release(provider): v0.6.29 — Gemma4 MoE compiled decode + DH-key chunk encryption

[Gajesh2007]

Summary

Version bump 0.6.28 → 0.6.29 (ProviderCore.version + coordinator LatestProviderVersion). All functional changes are already merged to master since v0.6.28.

Release contents

• perf(provider): Gemma4 MoE decode — compiled decode + fused gate+up (64→78 TPS, +23%) #482 — Gemma4 MoE compiled decode + fused gate+up + bf16 (pin mlx-swift-lm 5d0a084), including the P1/P2 compiled-decode correctness fixes (Codex-clean). Gemma decode 64→78 TPS @ B=1 on M4 Max.
• perf(provider): precompute DH shared key — 75x faster per-chunk encryption #483 — precompute DH shared key for chunk encryption (~150µs → ~2µs per chunk).

Before / After

flowchart LR
  A[fleet on v0.6.28<br/>Gemma ~9 tok/s prod, ~150µs/chunk crypto] --> B[v0.6.29<br/>compiled MoE decode + ~2µs/chunk crypto]

Loading

Rollout note

After this merges + the v0.6.29 tag builds/signs/notarizes and uploads the bundle, the coordinator must be redeployed to advertise LatestProviderVersion=0.6.29 to the fleet. scripts/install.sh reads the version from the release JSON (no change needed).

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
d-inference	Building	Preview	Jul 1, 2026 12:03am
d-inference-console-ui-dev	Building	Preview	Jul 1, 2026 12:03am
d-inference-landing	Ready	Preview	Jul 1, 2026 12:03am

[ethenotethan]

Automated Code Review — Layr-Labs/d-inference#

Verdict: COMMENT

Security — ⚠️ SKIPPED

Error: OpenRouter HTTP 402: {"error":{"message":"Insufficient credits. Add more using https://openrouter.ai/settings/credits","code":402}}

Performance — ⚠️ SKIPPED

Error: OpenRouter HTTP 402: {"error":{"message":"Insufficient credits. Add more using https://openrouter.ai/settings/credits","code":402}}

Type_diligence — ⚠️ SKIPPED

Error: OpenRouter HTTP 402: {"error":{"message":"Insufficient credits. Add more using https://openrouter.ai/settings/credits","code":402}}

Additive_complexity — ⚠️ SKIPPED

Error: OpenRouter HTTP 402: {"error":{"message":"Insufficient credits. Add more using https://openrouter.ai/settings/credits","code":402}}

✅ All four passes clean. No issues found.

🤖 Automated review by Centaur · DAR-186

[github-actions]

No changes in this PR touch any file explicitly listed in the threat model's affected_files patterns, so no existing threat mitigations are strengthened, weakened, or removed.

---

Files changed vs. threat model coverage

File	Closest threat-model coverage	Gap
coordinator/api/server.go	TB-001, TB-002, TB-006 (multiple threats list coordinator/internal/api/server.go)	Path mismatch: diff is under coordinator/api/ (no internal/ segment). Likely a package restructure or a second server entrypoint.
provider-swift/Sources/ProviderCore/ProviderCore.swift	TB-003, TB-007 (threats list files under provider-swift/Sources/ProviderCore/**)	The glob ** should cover this file, but the automated matcher did not match it — possible that the matcher requires explicit filenames rather than glob expansion.

---

Do these files introduce new trust-boundary surface?

coordinator/api/server.go — If this is a package reorganisation of the existing coordinator/internal/api/server.go, it touches nearly every trust boundary the coordinator owns (TB-001 through TB-006). Key things to verify manually:

• Middleware ordering (auth → rate-limit → handler) must be preserved; any route moved outside the internal/ package boundary may lose visibility to linting/vet tools that enforce package privacy.
• If this is a new server entrypoint (e.g. a separate admin or webhook listener), it could introduce an unauthenticated surface not covered by any existing threat — particularly relevant to T-021 (unauthenticated MDM webhook) and T-026 (unauthenticated OTP endpoints).
• The threat model should be updated to reflect the new path if the package has been renamed.

provider-swift/Sources/ProviderCore/ProviderCore.swift — This looks like a module-level entry point or public API surface for the Swift provider package. Changes here could affect:

• Which security-sensitive types are exported (AntiDebug, PersistentEnclaveKey, AttestationBuilder), widening the attack surface covered by T-013 and T-014.
• Whether new public initialisers allow the inference engine to be instantiated without the startup security checks (SIP check, PT_DENY_ATTACH, binary hash) that TB-003 relies on.

Recommendation: Update the threat model's affected_files entries to include coordinator/api/server.go (alongside the existing coordinator/internal/api/server.go entries) and confirm provider-swift/Sources/ProviderCore/ProviderCore.swift is matched by the glob patterns in TB-003/TB-007. A reviewer should manually inspect both files against the trust boundaries above before merging.

---

🔐 Threat model: docs/threat-model.yaml · Updates on each push to this PR