Workstream W3 · CTC Research Lab

Local Three-Tier Agent Workstation

Three very different agent workloads – an interactive cognitive cockpit, an agile software-engineering environment, and an autonomous long-horizon factory – each paired with the framework and open-weight model whose architecture fits the workload’s cost model. Because the smallest viable pair of models already exceeds the 32 GB ceiling, the design is built on strict single-residency: exactly one model resident, a tier switch swaps it.

Design & operator setuparchitecture and fit measured · throughput and swap cost stated as falsifiable criteria

++
15–24 GB
Every model fits the card alone, with headroom – the smallest pair (33 GB) does not.
Measured
1 resident model
Strict single-residency, enforced at the serving layer; a tier switch swaps it.
By design
≤ 30 s / ≤ 3 s
Cold-swap and kept-warm switch budgets per tier switch – the design’s named ergonomic tax (A2).
Proposed · predicted
++
Context

One card. Three workloads.
One model for everything is the wrong optimisation.

Reasoning, repo-scale coding, and unattended automation reward three different architectural properties – and at Q4, no two of the relevant models fit together in 32 GB.

The temptation with a capable local card is to run one large model for everything. That is the wrong optimisation: reasoning-heavy research, repository-scale software engineering, and unattended long-horizon automation reward three different architectural properties, and paying for all of them at once wastes both VRAM and latency. The constraint that shapes everything is memory – at Q4, the relevant open-weight models occupy 15–24 GB each, so no two fit together on 32 GB. The design therefore does not co-locate models; it time-multiplexes a single resident model across three tiers, and spends its engineering budget on choosing the right model per tier and making the swap between them cheap and safe.

The setup operates against three strands of the systems literature: paged-attention local serving and the memory-bandwidth wall, model routing (send each query to the cheapest model that can answer it – here routed across time on one card rather than across a fleet), and the cold-start problem of serverless LLM serving, whose checkpoint-loading latency this design does not solve in general but budgets, honestly. The contribution is not a new serving system: it is a disciplined operator composition a solo operator can actually run and reason about on commodity hardware.

++
Architecture

Three tiers, matched to the workload.

Each tier pairs a workload with the agent framework and the open-weight model class whose architecture fits it. Only one model is resident at a time; a tier switch swaps it.

Tier 1 · Cognitive cockpit everyday & research · reasoning, writing AgentHermes (Nous Research) ModelsR1-32B · Gemma4-31B Pays fortest-time compute Tier 2 · Agile dev env repo-scale reviews · multi-file edits AgentOpenCode · terminal-native Modelsqwen3-coder:30b (MoE) Pays forsparse activation Tier 3 · Autonomous factory unattended long-horizon jobs AgentOpenClaw · checkpointing ModelsDevstral Small 2 · Qwen3.6 Pays forsmall dense footprint STRICT SINGLE-RESIDENCY · exactly one model resident – a tier switch swaps it
Figure 1 – match agent and model architecture to the workload. One card, three distinct workloads.
T1
Reasoning → a dense RL-trained reasoning modelDeepSeek-R1 spends test-time compute on a long chain-of-thought, trading tokens – and latency – for correctness. Worth it for research; the longer time-to-answer is a design acceptance, not a defect. Drafting uses a fluent generalist instead.
T2
Software engineering → a coding MoESparse routing activates ~3.3B of 30.5B parameters per token – heavy-model competence at light-model latency, 2–4× the token rate of a comparable dense model, with long native context so multi-file review does not thrash the KV cache.
T3
Long-horizon → an efficient specialistFault-tolerant orchestration and long context matter more than latency; Devstral’s small 24B footprint leaves the most KV headroom for extended jobs.
The unifying rule

Pick the architecture whose cost model the workload can pay – and never spend VRAM or latency on a property the tier does not use.

++
Measured

Any single model fits.
No two fit together.

The fit envelope that forces the design – and the swap cost it incurs, named honestly rather than elided.

