BEDIM SECURITY

🦞 AI SOC β†’ Laya β€” "the 300" & Power/Time Report

2026-09-27 15:05 UTC Β· control host + edge host + GPU host Β· all numbers measured from live systems unless labeled est.
GATE PASSED Β· 452 unique β‰₯ 300 agreement 94.6% (n=452u) GPU βˆ’74% available (Phase 3)
561
Shadow decisions (raw)
452 unique Β· 109 re-detections
~02:40 UTC
300 gate crossed
286β†’304 during 02:00 hour
94.6%
escalate agreement
vs deterministic ingest rule
1.1 s
Laya latency
3 questions, CPU Β· gemma 18.2 s
205 W
GPU power today
2Γ—102.5 W measured, model resident
βˆ’74%
Power saving upside
GPU energy/day, Phase 3 + eco

1 Β· Executive summary

  • The 300 gate is passed. 561 raw / 452 unique real shadow decisions (selftests excluded, deduped by alert_id). The β‰₯300 gate for Phase 2 crossed at ~02:40 UTC, ~6 h before the planned 09:00 review.
  • Quality holds where it matters: escalate-vs-ingest agreement 94.6% live (97.9% nightly). known_pattern confidence sits in a stable 0.68–0.74 band. response is the weak question (raw conf p50 0.04) β€” it stays in shadow until the Phase 4 finetune.
  • Power story: decisions are already deterministic (Option B) + one laya forward pass β€” the GPU fleet on GPU host runs only to serve gemma turns (wazuh soc_decision p50 18.2 s, narrator/email ~44 turns/day). Moving soc_decision to laya unlocks βˆ’74% GPU energy; the cost is time in the llama wake cycle (β‰ˆ3 min degraded per wake) and the response-quality gap β€” not decision latency, where laya is 16Γ— faster.

2 Β· The 300 β€” soak growth & gate crossing

Soak growth0150300450600gate β‰₯300crossed ~02:40 UTC151821000306091215Shadow decisions β€” hourly bars (left) + cumulative line β†’ 561 raw / 452 unique2026-09-26 15:00 UTC2026-09-27 15:00 UTC (partial)

Hourly bars = decisions logged that hour; green line = cumulative (raw, non-selftest, alert_id-bound). Alert rate is bursty (quiet 08:00–10:00, bursts 17:00–23:00 and 06:00–07:00) β€” the gate was sized β‰₯300 β‰ˆ 1 day of organic traffic, so this is one full soak day, not a full week.

3 Β· Architecture β€” where the decisions live now

Architectureedge host β€” edge / ingestwazuh.manager containerrealtime_ingest (Option B): deterministic severity (code) laya shadow hook (log-only)imap-watcher β†’ 3 email questionsedge host β€” laya-serve :8099CPU, 3 ckpts, 4.7 GB RAM6 threads Β· ~1.1 s / predictshadow β†’ laya-shadow.jsonlagreement cron 05:55 UTCjoins shadow Γ— ingestβ†’ laya-agreement-latest.jsoncontrol host β€” control planesoc-control :15108 (power panel)watchdog cron (10 min)this OpenClaw (main)control host β€” laya-serve :8099CPU, 3 ckpts, 8 threadsevals / baselines / tooling127.0.0.1 loopback onlySOC gateway :18790soc-* agents (narrator, comms,incident-reviewer…)GPU host β€” llama.cpp :21402gemma-4-31b-it Q3_K_M2Γ— 16 GB GPU Β· 15.6+15.6 GB used102.5 W/GPU loaded (measured)p50 soc_decision 18.2 ssystemd: soc-llama-31b.servicePOWER SWITCHcontrol host :15108 β†’ ON/OFFstops llama + gateway 18790watchdog silent when offshadow (log-only)05:55alerts ~480/daysoc_decision β†’ gemma (18.2 s)Phase 3: β†’ laya (1.1 s)power chainAI SOC decision paths β€” post-Option-B, shadow live Flowwazuh alert~480/daydeterministic severitylevelβ†’sev, Option BLaya (1 q-set, 3q)kp Β· escalate Β· responsegate confβ‰₯Ο„flip: LAYA_MODEgemma :21402narrator Β· email onlyincident if escalate∧sev∈{high,critical}Decision flow β€” gemma only touches text-generation paths; decisions are code + one forward pass

