An engine in the request path, and a console that stays out of it.
PRIOR runs as a headless engine container that serves your model behind an OpenAI-compatible API. Alongside it runs a separate, optional console container: a web dashboard to watch the gate decide, author policy, manage keys and licenses, and read the audit log. Run one, or both. Everything stays on your infrastructure.
One engine per model. One console for the whole fleet.
The two containers have deliberately separate jobs. The engine is the enforcement path: immutable, headless, one model. The console is how a human operates it, and it's an ordinary API client with no special powers, so the engine image never has to ship a UI or an extra attack surface.
llama.cpp. Serves one GGUF model on
:8089. This is the enforcement path, and the only container you strictly
need.
prior-webui: a static React dashboard on non-root nginx
(:8080). Optional. It holds an operator key in the browser and talks to
the engine like any client.
See the gate decide, and drive the policy from one place.
You can drive everything from the API, but the console is where policy work and day-to-day operation actually happen. Six tabs, all talking to the engine's own routes.
Playground
Live chat with the tri-state X-Ray, and a steering on/off comparison. Prove that a jailbreak that lands on the raw model is stopped by PRIOR.
Policy & Packs
Paste or upload a governance document; PRIOR builds a pack and shows the calibration diagnostics. Enable, disable, or hot-reload, with no restart.
Analytics
Live traffic, refusal rate, gate latency, and traffic-by-zone: the operational health of enforcement at a glance.
Access
Issue scoped API keys (Viewer / Operator / Admin), revoke them, and upload or check a license. It's hot-applied, with no restart.
Audit Log
Safety decisions and control-plane actions, filterable and exportable. Prompts are stored as hashes, never plaintext.
Configuration
Steering-model params and calibration status, runtime toggles, and a live log tail: the operator's cockpit.
From pull to serving in three commands.
The engine pulls from the GitHub Container Registry. You supply the model as a mounted
GGUF (weights are large and shared, so they're never baked into the image) and your
license.bin from the trial email or your purchase.
The one-command path easiest
Our quickstart repo ships a
docker-compose.yml that brings up both containers together. Set two values,
drop in your license, and go.
On first run the engine prints a one-time admin key in its logs
(docker compose logs engine).
Paste it into the console to sign in. CPU-only? Delete the engine
deploy: block and set
PRIOR_NATIVE_NGL=0. The
console is optional, and the engine runs fine headless.
The public repo is just this deploy scaffold (compose files and config). PRIOR itself is a licensed, node-locked engine that your trial or license file unlocks; it isn't an open-source download. The free trial runs the full engine with no card, and like every license it binds to the first host you activate it on.
Or run each container yourself
1 · The engine
Check your NVIDIA driver first. prior:slim is the CUDA 12.4 build and needs only driver 550 or newer, which is why it is the default. On a Blackwell / RTX 50 series card, pull prior:slim-cuda12.9 instead: same engine, but it emits sm_120 and needs driver 575.57.08 or newer on Linux. No GPU at all? prior:slim-cpu needs no driver. Run nvidia-smi to see yours.
prior:slim-cuda12.8 is deprecated: it always named a CUDA version the image did not carry, and now resolves to the same digest as prior:slim-cuda12.9. Existing pulls keep working; move over when convenient. Pin an exact release with 1.2.0-cuda12.4, 1.2.0-cuda12.9, or 1.2.0-cpu. Running an engine older than 1.2.0? Upgrade it: check-in now proves possession of the signed license, older engines are refused, and the failure is silent, ending in unsteered passthrough. It is a pull and a restart, and your license file is unchanged.
2 · The console optional
The console is a separate origin, so allow it on the engine with
PRIOR_ALLOWED_ORIGINS,
and use HTTPS for any non-local deployment. The full deployment reference (volumes, auth,
Kubernetes probes) is in the documentation.
Talk to the engine from code
from openai import OpenAI
client = OpenAI(base_url="http://localhost:8089/v1", api_key="…")
client.chat.completions.create(model="prior", messages=[…])
It's the standard OpenAI client. Point base_url at the engine and keep
going. The tri-state decision rides in the x-prior-* response headers,
which ordinary clients ignore.
Pick a certified model and go.
The gate (detection) works on any model you load. Steering acts on a model's internal geometry, so it's validated per model and graded certified or beta. The engine reads the calibration from a baked registry when the GGUF filename matches, so keep the registry filename. It also picks its own steering plan at load, from the model's architecture and the free VRAM on the card, so mixture-of-experts and hybrid state-space builds run the backward-free path without you configuring anything. Start here:
| Model (Q4_K_M) | Approx. size | Steering grade | Best for |
|---|---|---|---|
| Llama-3.2-3B-Instruct | ~2 GB | Certified | The quickstart default: fast, modest GPU, best fidelity. |
| Qwen3-8B | ~5 GB | Certified | More capable, still light on VRAM. |
| Qwen3-4B-Instruct-2507 | ~2.5 GB | Certified | A strong 4B middle ground. |
| Meta-Llama-3.1-8B-Instruct | ~5 GB | Certified · reference | The model all our published benchmarks use. Reproduce our numbers. |
| Llama-3.2-1B-Instruct | ~0.8 GB | Certified | The smallest footprint. |
Also runs (beta / lower steering fidelity): Qwen3-14B, the smaller Gemma-3/4 builds, SmolLM3. Load them for the gate, not for reliable forced refusals. The registry spans dense, mixture-of-experts and hybrid-SSM builds up to 31B and grows as models are calibrated; see the model registry for the current roster, or bring your own and calibrate it in the console.
Six ways to run PRIOR at its best.
Write policy from a document
Don't hand-tune rules. Paste your real governance doc or system prompt into the console; PRIOR extracts the intents, generates exemplars, and calibrates the thresholds. Read the diagnostics (separation, recall) before you trust a pack.
Tune the tri-state, don't max it
PRIOR ships precision-first, with zero false blocks on safe traffic. Let the yellow confirm band absorb ambiguity, and raise sensitivity only where your risk tolerance calls for it. Recall is an operating point you own.
Watch it before you trust it
Use the console's comparison mode to run your real prompts steering-off vs steering-on, side by side. See the refusal hold (in the model's own voice) before it's in front of a customer.
Ground the facts that matter
Beyond safety: ground verified facts (config values, current truths) in the model's latent state so a poisoned or stale source can't override them. Zero prompt tokens. See the demo →
Layer it, don't replace
PRIOR is defense-in-depth. Keep your prompts and filters; PRIOR adds the enforcement layer they can't provide: from inside the model, on intent, provable in the audit log.
Keep the audit trail
Every gated decision and admin action is logged durably, on your box. Export it for a review; make "what did the agent do, and why?" a query, not a project.