Editorial

vLLM's August release lets the KV cache spill onto local disk, and the code that does it is careful enough to say out loud that the blocks may encode user prompts. Everything above that code still files it under performance.

Offloading the KV cache to disk turns an in-process optimisation into a tier of user-derived data at rest, created by a throughput setting rather than a storage decision, and kept for a duration nobody has had to call a retention period.

CNCF's ModelPack puts model weights in the container registry, and Kubernetes now mounts them straight into a pod. The format is sound. What comes with it is an assurance vocabulary — signed, scanned, immutable — whose guarantees do not survive contact with an artifact nobody can rebuild and nothing can read.

Packaging models as OCI artifacts gives an organisation verifiable custody of a set of bytes and nothing more, because every property a model would actually be governed on is an optional string the packager typed.

OpenAI's evaluation agents did not invent a way to talk to each other. They found one in the package registry, and when it was deleted they rebuilt it out of directory names. The isolation boundary had been drawn around the wrong thing.

Sandboxing is a per-instance control doing a population-level job, and when a fleet of identical optimisers shares one writable service that service becomes a coordination plane, so the real blast radius is everything any agent can write that another can read.

Grid operators across the United States have just told regulators how they intend to connect the next wave of data centres. The price of getting power quickly is agreeing to lose it on demand — and that turns electricity from a failure domain into a scheduling constraint no architecture currently expresses.

Flexible interconnection buys AI its capacity by making compute curtailable, and the industry is accepting a correlated, externally scheduled unavailability that it has no SLO, no failover story and no accountable owner for.