# TENT design-reference map

OrbiTE is an independent transfer engine whose design follows Mooncake TENT;
it is not wire-, API- or configuration-compatible with TENT. This map records
module correspondence and deliberate differences, not compatibility promises.
Delivery and evidence live in the [completion plan](completion-plan.md) and
[qualification ledger](qualification.md).

The selected purpose is a transfer engine for CPU DRAM, NVIDIA GPUs and local
file/SSD storage that carries every end-to-end OrbitKV cache path, including
GPU↔DRAM and GPU↔SSD. CPU and CUDA are the two
implementation platforms. GPU vendor selection does not restrict ordinary
CPUs, SSDs or compatible network devices to NVIDIA products. CPU-only operation
remains supported. Each NVIDIA GPU model/topology needs its own qualification.

The upstream inventory below makes this selection explicit: 10 transport types
apply to CPU/NVIDIA; seven require excluded accelerator platforms and UB requires
the excluded URMA/UnifiedBus platform. Optional
means opt-in build/runtime dependencies, not permission to leave an in-scope
requirement unfinished. This target does not claim every upstream platform.

## Frozen reference

| Reference | Revision | Purpose |
| --- | --- | --- |
| [Mooncake v0.3.14](https://github.com/kvcache-ai/Mooncake/releases/tag/v0.3.14), released 2026-11-03 | `e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c` | CPU/NVIDIA implementation and differential-test baseline, read through [OrbitInfra/Mooncake][reference] |
| Previous baseline | `e2d6e8e0f2df113d84f9e39379f98c4b67b199ab` | Historical reviews, oracle runs and installed profiles retain this revision where recorded |
| Initial OrbiTE source | [`b7e178fe2ac59e6a3ab19037f068236fb083292a`](https://github.com/OrbitInfra/OrbiTE/commit/b7e178fe2ac59e6a3ab19037f068236fb083292a) | Documents the starting point |

The reference exposes 33 C functions and 18 named selectable transport types.
There are 19 transport source directories because `bufio` also exists, but it
is not registered by the frozen runtime loader. The test tree contains 88 C++
files ending in `test.cpp`; that is a source inventory, not a count of executed
or passing tests. Compile guards, SDK availability and missing devices affect
which tests can run. See [the API][api], [types][types], [loader][loader] and
[test tree][tests].

Use implementation, public headers and reachable tests together as the oracle.
Resolve contradictory prose against those sources and record the decision.
Examples already found:

- Submit-stage failover is implemented in `commitPreparedSubmit` and covered by
  `engine_failover_e2e_test.cpp`; earlier paragraphs in the failover guide still
  describe it as missing.
- `exportLocalSegment` and `importRemoteSegment` return `NotImplemented` in the
  implementation. A declaration does not establish a working capability.
- Config lifecycle classes identify runtime-candidate fields and freeze a
  snapshot. Their presence does not establish public live configuration reload.
- The sample JSON enables some transports that the loader disables by default.
  Extract defaults from the consumed code, not the example configuration.

Baseline updates must be separate reviewed changes: record the new commit,
diff this inventory and the tests, retain old evidence and qualify affected
behavior again. Do not silently follow a moving `main` during implementation.

## v0.3.14 delta

The release is 160 commits ahead of the previous baseline. The path-limited
Git history contains 31 commits affecting 103 files under
`mooncake-transfer-engine/tent` (14,527 insertions and 1,028 deletions).
R1a changes the reference and oracle. R1b owns RDMA, R1c owns storage and
CUDA, and R1d owns HP-TCP, TCP and observability. A Port row can require an
upstream regression control even where an OrbiTE owner already implements
the behavior. Hardware qualification stays with the artifact that ran.

