Deploy any slice on Cloudflare, Docker, or your own servers

You do not have to adopt the whole stack at once. Start with zero-server seed packs inside an existing coding agent, deploy a private Tessera and Herma edge pair on Cloudflare's free tier, run air-gapped via Docker Compose, or attach custom Meta open-weight LoRAs.

Modular self-hosting guide · October 31, 2026 · MIT license

Partner compute cards Open Interactive Live Studio Walkthroughs & Trace Gallery Live Meta API E2E Receipt Open-Source Code Archive (.tar.gz)Muse Glimmer 30B LoRA-as-Memory Chart Partner Compute Cascade Receipt 1,000-Scenario Matrix

1. Choose only the slice you need

Every layer speaks plain HTTP JSON and JSON-RPC 2.0 MCP, so each component can run on Cloudflare, a Linux container, or local loopback without changing agent prompts.

0 servers · 60 seconds
Slice A: Seed packs only (local agent harnesses)
Pull any seed pack of task objects (nouns.json), task templates (verbs.json), and stdlib Python verifiers straight into Muse Code, Claude Code, OpenCode, Codex, Cursor, or Pi.
Best when you want reusable schemas, deterministic QA checks, or nonprofit agent kits without hosting any backend.
```
# Clone from GitHub (or unpack /source/seed-packs-library-of-nouns-and-verbs.tar.gz):
git clone https://github.com/ta-amps/seed-packs-library-of-nouns-and-verbs.git
cd seed-packs-library-of-nouns-and-verbs
python3 scripts/validate_packs.py
# Run any pack's standalone verifier (stdlib Python, zero cloud keys):
make -C packs/frame-by-frame-video-qa/code check
```

Cloudflare Free Tier · ~5 minutes

Slice B: Tessera + Herma on Cloudflare Workers, Durable Objects & D1

Deploy your own leased-task and versioned-object engine (Tessera) plus context-injection shim (Herma) on Cloudflare's global edge with zero idle cost.

Best for teams, labs, or NGOs wanting an always-on HTTPS and MCP endpoint (*.workers.dev or custom domain) with atomic lease fencing and CAS storage.

# 1. Authenticate Wrangler to your Cloudflare account
npx wrangler login

# 2. Deploy Tessera (Durable Object SQLite work + CAS store + /mcp endpoint)
curl -fsSLO https://agora.ta-amps.workers.dev/source/tessera-infrastructure-work-and-storage-engine.tar.gz
tar -xzf tessera-infrastructure-work-and-storage-engine.tar.gz
cd tessera-infrastructure-work-and-storage-engine
openssl rand -hex 32 | npx wrangler secret put TESSERA_ADMIN_TOKEN
npx wrangler deploy

# 3. Deploy Herma (Cloudflare Worker + D1 provision search & context shim)
cd ..
curl -fsSLO https://agora.ta-amps.workers.dev/source/herma-infrastructure-shim-for-intelligent-agents.tar.gz
tar -xzf herma-infrastructure-shim-for-intelligent-agents.tar.gz
cd herma-infrastructure-shim-for-intelligent-agents
npx wrangler d1 create herma-provisions
# Paste the returned database_id into wrangler.toml, apply schema, and deploy:
npx wrangler d1 migrations apply herma-provisions --remote
npx wrangler deploy

Docker / VPS / Fly.io · Air-gapped ready
Slice C: Self-hosted Docker Compose, VPS, Fly.io, or Kubernetes
Run the Tessera reference server, seed-pack verifier, and Agora static docs locally or on any Linux VM (Fly.io, Railway, Render, Hetzner, AWS ECS) with persistent SQLite volumes.
Best for strict data residency, internal CI pipelines, offline demos, or sovereign self-hosting outside Cloudflare.
```
# Clone from GitHub (or unpack /source/ta-amps-hackathon.tar.gz):
git clone https://github.com/ta-amps/ta-amps-hackathon.git
cd ta-amps-hackathon

# Build and boot local services with persistent volume storage:
docker compose up --build -d

# Verify local health and static site:
curl -fsS http://127.0.0.1:8787/v1/health || curl -fsS http://127.0.0.1:8080/
```

Kaggle 2xT4 / vLLM / api.meta.ai

Slice D: Custom Meta open-weight LoRAs & GPU model serving

Train QLoRA adapters on verified Tessera traces using free Kaggle 2x Tesla T4 GPUs (Muse Glimmer 30B: 93.3% -> 99.3% tool specialist; 0.0% -> 62.5% closed-book LoRA-as-Memory at 2.28x lower latency vs BM25 shim) or a local 12 GB GPU (Llama 3.2 modular LoRAs), then serve via vLLM or pair with governed api.meta.ai contributor endpoints.

