thresholds, in the same measured/predicted discipline as the companion papers. Thresholds marked [proposed] are defaults offered for confirmation.
The workstream hypothesis: single-residency time-multiplexing serves three model tiers in 32 GB without VRAM collision, at a bounded and manageable swap cost. All five criteria run on the same single-GPU, air-gapped setup plus the evaluation harness already in the program.
Safety is verified, not assumed.
The highest-risk tier is Tier 3: an unattended, long-horizon, high-privilege autonomous agent – and for the chosen tooling the risk is not hypothetical. OpenClaw’s rapid rise came with a severe, documented security record: a critical remote-code-execution flaw via an unvalidated local WebSocket, a chained set of sandbox-escape and privilege-escalation vulnerabilities (“Claw Chain”, allowlist bypass rated CVSS 8.8), and a marketplace supply-chain problem – an independent audit found 341 malicious entries among 2,857 skills. Safety is therefore a cross-cutting requirement, applied most stringently where autonomy and privilege are highest, and verified – not assumed – by criterion A5.
The three-tier design is safe to run only to the extent that the isolation layer is real – the convenience of an autonomous background agent is exactly proportional to the discipline of the sandbox around it.
Three workloads, one card, sovereign.
- Situation. An independent ML operator needs an interactive research assistant, a repository-scale coding agent, and an unattended overnight automation agent – with one 32 GB card, a data-sovereignty constraint, and no budget for a multi-GPU rig or per-workload cloud subscriptions.
- Task. Run all three on the single card, each with a model whose architecture fits its cost, without VRAM collisions, with predictable switch latency, and with the unattended agent safely contained.
- Action. Configure strict single residency; assign DeepSeek-R1/Gemma4 to Tier 1, qwen3-coder to Tier 2, Devstral to Tier 3; keep the most-used tier warm; budget context per tier under a q8_0 KV cache; run every model-driven action inside the hardened, network-less sandbox.
- Result. Three capable agent workloads from one commodity card – swapped rather than co-loaded, at a switch cost the operator can plan around, with an automation tier whose safety rests on a verified isolation layer. Fully sovereign, re-derivable from the pinned configuration.
Limitations, stated up front.
- No true concurrency. Strict single-residency means an unattended Tier-3 job blocks interactive Tier-1 work; operators with near-constant interactive use should prefer the always-on-small-plus-swapped-large variant, at a cost in fit budget.
- External performance figures. The envelope numbers are published benchmarks for these model classes, not own deployment measurements – the operational claims read as predicted until A2–A4 are run.
- Model availability and drift. The specific open-weight models are a 2026 snapshot; the design is a mapping from workload to architecture class, which outlives any one checkpoint – but exact footprints and rates will move.
- Safety is only as real as the sandbox. The Tier-3 threat model is defended by container isolation whose efficacy is asserted until A5 runs against the concrete OpenClaw attack classes – a containment failure there would invalidate the “safe to run unattended” claim, which is why A5 is load-bearing rather than a formality.