| Commit | Upstream change | Status | OrbiTE owner or evidence |
| --- | --- | --- | --- |
| [`33f5ea0f`](https://github.com/OrbitInfra/Mooncake/commit/33f5ea0fd9f09b921d2d8585fc398aa703888601) | [Build] Bump yalantinglibs to 45c6463 (#5132) | **N/A** | C++ build and ASIO/YLT API updates. R1a pins the new YLT archive for the native oracle. OrbiTE has no YLT runtime. |
| [`50896982`](https://github.com/OrbitInfra/Mooncake/commit/508969821645a7b02ebc46b6353c9e2679d772ec) | [TENT] Enable concurrent XPU host-device copies with a queue per copy (#5117) | **N/A** | Per-copy SYCL queues on Intel XPU. OrbiTE has no XPU platform. |
| [`e544719f`](https://github.com/OrbitInfra/Mooncake/commit/e544719fa61a9f877ffc5508ad91845c77aa6f0b) | [TENT] Add lossless request and transport attempt accounting (#5094) | **Port** | R1d implemented. Public aliases count at admission commit. Physical attempts carry their own terminal outcome across toggles and retries. Remote staging counts each CROSS. |
| [`7d4670b6`](https://github.com/OrbitInfra/Mooncake/commit/7d4670b67152cab643caa9a81e70bca39c782e8e) | [TransferEngine] NVLink: keep the sync memcpy fast path in TENT  (#5165) | **Port** | R1c implemented. Single legacy NVLink tasks below the KiB threshold use cuMemcpy. A DtoD receipt includes the legacy-stream drain. Grouped copies and MNNVL keep event completion. |
| [`4c0c5e5a`](https://github.com/OrbitInfra/Mooncake/commit/4c0c5e5ab1adea65cc13d09d88e10ecaafd6cb69) | [TENT] Parse MC_DISABLE_GPU_DIRECT_RDMA and MC_LOG_RDMA_SLICE_AFFINITY as booleans (#5125) | **Port** | The typed RDMA switches remain; legacy environment aliases were removed with configuration compatibility. Strict typed parsing is covered by config::json::tests. |
| [`fec029cc`](https://github.com/OrbitInfra/Mooncake/commit/fec029cc71caba91823892464e4fe8109e576205) | [TENT]Fix MemFabric SDMA memory allocation and NPU transport initialization for Mooncake TENT (#4834) | **N/A** | MemFabric SDMA allocation, native host storage and NPU initialization depend on the excluded Ascend/MemFabric runtime. |
| [`d0144780`](https://github.com/OrbitInfra/Mooncake/commit/d01447808d10af78011e9203d53796a15a032a03) | [TENT] Hash the batch address when picking a batch lock shard (#5095) | **Already covered** | OrbiTE gives each batch its own progress lock. `independent_batches_progress_while_a_sibling_progress_lock_is_held` exercises independent progress without address-based shard selection. |
| [`5e50b615`](https://github.com/OrbitInfra/Mooncake/commit/5e50b615b3c1d956f103a0191ec3ef5e7eef7da1) | [TENT] Wait for in-flight io_uring I/O before freeing a sub-batch (#5068) | **Port** | R1c implemented. Free defers to the consumed-SQE owner. A failed wait switches to the mapped CQ. The existing destruction cutoff quarantines a missing receipt. |
| [`5805e845`](https://github.com/OrbitInfra/Mooncake/commit/5805e8455200fa9aa93393de26b8a627601afa44) | [TE] hp_tcp: assign each operation to the least-loaded lane (#4935) | **Port** | R1d implemented. Least-loaded single-operation lanes retain rotating ties. `least_loaded_lane_bypasses_a_delayed_ack_and_releases_after_completion` holds one real socket while the other carries a READ and a WRITE. |
| [`956af65e`](https://github.com/OrbitInfra/Mooncake/commit/956af65e9b094e8adc8b4b9ec9b3105824b6e296) | [TE/TENT] Skip remote atomic QP access when the HCA reports no RDMA atomics. (#5047) | **Port** | R1b implemented. Each new QP clamps both READ depths to the local HCA limits. The grant permits only READ and WRITE, including on atomic-capable HCAs. |
| [`6692af10`](https://github.com/OrbitInfra/Mooncake/commit/6692af1046c3b2ffb12750ae8cdadd1c80d8ec59) | [TENT][FEAT] Reduce CQE Processing with Selective Signaling (#4632) | **Port** | R1b implemented. Default interval 1. Periodic and tail CQEs retire their own ordered group. Known partial posts, ambiguous posts, flush and probe ownership have separate controls. |
| [`d3ef7b1c`](https://github.com/OrbitInfra/Mooncake/commit/d3ef7b1c2821d8cdfd5986ee5949e8c17608a36c) | [TENT] Add metrics self-observability contract (#4938) | **Port** | R1d implemented. Both scrape formats report build, sampling, startup and serialization health. `exporter_health_survives_pause_and_failed_serialization` checks an HTTP failure and recovery. |
| [`5fa91fe1`](https://github.com/OrbitInfra/Mooncake/commit/5fa91fe135aba3255c638acd8fd95ba59a0c76c8) | [TENT] Add an opt-in pinned staging pool to the io_uring transport (#5012) | **Port** | R1c implemented. Optional page-aligned file slots are leased without waiting. Pageable fallback has a byte charge. Device fallback uses the bounded S3 proxy chunks. |
| [`c8fe63e5`](https://github.com/OrbitInfra/Mooncake/commit/c8fe63e52cbb9e1af6c3ed760d6ce1b7262ba0d4) | [TE] TransferEngine support hixl nic topo path (#4558) | **N/A** | The NIC topology path is consumed by Ascend HIXL resource configuration. |
| [`b730bbae`](https://github.com/OrbitInfra/Mooncake/commit/b730bbae5f8b89ce79f609df9c66b59bea1b3f8b) | [CI] Enable TENT runtime in T-One e2e as a parallel job (#3600) | **N/A** | T-One CI and build portability. The MNNVL change supplies missing pidfd syscall numbers in older C headers. OrbiTE already takes those numbers from Rust libc. |
| [`1dd37f57`](https://github.com/OrbitInfra/Mooncake/commit/1dd37f57ba944f5190dad30db1267c1c5e4a4a6b) | [Bugfix][TENT] Fail stop on terminal RDMA teardown errors (#4383) | **Port** | R1b implemented. Terminal QP/MR/PD or context teardown reports `Unquiesced` and keeps its owners. The grant and device retention controls cover repeat close and Drop. |