4 Β· Latency β€” laya vs the LLM it replaces

Latency0.1s1s10s100sLaya predict (3q, CPU, soak mean)0.88–1.13 s liveRich-state eval p50616-alert setIngest per alert (Option B)was 4.3–4.7 sIngest per alert (pre-Option B)incl. gemma triageNarrator (warm, range)2–12 s observedsoc_decision gemma (p50)7/7 post-fix 2026-09-26Gemma 75k-ctx turn (range)16–77 sEco wake cycle (est.)stop 60–90s + load ~60s + cold turn 64sDecision-path latency (log scale)

Log scale. The interesting bar is the red 18.2 s soc_decision turn vs the green 1.1 s laya predict β€” 16Γ—. The amber bar is the time cost of power saving: bringing llama back after an eco stop.

5 Β· Quality β€” agreement & evals

Quality0.00.20.40.60.81.00.946 liveescalate vs ingest β€” live soak (n=452u)0.95escalate vs ingest β€” nightly (n=240u)0.98known_pattern β€” eval (rich states)0.90response β€” Laya vs historic labels0.59response β€” gemma vs historic labels0.48severity β€” deterministic (code)1.00severity β€” Laya zero-shot0.27Agreement / accuracy by decision (1.0 = perfect)

escalate is the only question with a live objective join (ingest incident rule; deterministic severity makes its "truth" free). Post-Option-B there are no per-alert LLM verdicts, so response/known_pattern are only evaluable against the historic 68-row set. Response verdict: keep shadowed β€” conf p50 0.04, and 115 of 443 auto_remediate predictions at that confidence must never gate anything.

6 Β· LLM volume β€” what actually burns the GPU

LLM volume01,0002,0003,0004,000soc-triage (per-alert)35.50eliminated by Option B (deterministic)soc-narrator (email)35.435.4stays on gemmastig-remediate8.48.4deterministic gate; LLM only inside turnwazuh soc_decision03800new stream post-fix; Phase 3 β†’ laya targetbaseline (Sep 26 pre-Option-B)current / after Phase 3 flipLLM turns per day by agent β€” ticket-creator's '109/day' was busted (template POSTs, no LLM)

llama.cpp counters: prompt tokens went 67.7 k β†’ 2.40 M and predicted 6.0 k β†’ 60.2 k between Sep 26 17:03 and Sep 27 06:10 (β‰ˆ2.33 M prompt tokens in 13 h once the wazuh decision stream was fixed to 100%). That stream is exactly what Phase 3 moves to laya.

7 Β· Power saving at the cost of time

Power scenarios012345kWh/day4.92βˆ’0%llama always-on1.29βˆ’74%laya decisionsllama on-demand (~2 h/day loaded)3.60βˆ’27%S2 β€” full power-off nights 22:00–06:00 (today's switch)1.29βˆ’74%S3 β€” llama-only eco + on-demand (gateway stays up)floor: GPUs unloaded β‰ˆ 0.96GPU host GPU energy per day by scenario (GPU-only; measured 2Γ—102.5 W loaded, idle est. 2Γ—20 W)
ScenarioGPU energy / dayΞ” vs todayTime cost (the trade)
S0 β€” today: llama always-on (2Γ—102.5 W measured, model resident)4.92 kWhβ€”none
S1 β€” Phase 3: laya decides, llama loaded only for narrator/email/stig (~2 h/day)1.29 kWhβˆ’74%0 per decision β€” laya is 16Γ— faster (1.1 s vs 18.2 s)
S2 β€” full power-off 22:00–06:00 (today's switch: gateway+llama)3.60 kWhβˆ’27%watchdog silent 8 h; SOC UI down; no wake-on-alert
S3 β€” llama-only eco (gateway alive, llama stopped when idle)1.29 kWhβˆ’74%per wake: stop 60–90 s + load ~60 s + first turn 64 s cold (vs 2–12 s warm) β‰ˆ 3 min degraded window

