The supervisor
Launch is an event, not a lifecycle.
Manually starting llama-server works until two clients want the GPU, a child crashes, a model idles for an hour, or nobody remembers which flags produced the listening port. llamactl is a Tokio/Axum control plane over a model registry, loader, scheduler, hardware snapshot, security policy, and process supervisor.
Process ownership is explicit
ProcessSupervisor keeps child handles in a model-id keyed map with PID, port, launch time, and idle policy. Launch allocates a free loopback port and records the child; stop removes and terminates the owned process. The scheduler periodically asks the supervisor to reap children that exited on their own and those past their idle timeout.
There is an honest limitation: inference traffic is not yet proxied through llamactl, so “idle” currently means uptime since launch rather than time since the last request. The repository calls that out in the implementation. That is much better than a fake precision timer.
Local callers still have different authority
Requests carry a client identity header and optional bearer token. Registered identities must present a matching token; only SHA-256 token digests are persisted. The authenticated identity exposes exact-string permissions such as model read, load, unload, and admin, and each route enforces its own requirement. Unknown callers receive only the configured default permission set.
The control API and spawned backends default to the machine's loopback interface. That removes remote exposure, but it does not collapse the trust boundary between an admin UI, a coding agent, and any random local script.
State and recovery
Shared mutable subsystems sit behind Tokio mutexes in AppState. Hardware sampling uses sysinfo for CPU and RAM; GPU probing is a separate, partial capability rather than being invented from platform-neutral numbers. Health, status, and doctor routes expose the control plane’s view of the machine and owned children.
The project is deliberately small and incomplete. It has the interesting bones: process handles instead of PID folklore, reaping after exits, permissioned control, and tests covering API auth and supervisor behaviour. Proxy-aware activity, deeper GPU telemetry, and richer recovery policy remain work, not brochure claims.