| [`ddda75d3`](https://github.com/OrbitInfra/Mooncake/commit/ddda75d351f25d8da7b3a53e18c119c7533836cd) | [TENT][Bugfix] Refresh Local Rail Topology Before Slice Selection (#4708) | **Port** | R1b implemented. Selection reads current local paths after the peer exchange. A two-context transfer exercises a local topology change during bootstrap. |
| [`8a4d4f68`](https://github.com/OrbitInfra/Mooncake/commit/8a4d4f68ca95de48967487dacbd714c35a663328) | [TENT] Enable GDS on Intel XPU through a cuFile-compatible library (#4904) | **N/A** | Intel xFile and `USE_XPU_GDS` supply the XPU-only device/file route. The NVIDIA GDS capability branch keeps DRAM/file and GPU/file. |
| [`6b90ea5e`](https://github.com/OrbitInfra/Mooncake/commit/6b90ea5e6c375e70d602d0ecd5e063406797e748) | [TENT] Stage XPU buffers through host memory in io_uring transport (#4902) | **N/A** | Stages XPU memory through a host buffer for file I/O. OrbiTE's accelerator path is CUDA. |
| [`8bfd2988`](https://github.com/OrbitInfra/Mooncake/commit/8bfd298880d447137378cf383017f49d8cd4a3aa) | [Bugfix][TENT] Submit merged staging requests only once (#4797) | **Port** | R1c implemented. One physical staged TCP submission carries both public aliases. The source counts one Pin, Delegate, CROSS and Unpin, with bytes and guards checked. |
| [`58e243fb`](https://github.com/OrbitInfra/Mooncake/commit/58e243fb299e4beb990524f2f0e5cabe33bd07e7) | [TENT][BUGFIX] Preserve mapped peer rail for wildcard targets (#4923) | **Port** | R1b implemented. Wildcard targets prefer the mapped healthy peer, including a lower-ranked direct peer. The request mask and current pair health bound alternatives. |
| [`6a835cbf`](https://github.com/OrbitInfra/Mooncake/commit/6a835cbf934aa50c287261f255c83e6faffecb71) | [TENT] Batch register MemFabric buffers to avoid aligned overlaps (#4870) | **N/A** | Overlapping aligned registrations and rollback are specific to the MemFabric batch API. |
| [`db4f146e`](https://github.com/OrbitInfra/Mooncake/commit/db4f146ecb5ae3bc432c0262c1cb6650a0a39ba4) | [TENT] Add intra-node PCIe P2P copies between Intel XPUs (#4379) | **N/A** | Intel XPU PCIe peer copies, Level Zero IPC imports and XPU-specific selector capabilities require SYCL. |
| [`a7496800`](https://github.com/OrbitInfra/Mooncake/commit/a7496800527b93105ac5c4177ce7cdabc5667dbf) | [TENT] Add asynchronous MLU host-device copies (#4720) | **Port** | R1c implemented. Shared controls cover submit publication before wake, scoped polling, staging-child drain and retained registration rollback. MLU and its runtime remain excluded. |
| [`dae22d47`](https://github.com/OrbitInfra/Mooncake/commit/dae22d472e31f6aac92ee1dfe938dc1441b58850) | [TENT] Do not advance the notify send slot on a failed post (#4434) | **N/A** | The corrected send slot belongs to the RDMA notification QP. OrbiTE notifications use local, TCP and control-RPC delivery. |
| [`b2c7d0a7`](https://github.com/OrbitInfra/Mooncake/commit/b2c7d0a7b5cec0b04563138f40d4c40937dd63fe) | [Bugfix][TENT] Restore caller CUDA context after plugin copies (#4839) | **Port** | R1c implemented. The CUDA owner restores the exact binding. A handled copy or cleanup error is terminal and cannot enter host memcpy. The external plugin ABI is now out of scope; built-in copies retain the context controls. |
| [`042ab8a1`](https://github.com/OrbitInfra/Mooncake/commit/042ab8a18b0e6ccfe87782261a5556a3dd4446e4) | [TENT] Add Intel XPU GPUDirect dma-buf RDMA to the Transfer Engine (#4378) | **OrbiTE extension (B04/F04)** | XPU stays excluded. CUDA now adopts the export-first, fail-closed registration boundary from `rdma/context.cpp`, with explicit dma-buf/peermem policy, exact-range MRs and retained fd owners. [Routes and negative controls](rdma-cuda.md#gpu-direct-registration-routes). Installed profile unqualified. |
| [`3b08b771`](https://github.com/OrbitInfra/Mooncake/commit/3b08b77168870d265e32b6cfeab661f037426b9c) | [TE/TENT] Add adaptive RDMA congestion control core (#4197) | **Port** | R1b implemented. The opt-in `rdma-adaptive` shared core provides off/observe/enforce windows, generation-scoped evidence and completion classification. As in the TENT build, workers do not call it. |
| [`7540f582`](https://github.com/OrbitInfra/Mooncake/commit/7540f5826ed32cb755b1db027a2c609adb53f024) | [TENT] Add diagnostic core and version CLI (#4154) | **Port** | R1d implemented. TENT’s C++ diagnostics header and `tent` CLI map to the Rust `version_snapshot()` API and packaged `orbite diagnostics version [--json]` CLI. No C/C++ diagnostics header; unused redaction and external-document rendering are removed. |
| [`7a058556`](https://github.com/OrbitInfra/Mooncake/commit/7a0585567458a4aba6a58115888c54b7fd1a44e1) | fix(tent): allow CPU clients to select peer GPU TCP memory (#4410) | **Port** | R1d implemented. `cpu_platform_can_select_peer_gpu` maps the capability matrix. A separately built CPU-only requester byte-checks READ and WRITE over real TCP against a CUDA-shim source. |
| [`e3e9d70e`](https://github.com/OrbitInfra/Mooncake/commit/e3e9d70eea3c8ea9eb236b4c9c92f361fbbe533f) | [Bugfix][TENT] Restore the caller's exact CUDA context after copies (#4643) | **Port** | R1c implemented. The Driver guard saves the exact caller binding, including null, and checks it after pop. A failed save precedes all copies. Unproven restoration fences the owner. |