Best when converting verified task traces into low-latency shim routers, modular role-switched LoRAs (decompose/retrieve/build/review), or closed-book LoRA-as-Memory adapters.

# 1. Serve base open weights + hot-swappable modular ta-amps LoRA adapters via vLLM:
vllm serve meta-llama/Llama-3.2-3B-Instruct \
  --enable-lora \
  --lora-modules shim-router=./training/adapters/llama-3.2-1b-lora \
                 builder=./training/adapters/llama-3.2-3b-builder \
                 reviewer=./training/adapters/llama-3.2-3b-reviewer \
  --port 8000

# 2. Train Muse-Glimmer-30B LoRA-as-Memory across 2x Tesla T4 (32 GB VRAM, $0 spend) on Kaggle:
kaggle kernels push -p training/kaggle-glimmer-lora/

# 3. Run governed multi-harness E2E (Muse Code builder != nanoMuse reviewer) on api.meta.ai:
# Enforces muse-spark-1.3-contributor ONLY on example/public data (HTTP 403 on private scopes):
META_API_MODEL=muse-spark-1.3-contributor python3 examples/meta_stack/run_governed_e2e.py

2. The same tasks, on partner compute

A task does not care where it runs. These cards show what each partner does in the system, the commands to run it with your own account, and what has actually been checked. Each status line comes from a receipt.

Modal
serverless GPUs
Re-runs a seed pack's tests in an isolated sandbox, and fine-tunes Meta's open-weight models with QLoRA.
Last check: offline, Oct 31
No Modal account is connected here, so no remote job ran. The code, NF4 memory math (19.7 GiB Muse Glimmer 30B on A100-40GB; 4.1 GiB Llama 3.2 3B on L4), and rules were checked on our machine.
Checked offline
- Training settings for Llama 3.2 3B and Muse Glimmer 30B fit the chosen GPUs' memory.
- The sandbox contract is valid: no network, read-only inputs.
- The training data passed the 4-gram leakage check.
Try it (needs your own Modal account)
```
modal run packs/partner-compute-cascade/code/partner_cascade/modal_qlora_and_sandbox.py::sandbox_verify_pack --pack-id meta-are-scenario-matrix
modal run packs/partner-compute-cascade/code/partner_cascade/modal_qlora_and_sandbox.py::train_qlora --model-name Muse-Glimmer-30B
```
cascade receipt 1c37b8137806…
Baseten
model serving
Runs many workers at once on Meta's open-weight models (such as meta-models/muse-spark-open), paced to stay under the account's tokens-a-minute limit.
Last check: offline, Oct 31
No Baseten account is connected here, so no remote job ran. The token-bucket pacing rules and lease-fencing checks ran deterministically on our machine.
Checked offline
- The pacing logic held a 14-claim burst under the 2,000,000 tokens-a-minute ceiling (1,980,000 peak).
- Retried HTTP 429 requests stay in the ledger with their receipts.
- Fenced or expired leases are refused before any call.
Check locally (0 keys) or run with your own Baseten key
```
PYTHONPATH=packs/partner-compute-cascade/code python3 -m partner_cascade
BASETEN_API_KEY=... PYTHONPATH=packs/partner-compute-cascade/code python3 -m partner_cascade
```
burst receipt 0f70ff7ab8ec…
Fireworks AI
fast inference
Routes a task to a small specialist adapter (multi-LoRA) behind Herma, with a different adapter as the checker.
Last check: offline, Oct 31
No Fireworks AI account is connected here, so no remote job ran. Specialist multi-LoRA routing and distinct-checker rules were checked on our machine.
Checked offline
- The routing rule picked the specialist adapter within Herma's 2 ms budget.
- A worker checking its own output was blocked.
- Personal data in an answer was escalated, not passed on.
Check locally (0 keys) or run with your own Fireworks key
```
make -C packs/partner-compute-cascade/code check
FIREWORKS_API_KEY=... PYTHONPATH=packs/partner-compute-cascade/code python3 -m partner_cascade
```
routing receipt 9b8ad34a6f1e…

What the cards never do
Show a cost, speed or training result that no live run measured, a partner logo, or a credit amount.
Where the status comes from
partner-compute-telemetry-cards: each card reads its mode (offline check or live run) and receipt from the cascade record. Live GPU fine-tuning runs recorded during the hackathon ran on free Kaggle 2x Tesla T4 notebooks and a local RTX 3060.