7.1 Β· Where power is traded for time β€” detail

ImprovementPower savedCost in timeMeasured
Option B: deterministic severity, no LLM per alertremoves ~480 GPU-turns/daynegative β€” ingest 4.7β†’1.65 sβœ“ 2026-09-26 e639ba1
Laya gated (known_pattern + escalate)frees the gemma slot for narrator0 β€” 1.1 s vs 18.2 s per decisionβœ“ soak n=452u, 94.6% agreement
Phase 3: soc_decision β†’ laya~2.33 M prompt tok/13 h off GPUagreement cost only: 5.4% escalate disagreement vs deterministic rule; response stays gemma until Phase 4βœ“ counters: 67.7 kβ†’2.40 M prompt tok
Eco windows (llama on-demand)~3.6 kWh/daywake cycle β‰ˆ 3 min; watchdog blind on llama only; missed alerts degrade to deterministic sevest. from stop 60–90 s / load ~60 s / cold 64 s
laya on CPU (no GPU needed)31 GB VRAM freedalready the deployed path β€” 0.88–1.13 s on 6–8 threadsβœ“ control host+edge host

7.2 Β· Measured power on GPU host (live, 2026-09-27 15:07 UTC)

  • GPU0: 102.25 W / 180 W limit, 15 640 MiB used, util 36 % Β· GPU1: 102.96 W, 15 592 MiB, util 34 % β€” that's model loaded, mostly idle. Decode bursts push util higher; TG measured 10.8 t/s (31B, 2-GPU split).
  • laya-serve (control host + edge host): CPU-only, 4.7 GB RAM each, 8/6 threads β€” combined energy is noise (<0.1 kWh/day) and requires zero GPU.
  • Unloaded idle floor (2Γ— ~20 W) is an estimate β€” typical for this class; confirm by a one-time stop/start cycle before scheduling eco windows.

8 Β· Gantt β€” done and next

Gantt26Sep27Sep28Sep29Sep30Sep1Sep2Oct3Oct4Oct5Oct6Oct7Oct8Oct9Oct10OctP0 laya runtime (control host)13:20–14:00 βœ“P0.3 eval baseline (68 rows)13:45–15:45 βœ“P1 shadow deploy + hooks14:40–15:40 βœ“P2 prep: Option A + B + qset v1.115:30–20:10 βœ“Soak β†’ 300 gate19:47 β†’ 14:24 βœ“ (crossed ~02:40)Threshold review + gating decisiontoday 15:00 β†’ 18:00Gated flip (known_pattern+escalate)Sep 28P3 primary: soc_decision β†’ laya~480 gemma turns/day off GPUEco windows: llama on-demandβˆ’74% GPU energy; wake ~3 minP4 finetune (response question)Oct 1–8P5 ops + re-evalOct 8–10now (Sep 27 15:05)AI SOC β†’ Laya β€” actuals (solid) and plan (dashed)

9 Β· Risks & open items

  • response not gateable β€” 115 auto_remediate predictions at conf β‰ˆ0.03; must stay shadowed until Phase 4 finetune. Auto-remediation confidence gate (β‰₯0.85) protects us either way.
  • 5.4% escalate disagreement (β‰ˆ24/452) vs the deterministic rule β€” acceptable for gating known_pattern first; escalate gate threshold (noul) should be tuned on soak data during the threshold review.
  • Eco windows need wake-on-event β€” a scheduled OFF with no wake path strands narrator/email; recommend llama-only eco (S3) + a wake hook, never the full power switch unattended (watchdog goes silent by design).
  • Watchdog covers laya on both hosts + shadow-log staleness (>6 h = BROKEN) β€” stays authoritative during any power experiments.
  • soc-triage agent context reset (hygiene) and the wazuh instance's ~3.8 k attempts/day audit noise remain hygiene items from Sep 26.

Sources: /opt/soc-openclaw/data/laya-shadow.jsonl (edge host, 15:11 UTC) Β· laya-agreement-latest.json (05:55 cron + fresh run 14:24) Β· nvidia-smi GPU host 15:07 UTC Β· llama.cpp counters evals/llm-volume.jsonl Β· laya-control/docs/REPORT-OPTION-*.md. Report file: laya-control/docs/REPORT-LAYA-300-POWER-20260927.html.