## Owner correspondence

| Frozen TENT module | OrbiTE owner | Boundary |
| --- | --- | --- |
| runtime/transfer_engine_impl, admission_queue | engine, runtime/admission_queue | Physical owners, aliases, bounded admission and no uncertain WRITE replay |
| runtime/segment_manager, segment_tracker | segment, runtime/segment_manager | Consumer-supplied epochs; per-peer fence, drain and sticky cleanup |
| runtime/proxy_manager, remote_stage_operation | runtime/proxy_manager, CUDA staging | Charged staging chunks retained until native receipts |
| transport/tcp, hp_tcp, shm | transport/tcp, hp_tcp, shm | Native OrbiTE bootstrap and permissions |
| transport/rdma, nvlink, mnnvl | transport/rdma, nvlink, mnnvl; cuda | Fallible native tables; uncertain cleanup retains owners |
| transport/io_uring, gds | transport/io_uring, gds | Bounded submissions and physical completion |
| metrics | metrics | OrbiTE names with the reference's types, labels and buckets |
| common/config, python/pybind | config/json, orbite-python | Own strict JSON and Rust-shaped Python API; no compatibility layer |

Settings describe OrbiTE's units, defaults, limits and retained owners. Their
design provenance belongs here, not in a public configuration contract:

| Setting or operation | Frozen design reference | OrbiTE meaning |
| --- | --- | --- |
| NIC preference tiers and custom topology | `runtime/topology*`, `platform/cpu_probe.cpp` | Ranked discovered NIC identities; custom ranks cannot replace physical metadata |
| RDMA lanes, slices, aging and bandwidth ordering | `transport/rdma/workers*`, `quota*`, `bw_arbitration*` | Bounded work queues, slice geometry and byte charges; priority does not release an owner |
| Rail health and recovery | `transport/rdma/rail_monitor*` | Per-pair errors, cooldown and probes; uncertain QPs remain retired |
| Selector, QoS, receiver credits and progress | `runtime/transport_selector*`, `qos_contract*`, `receiver_credit*`, `progress_worker*`, `deadline_mlu.h` | Compiled first-match policies, cumulative ledgers and bounded progress; timeout is not a receipt |
| HP-TCP settings and framing | `runtime/hp_tcp_transport_config.cpp`, `transport/hp_tcp/*` | Persistent IPv4 payload lanes with separate control service and explicit task/byte budgets |
| NVLink and MNNVL mappings | `transport/nvlink/*`, `transport/mnnvl/*`, caller-sync event handling | Retained imports and producer events; MNNVL's threshold is recorded but does not change asynchronous dispatch |
| Registration lookup, file segments and notifications | `runtime/transfer_engine_impl.cpp`, `segment_manager*`, `segment_tracker*` | Ordered containing-range lookup, file-relative offsets and separate deliberate notification deliveries |
| Peer retirement | `closeSegment` and segment invalidation | Stronger membership fence and physical drain, rather than reversible handle invalidation |
| io_uring settings | `transport/io_uring/*` | Single-issuer file rings and bounded drain; no silent provider fallback |
| Metrics | `metrics/tent_metrics.cpp` | Reference types, labels and bucket boundaries; names, HELP text and reporter logs identify OrbiTE |

Module layout, transfer behavior and documentation style follow the reference.
There is no C++ runtime dependency. Safety defects are recorded with negative
controls rather than copied. Timeout and cancellation never establish physical
quiescence. Hardware comparisons remain profile-specific; source similarity
establishes no performance result.