Any single model fits – no two fit together (Q4 weights) Devstral Small 2 · ~15 GB · agentic-coding qwen3-coder:30b · ~18 GB · MoE ~3.3B active deepseek-r1:32b · ~19 GB · reasoning gemma4:31b · ~19 GB · dense, writing qwen3.6:35b · ~24 GB · MoE ~3B active 32 GB ceiling smallest pair – Devstral (15) + qwen3-coder (18) = 33 GB – already exceeds the ceiling → single-residency is the design, not a workaround enforced: OLLAMA_NUM_PARALLEL=1 · OLLAMA_MAX_LOADED_MODELS=1 – work queues; the resident model is unloaded before the next loads
Figure 2 – the fit envelope that forces the design.
Swap cost = unload + load + first token Tier A resident qwen3-coder · ~18 GB 1 · Unload LRU frees VRAM 2 · Load next stream from NVMe 3 · First token prompt · TTFT Tier B deepseek-r1 ~19 GB cold-start penalty ~10–30 s (weights stream from disk) · >3 s already reads as a stall – the real ergonomic tax, budgeted, not elided
Figure 3 – single-residency buys “it fits” at the price of a cold swap. Mitigations are part of the design: keep-alive for the most-used tier, pre-warming before an anticipated switch.

Two honest constraints remain. There is no true cross-tier parallelism: an unattended Tier-3 job holds the card, so interactive work waits unless the operator schedules around it. And CUDA memory fragmentation accumulates over repeated load/unload cycles – free contiguous VRAM must be monitored and the server restarted periodically.

++
Envelope

Weights set the floor.
The rest is context budget.

Two numbers decide whether a tier is usable: how fast it generates, and how much context it can hold – and the second constrains the design more than model size suggests.

Weights set the floor – the rest of 32 GB is the context budget (q8_0 KV roughly halves the pressure) Devstral · ~87 tok/s~17 GB → 256K feasible qwen3-coder · ~234→110 tok/s~14 GB → ~128–147K deepseek-r1 · ~52–94 tok/s~13 GB → ~47K, fills fast gemma4 · ~61 tok/s~13 GB → moderate qwen3.6 · ~110→234 tok/s~8 GB → short 32 GB the context ceiling is a per-tier budget, not a constant – the operator budgets context per tier rather than assuming a uniform ceiling
Figure 4 – indicative published figures for these model classes on the RTX 5090 (Q4, single stream). External benchmarks for the architecture, not own deployment measurements – those are precisely the acceptance criteria A2–A4.

Two consequences follow. Generation is memory-bandwidth-bound: an MoE that reads only ~3B active weights per token sustains 2–4× the token rate of a dense model of similar total size – exactly why the coding and allrounder tiers use MoE, and why the dense reasoning model is slowest per token. And the earlier “fits with headroom” is refined: every model fits, but usable context per tier differs sharply.

++
Falsifiable claims

Five acceptance criteria, A1–A5.

A design & operator setup, not a measured benchmark study – so its central claims are stated as falsifiable acceptance criteria with instruments and thresholds, in the same measured/predicted discipline as the companion papers. Thresholds marked [proposed] are defaults offered for confirmation.

A1 No-collision single residency Peak VRAM and host-RAM spill under each tier’s representative workload at its budgeted context, via GPU memory telemetry across a scripted run of all three tiers. Pass: peak VRAM below the 32 GB ceiling with headroom, zero spill on every tier. Falsified if: any spill or OOM under a tier’s stated context budget. Fit measured · run pending
A2 Bounded swap cost Cold-swap latency (unload + load + first token) and warm-tier switch latency over N repeated switches, timed from NVMe. Pass [proposed]: median cold swap ≤ 30 s at these model sizes; a kept-warm tier switches in ≤ 3 s. Falsified if: swap latency beyond the budget – interactive tier-switching unusable. Predicted
A3 Per-tier throughput floor Sustained single-stream generation per tier at its budgeted context, under NUM_PARALLEL=1. Pass [proposed]: MoE tiers ≥ 100 tok/s; the dense reasoning tier ≥ 40 tok/s – above reading speed, accepting the reasoning-latency trade. Falsified if: a tier falls below its usability floor. Predicted
A4 Per-tier context budget realised Maximum usable context per tier without OOM under a q8_0 KV cache, via a context-length sweep to the OOM boundary. Pass: each tier reaches its budgeted context – ~256K for the 15 GB Devstral, a short context for the 24 GB qwen3.6 – with no spill. Falsified if: OOM below the budgeted context. Predicted
A5 Isolation efficacy (Tier 3) The claim that the sandbox contains a hostile autonomous agent – red-teamed with the known OpenClaw attack classes (indirect prompt injection driving an action, a malicious imported skill, sandbox-escape attempts) under the hardened container. Pass: zero network egress, zero sandbox escape, every sensitive action gated. Reuses the W1 hardened sandbox directly. Falsified if: any containment breach. Predicted · load-bearing

The workstream hypothesis: single-residency time-multiplexing serves three model tiers in 32 GB without VRAM collision, at a bounded and manageable swap cost. All five criteria run on the same single-GPU, air-gapped setup plus the evaluation harness already in the program.