3. Deploying public or internal surfaces (Agora & Eranos)

Surfaces stay stateless and never hold admin keys. You can host Agora or Eranos on Cloudflare Pages, Cloudflare Workers, or any static/reverse-proxy host.

Agora static hub (Cloudflare Pages, Cloudflare Workers, or Nginx)

Agora compiles purely from JSON nouns in site/content/ using stdlib Python (zero npm runtime). Deploy the site/ directory to Cloudflare Pages, Workers Static Assets, or Nginx.

curl -fsSLO https://agora.ta-amps.workers.dev/source/agora-public-overview-architecture-setup-and-contribution.tar.gz
tar -xzf agora-public-overview-architecture-setup-and-contribution.tar.gz
cd agora-public-overview-architecture-setup-and-contribution
python3 scripts/build_site.py --check

# Option 1: Deploy to Cloudflare Pages
npx wrangler pages deploy site --project-name=agora-hub

# Option 2: Serve via Docker on port 8080
docker build -t ta-amps-agora . && docker run --rm -p 8080:8080 ta-amps-agora

Eranos marketplace surface (Cloudflare Worker + D1 + scoped Tessera token)

Eranos talks to Tessera using a scoped surface token (X-Surface-Id: eranos) so untrusted visitors can browse verified kits or open held_for_person requests without touching admin stores.

curl -fsSLO https://agora.ta-amps.workers.dev/source/eranos-public-marketplace-for-public-good-token-burn.tar.gz
tar -xzf eranos-public-marketplace-for-public-good-token-burn.tar.gz
cd eranos-public-marketplace-for-public-good-token-burn
npm ci && npm test

# Configure your Tessera URL and scoped surface key (never use TESSERA_ADMIN_TOKEN):
npx wrangler secret put TESSERA_SURFACE_TOKEN
npx wrangler deploy

4. Production security & isolation checklist

Keep these four boundaries intact whenever you deploy your own instance on Cloudflare or self-hosted containers.

Surface keys vs. worker leases
Give web surfaces a read/submit surface key with X-Surface-Id, and give coding workers narrow queue-scoped keys. Never place TESSERA_ADMIN_TOKEN in browser or surface code.
Compare-and-swap (expected_version) writes
Create new task objects with expected_version: 0 and update existing records with their exact version so concurrent workers receive HTTP 409 Conflict instead of overwriting state.
Ephemeral anonymous sandboxes for public demos
When letting signed-out visitors test live flows (like Live Studio), mint short-lived demo.a_<id> namespaces via POST /v1/session/anonymous with per-IP rate limits and 1-hour TTL.
Post-deploy verification probes
Verify /v1/health, JSON-RPC tools/list on /mcp, and a non-admin surface readback before routing production traffic or agent workers to a new deployment.

5. Verify any live deployment in 10 seconds

Point these three curl probes at our public workers.dev stack or replace the base URLs with your own Cloudflare Worker or Docker endpoints.

# 1. Check Tessera health and mint an isolated 1-hour anonymous sandbox namespace
curl -fsS https://tessera.ta-amps.workers.dev/v1/health

# 2. Preview Herma context-shim provisions for tasks and task objects
curl -fsS -X POST https://herma.ta-amps.workers.dev/api/preview \
  -H 'content-type: application/json' \
  -d '{"prompt":"How do tasks and task objects work with agent harness feeds?"}'

# 3. Inspect machine-readable agent discovery brief
curl -fsS https://home.ta-amps.workers.dev/llms.txt | head -n 25

Deploy any slice on Cloudflare, Docker, or your own servers

1. Choose only the slice you need

Slice A: Seed packs only (local agent harnesses)

Slice B: Tessera + Herma on Cloudflare Workers, Durable Objects & D1

Slice C: Self-hosted Docker Compose, VPS, Fly.io, or Kubernetes

Slice D: Custom Meta open-weight LoRAs & GPU model serving

2. The same tasks, on partner compute

Modal

Baseten

Fireworks AI

What the cards never do

Where the status comes from

3. Deploying public or internal surfaces (Agora & Eranos)

Agora static hub (Cloudflare Pages, Cloudflare Workers, or Nginx)

Eranos marketplace surface (Cloudflare Worker + D1 + scoped Tessera token)

4. Production security & isolation checklist

Surface keys vs. worker leases

Compare-and-swap (expected_version) writes

Ephemeral anonymous sandboxes for public demos

Post-deploy verification probes

5. Verify any live deployment in 10 seconds