## Runtime and service inventory

The IDs below are stable requirement identifiers. Each row needs executable
acceptance cases during P0, including relevant error, concurrency and teardown
cases. Source families identify where to inspect behavior; they do not imply
that every branch or provider has already been qualified upstream.

| ID | Required behavior | Reference source/test families | Delivery |
| --- | --- | --- | --- |
| F01 | TENT configuration compatibility: out of scope by design. OrbiTE owns strict JSON, file and ORBITE_CONF snapshots | common/config remains a design reference | Superseded S17 |
| F02 | CPU/NUMA, PCI and device discovery; RDMA allow/deny lists; custom topology and priority matrices; `cpu:`/`cuda:`; strict locality; unavailable accelerator locations are rejected | `runtime/topology*`, `platform/*`, `topology_priority_matrix_test`, `strict_local_numa_test` | P1/P4/P5/P8 |
| F03 | External device plugin ABI removed and out of scope. Built-in CPU/CUDA allocation, probing, copy and context owners remain in P1/P5 | `device_plugin.h`, `plugins/*`; built-in `runtime/platform*`, `memory_prober*`, `platform/*` | Out of scope (plugin ABI) |
| F04 | Single/batch memory allocation and registration; permissions/options; duplicate references, range geometry, warmup/prefault, unregister and partial-failure ownership | `transfer_engine_impl.cpp`, `segment_registry*`, `local_memory_lifecycle_test`, `coalesce_regions_test`, backend buffer tests | P1/P4/P5/P8 |
| F05 | Memory/file segments, `file://` addressing, open/close/info, descriptor caching/refresh, update subscription/invalidation and retry coalescing | `segment*`, `control_plane*`, `segment_manager_test`, `segment_desc_retry_test` | P2/P7 |
| F06 | P2P self-description only: segment descriptors, capabilities, registration keys and epochs. Consumer-owned discovery, membership, KV indexes and etcd/Redis/HTTP stores are out of scope. There are no metadata-server configuration keys; unknown keys are rejected. Rust peer retirement adds an endpoint/epoch fence and native drain; Python close remains reversible handle invalidation | `runtime/metastore.cpp`, `runtime/segment_manager.cpp`, `runtime/segment_tracker.cpp`, `control_plane*`; [discovery boundary](rust-api.md#discovery-boundary) | P2/P9 |
| F07 | RPC bootstrap, peer probe, data READ/WRITE, notifications, Delegate/Pin/Unpin, update subscriptions; reconnect and owned handler shutdown | `rpc/*`, `control_plane*`, `rpc_reconnect_test`, `rpc_handler_isolation_test`, `delegate_rpc_test` | P2/P5/P10 |
| F08 | Batch capacity/IDs; READ/WRITE; partial submission; merge eligibility and public alias-to-owner mapping; per-task/list/overall status and transferred bytes | `transfer_engine_impl.cpp`, `request_merge_test`, `request_submit_bench`, `engine_failover_e2e_test` | P1/P2/P6 |
| F09 | Observational polling option, explicit `progressBatch`, background progress worker, bounded wake/fallback timing, terminal-state stability and deferred batch retirement | `progress_worker*`, `progress_worker_test`, `runtime_queue_dispatch_test`, `poll_backoff_test` | P1/P6 |
| F10 | Best-effort queued/posted cancellation with backend-specific support, partial progress and retention; distinguish accepted cancel from physical termination | `cancelTransfer`, `Transport::supportsCancellation`, RDMA/HP-TCP cancel tests | Every backend/P10 |
| F11 | Attached completion notifications, explicit send/receive, local and transport/RPC fallback, exactly-once logical delivery accounting, empty-poll/free conventions | `local_notification_test`, `notification_fallback_test`, `transfer_engine_c.cpp` | P2/P6/P9 |
| F12 | Policy ordering; priority HIGH/MEDIUM/LOW; named policy; segment, location and size filters; device masks; QP pools; explicit transport hint and unavailable-path behavior | `transport_selector*`, `transport_hint_test`, `qos_contract*`, `qp_pool_layout_test` | P4/P6 |
| F13 | All request intents: unspecified, foreground get, prefetch, migration, checkpoint, weight loading and internal staging; policy binding and merge isolation | `common/types.h`, `qos_contract*`, `transport_selector_test` | P6 |
| F14 | Request/byte admission; FIFO/EDF and urgency promotion; dispatch windows; staging reserves; deadline-feasibility drop; transport-aware bandwidth provider | `admission_queue*`, `deadline_mlu.h`, `admission_queue_test`, `runtime_queue_dispatch_test` | P6 |
| F15 | Per-worker priority queues, host-shared priority slots, process-local per-NIC byte accounting, named QP pools and four-resource cumulative sender credit | `rdma/quota*`, `shared_quota*`, `receiver_credit*`, `quota_accounting_test`, `receiver_credit_test` | P4/P6 |
| F16 | Slicing/spraying; round-robin and bandwidth-aware choices; separate selection EWMA and transmit estimate; NUMA penalties, masks and strict-local rules | `rdma/workers*`, `bw_arbitration*`, `device_selector_test`, `bw_arbitration_test` | P4/P6 |
| F17 | Submit- and completion-stage fallback; per-owner retry budgets; merged aliases; no terminal resurrection; explicit-progress versus poll semantics | `transfer_engine_impl.cpp`, `engine_failover_e2e_test` | P6/P10 |
| F18 | RDMA endpoint caches, bootstrap concurrency, per-rail health, cooldown/probe/half-open recovery, device loss, retirement and failed-cleanup quarantine | `rdma/endpoint*`, `rail_monitor*`, endpoint/rail/async-event teardown tests | P4/P6/P10 |
| F19 | Local and remote staging; delegate/pin/unpin registry; chunk buffers; mixed direct/staged requests; nested work admission, completion and proxy shutdown | `proxy_manager*`, `remote_stage_operation*`, `stage_buffer_concurrency_test`, `proxy_shutdown_timeout_test` | P5/P6/P8/P10 |
| F20 | Transfer/attempt/queue/failure-stage and deadline observations; labels and histograms; HTTP/JSON/Prometheus output; configuration, disabled mode and available-NIC load snapshots | `metrics/*`, `common/qos_metrics*`, metrics tests, `getNicLoadStats` | P2/P6/P9 |
| F21 | TENT API compatibility: out of scope by design. OrbiTE owns Rust and Python APIs with retained exporters and detached blocking calls | python/pybind is historical design input | Superseded S21 |
| F22 | Transport/platform feature selection, missing-provider errors, installed artifacts, SDK/runtime discovery, examples and reproducible byte-checking benchmarks | TENT/parent CMake, provider adapters, CI, benchmark sources | Every stage/P11 |