++
Security

Safety is verified, not assumed.

The highest-risk tier is Tier 3: an unattended, long-horizon, high-privilege autonomous agent – and for the chosen tooling the risk is not hypothetical. OpenClaw’s rapid rise came with a severe, documented security record: a critical remote-code-execution flaw via an unvalidated local WebSocket, a chained set of sandbox-escape and privilege-escalation vulnerabilities (“Claw Chain”, allowlist bypass rated CVSS 8.8), and a marketplace supply-chain problem – an independent audit found 341 malicious entries among 2,857 skills. Safety is therefore a cross-cutting requirement, applied most stringently where autonomy and privilege are highest, and verified – not assumed – by criterion A5.

01
Untrusted inbound dataEmail, web content, and tool output are treated as untrusted across all tiers – the standard mitigation against indirect prompt injection, where the attack rides in on data the agent reads.
02
Confirmation gatesSensitive or irreversible actions require explicit confirmation; on the unattended Tier 3, the equivalent is an allowlist of permitted actions plus checkpoint-based rollback if behaviour drifts.
03
Execution isolationAll model-driven execution runs under container isolation – no network, non-root, read-only, seccomp – the same hardened substrate as the evaluation pipeline. For Tier 3 this is not optional hardening but the precondition for running the agent at all.
04
Memory & supply-chain integrityPersistent memory and imported skills are attack surfaces; memory writes and skills are validated, and checkpoints provide a trusted state to roll back to.
The honest position

The three-tier design is safe to run only to the extent that the isolation layer is real – the convenience of an autonomous background agent is exactly proportional to the discipline of the sandbox around it.

++
Applied

Three workloads, one card, sovereign.

A solo operator, three agent workloads, one card – sovereignly
  • Situation. An independent ML operator needs an interactive research assistant, a repository-scale coding agent, and an unattended overnight automation agent – with one 32 GB card, a data-sovereignty constraint, and no budget for a multi-GPU rig or per-workload cloud subscriptions.
  • Task. Run all three on the single card, each with a model whose architecture fits its cost, without VRAM collisions, with predictable switch latency, and with the unattended agent safely contained.
  • Action. Configure strict single residency; assign DeepSeek-R1/Gemma4 to Tier 1, qwen3-coder to Tier 2, Devstral to Tier 3; keep the most-used tier warm; budget context per tier under a q8_0 KV cache; run every model-driven action inside the hardened, network-less sandbox.
  • Result. Three capable agent workloads from one commodity card – swapped rather than co-loaded, at a switch cost the operator can plan around, with an automation tier whose safety rests on a verified isolation layer. Fully sovereign, re-derivable from the pinned configuration.
++
Honesty

Limitations, stated up front.

Four limitations bound the claims
  • No true concurrency. Strict single-residency means an unattended Tier-3 job blocks interactive Tier-1 work; operators with near-constant interactive use should prefer the always-on-small-plus-swapped-large variant, at a cost in fit budget.
  • External performance figures. The envelope numbers are published benchmarks for these model classes, not own deployment measurements – the operational claims read as predicted until A2–A4 are run.
  • Model availability and drift. The specific open-weight models are a 2026 snapshot; the design is a mapping from workload to architecture class, which outlives any one checkpoint – but exact footprints and rates will move.
  • Safety is only as real as the sandbox. The Tier-3 threat model is defended by container isolation whose efficacy is asserted until A5 runs against the concrete OpenClaw attack classes – a containment failure there would invalidate the “safe to run unattended” claim, which is why A5 is load-bearing rather than a formality.
PinnedNUM_PARALLEL=1 · MAX_LOADED_MODELS=1 PinnedKV_CACHE_TYPE=q8_0 · FLASH_ATTENTION=1 tier switch = unload → load → first token