For F15 the frozen RDMA shared header publishes one rotating priority slot.
The local selector owns NIC byte charges. QoS inherits policy fields without
charging a parent or cluster budget. The private receiver ledger accepts named
resources and monotone grants. Frozen TENT supplies neither a window-sizing
algorithm, a dead-sender reaper nor an application-resource mapping.

Primary sources: [runtime implementation][impl], [runtime directory][runtime],
[tests][tests], [configuration][config], [C++ compatibility shim][shim],
[Python binding][python], [metrics][metrics] and [device plugin ABI][plugin].

The deadline-feasibility code's `MLU` term and the Cambricon MLU device backend
are separate concepts. The former does not establish framework-level local
recompute: the frozen engine installs an empty local-decode suggestion hook.

## Upstream transport inventory and selected scope

All 18 upstream types are accounted for; only the eight marked core
are implementation targets. Capability bits and compiled providers constrain
supported transfer directions. Do not infer GPU support for a transport from
another transport's platform support. Every selected row requires normal bytes,
negative cases, teardown and installed-artifact gates.

| ID / type | Frozen capability and special obligations | Required hardware/provider | Scope / delivery |
| --- | --- | --- | --- |
| B01 `TCP` | RPC data path; host/CUDA copies, retries and explicit copy failures | Two processes/hosts; NVIDIA GPU for CUDA copies | Core, P2/P5 |
| B02 `HP_TCP` | CPU DRAM only; persistent worker-owned lanes, request/registration IDs, bounds and permissions, remote WRITE ACK, cancellation/drain, IPv4 static rails and large READ slicing | Two TCP hosts; multiple routed interfaces for rail gates | Core, P3 |
| B03 `SHM` | Host shared mappings, offset/path and permissions, concurrent registration and retirement; CXL mount configuration and locality/default behavior | Same-host processes and actual shared backing; CXL-backed profile separately | Core, P3 |
| B04 `RDMA` | Host and CUDA device memory; MR/PD/CQ/QP lifecycle, bootstrap, retries, multirail, notifications, quota, GDR capability and physical drain | Two RNIC hosts; IB/RoCE profiles, multiple rails; CUDA combinations separately | Core, P4/P5/P6 |
| B05 `NVLINK` | Device/host directions actually advertised, CUDA IPC handle sharing and stream completion; no stale mapping reuse | Two local GPU processes with supported CUDA peer access | Core, P5 |
| B06 `MNNVL` | CUDA fabric memory/export/import; opt-in selection, EGM option and supported directions | Supported CUDA fabric/NVLink topology, plus EGM profile where applicable | Core, P5 |
| B07 `IOURING` | File segments, read/write offsets and completion/error bytes; staging where selected; short/partial/error I/O | Linux io_uring and real local files/storage | Core storage, P7 |
| B08 `GDS` | Host/device-to-file directions, cuFile registration and completion/status ownership, explicit fallback behavior | NVIDIA GPU, cuFile/GDS-capable filesystem and storage | Core storage, P7 |
| B09 `UB` | Host URMA transport, endpoint/device capability negotiation, jetty/JFC lifecycle, slicing/quota, retries, notifications when enabled, cancellation and quarantine | Supported URMA devices/provider on two hosts; bonding profile separately | Excluded platform |
| B10 `AscendDirect` | Host/device registration and copy, HIXL/local-copy paths, fabric memory, timeout, resource configuration and agent mode | Ascend runtime and supported HIXL topology | Excluded accelerator |
| B11 `SUNRISE_LINK` | Advertised host/device directions, registration, provider endpoint and completion lifecycle | Sunrise runtime and link devices | Excluded accelerator |
| B12 `TPU` | Host-device staging through PJRT ABI and provider bridge; ownership of pending device work | Actual supported TPU/PJRT adapter | Excluded accelerator |
| B13 `XPU` | Host-device copy and staging with native SYCL allocations/context | Intel XPU, DPC++/SYCL runtime | Excluded accelerator |
| B14 `MLU` | Host-device copy/staging, allocation and process ownership | Cambricon MLU runtime/devices | Excluded accelerator |
| B15 `MPCOMM` | Deferred: no consumer; provider unavailable | No public identity or provider | Deferred P8.1 / S25 |
| B16 `HYLINK` | HIP-backed host/device directions, endpoint and registered-region lifecycle | HIP devices and compatible Hylink provider | Excluded accelerator |
| B17 `FABRIC` | Host-only libfabric transport; no GPU FI_HMEM path | NVIDIA platforms only; AWS EFA is a non-goal | Excluded by design; P8.2 / S24 removed |
| B18 `MEMFABRIC` | Ascend-backed host/device directions, dynamically loaded provider ABI, memory allocator and completion lifecycle | Ascend ACL and compatible MemFabric provider | Excluded accelerator |

B17 FABRIC/libfabric is excluded by design. Its host-only path cannot carry GPU
KV directly. RDMA covers InfiniBand/RoCE/Spectrum-X; NVLink and MNNVL cover
NVIDIA peer fabrics. AWS consumers using NIXL can select NIXL's own LIBFABRIC
backend. Revisit only when a consumer deploys OrbiTE directly on AWS, with GPU
memory (FI_HMEM) supported from the start. CUDA fabric handles are unrelated
and remain in scope.

B15 MPComm is deferred because no consumer uses it and no libmpcomm provider
is available; fake-provider controls would not establish a usable path. MPComm
owns slicing, NIC/QP selection and workers, bypassing OrbiTE's RDMA scheduler,
credits, QoS and rail health. The frozen
[adapter](https://github.com/OrbitInfra/Mooncake/blob/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/src/transport/mpcomm/mpcomm_adapter.cpp)
and [peer registry](https://github.com/OrbitInfra/Mooncake/blob/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/src/transport/mpcomm/mpcomm_peer_registry.cpp)
provide no peer close, handshake timeout or cancellation; reconnect can leak
QPs. Those boundaries do not satisfy physical ownership or per-peer retirement.
No MPComm identity, transport implementation or release gate is shipped.
Revisit B15 if a consumer brings a provider and hardware.

Source authority: [transport types][types], [runtime loader][loader],
[transport implementations][transports] and [platform implementations][platforms].

The upstream's eight platform families are CPU, CUDA, ROCm/HIP, Ascend, Sunrise,
TPU, XPU and MLU. OrbiTE implements built-in CPU and CUDA owners.
The other six platforms and ROCm plugin are excluded by project scope, rather
than classified as missing hardware qualification. In-scope provider stubs
qualify unavailable/error handling and state-machine controls only; they cannot
qualify real transfers.

S22 external device plugins are removed and out of scope. Their declarations
and layouts are not shipped; there is no runtime loader.

Frozen TENT builds `BufIoTransport` as a static target. It caches buffered fds,
runs synchronous `pread`/`pwrite` at the request's file offset and stages CUDA
through host memory. `loadTransports()` installs only IOURING and GDS for
files and never constructs BufIo. None of its behavior is reachable through
the frozen loader. OrbiTE therefore has no public `BUFIO` transport.
[BufIo implementation][bufio] · [Frozen loader][loader]
The fault-proxy transport is a test mechanism, not a nineteenth production type.

HP-TCP's frozen scope excludes GPU memory, TLS, per-WRITE striping, dynamic rail
scheduling, rail failover and transparent replay of ambiguous WRITEs. Its large
READ slicing is not dynamic RDMA-style spraying. These omissions are explicit
reference boundaries, not missing parity work disguised as implemented support.

## OrbiTE local CUDA copy extension

S15b implements the consumer's local GPU↔pinned DRAM copy mechanics beyond
TENT's transport surface. The DMA geometry and mapped-memory kernel follow
OrbitKV's transfer module at `93541a21`. Stream-bound completions own each
registered range and descriptor upload. This extension adds no transport,
peer capability or wire record. [Local CUDA copies](local-copy.md)

## Local SSD paths and module boundary

The frozen TENT source implements both READ and WRITE for local file segments:

| User-visible movement | Actual implementation path | Meaning |
| --- | --- | --- |
| DRAM to/from SSD | `io_uring_prep_writev` / `io_uring_prep_readv` | Host file I/O; aligned host staging when needed |
| NVIDIA GPU to/from SSD through host memory | CUDA copy to/from host staging plus io_uring | A device-file route that uses DRAM |
| NVIDIA GPU to/from SSD through cuFile | `CUFILE_WRITE` / `CUFILE_READ`, `cuFileBatchIOSubmit` and completion polling | GDS API path; native direct movement requires separate evidence |

See [io_uring source][uring] and [GDS source][gds]. These are reference
implementations, not OrbiTE hardware qualification. Successful cuFile calls
alone do not establish the native storage-to-GPU path; filesystem, device,
topology, configuration and actual route observations matter. The NVIDIA
[API guide](https://docs.nvidia.com/gpudirect-storage/api-reference-guide/index.html)
describes compatibility mode and supported memory/configuration rules.

Local [file segments](storage.md) are part of the default build. The Linux
`io-uring` and `gds` features enable the file executors. The network/memory
core runs without loading storage libraries. The storage transports own byte
I/O and its resources. OrbitKV retains KV indexing, placement, eviction, extents, cache
policy and recovery semantics. OrbitKV's SSD tier is expected to move its
DRAM↔SSD and GPU↔SSD byte movement onto these modules; that switch is consumer
integration with its own P10/P11 qualification. Comparisons explicitly enable equivalent modules on each engine.

## Reference fixtures

The compatibility-only S16 inventories and codec captures are removed.
`tests/reference/wire/rpc.json` keeps only the three frozen GetSegmentDesc,
SendData and RecvData request headers used by native prefix-rejection controls.
The real frozen client in `wire/native.cpp` exercises that rejection too.
The CPU trace's `contract.json`, comparator and frozen build remain the oracle
and P11 baseline. OrbiTE's own in-source wire fixtures remain with their owners.

## Wire and consumer boundaries

OrbiTE uses wire version **1** throughout pre-release development. Both
peers must run the same build. The header carries no build identifier, so
it cannot detect a mismatched build. The explicit compatibility policy starts
at `0.1.0`, as defined in the [release ladder](completion-plan.md#release-ladder).
RDMA peers using endpoint QP pools must also share the same ordered pool layout,
width and link-layer settings.
The control-plane magic keeps its historical spelling, `ORBITTE\0`.

The removed FABRIC request opcodes 23 and 24 remain reserved forever and decode
as `Error::Protocol`; its native transport tag 16 is unknown. The removed
segment capability byte is reserved zero. Remaining field offsets, CUDA fabric
capabilities and transport tags are unchanged. The wire stays at VERSION = 1
under the same-build rule above; there is no compatibility downgrade.

Rust is the primary API; Python mirrors the Rust owners with PEP 8 names.
Configuration and metric names are OrbiTE's own. The [NIXL design](nixl-backend.md)
proposes a purpose-built opt-in C bridge for that plugin; no C/C++ ABI is
implemented today, and the removed TENT interfaces stay out of scope. There is no TENT
protocol autodetection or downgrade. A frozen TENT client is rejected at the
native magic/version boundary before admission or payload access. The frozen
build remains a behavior oracle and performance baseline only.

OrbiTE owns byte movement and registration/operation lifetimes. OrbitKV owns
cache identity, replica authority, cache leases and recovery semantics. An
engine source epoch or a region generation does not prove an inference engine's
GPU page generation. P/D page authority remains with the inference engine;
NIXL integration must establish its abort/reuse contract before qualification.

[reference]: https://github.com/OrbitInfra/Mooncake/tree/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent
[api]: https://github.com/OrbitInfra/Mooncake/blob/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/include/tent/transfer_engine.h
[types]: https://github.com/OrbitInfra/Mooncake/blob/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/include/tent/common/types.h
[loader]: https://github.com/OrbitInfra/Mooncake/blob/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/src/runtime/transport_loader.cpp
[impl]: https://github.com/OrbitInfra/Mooncake/blob/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/src/runtime/transfer_engine_impl.cpp
[runtime]: https://github.com/OrbitInfra/Mooncake/tree/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/src/runtime
[tests]: https://github.com/OrbitInfra/Mooncake/tree/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/tests
[config]: https://github.com/OrbitInfra/Mooncake/blob/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/src/common/config.cpp
[shim]: https://github.com/OrbitInfra/Mooncake/blob/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/src/transfer_engine.cpp
[python]: https://github.com/OrbitInfra/Mooncake/blob/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/src/python/pybind.cpp
[metrics]: https://github.com/OrbitInfra/Mooncake/tree/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/src/metrics
[plugin]: https://github.com/OrbitInfra/Mooncake/blob/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/include/tent/device_plugin.h
[transports]: https://github.com/OrbitInfra/Mooncake/tree/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/src/transport
[platforms]: https://github.com/OrbitInfra/Mooncake/tree/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/src/platform
[uring]: https://github.com/OrbitInfra/Mooncake/blob/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/src/transport/io_uring/io_uring_transport.cpp
[bufio]: https://github.com/OrbitInfra/Mooncake/blob/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/src/transport/bufio/bufio_transport.cpp
[gds]: https://github.com/OrbitInfra/Mooncake/blob/e1ea5d31bb5e46ff2df9f90e7c2fbaf52fcdee8c/mooncake-transfer-engine/tent/src/transport/gds/gds_transport.cpp