Approach
How the swarm gathers evidence, gets permission, chooses where to run, and proves the result
Four design commitments, each with its honest limit. Below them: the external benchmark records we rely on, with their attribution, and the public claims register that governs every sentence on this site.
Evidence before conclusions
Every observation carries its input revision, tool version, time, result and coverage. Unknown relationships stay visible. A plausible relationship supplied by a model is not evidence. Secret values are kept out of model prompts; redacted locations and fingerprints are used instead.
LimitCoverage is only as good as the qualified adapters. The historical plugin catalogue is not a shipped feature list.
Permission outside the model
Agents cannot write themselves a permission or change the gate’s rules. The broker checks operation, tenant, exact target, revisions, expiry, revocation and effect limits. A malicious log entry, README or tool result remains evidence data, never an instruction. Modified or uncensored checkpoints receive no additional credentials.
LimitPlanned capability. Policy, isolation and effect tests are required. No universal safety claim.
Model selection is a policy decision
For each task, first determine permitted data location, allowed providers and required capabilities. Then select among qualified routes by measured task quality, queue delay, context needs and cost. A local-only task may wait or fail explicitly if local inference is unavailable; it must not silently fall back to a cloud API.
LimitA local model reduces prompt transfer to an external provider. It does not make telemetry, backups, updates or support local by itself. “Air-gapped” and “data never leaves” are withheld until tested.
Independent verification of both sides
A verifier uses separate evidence and acceptance checks. For containment, the actor probes must be denied with collector evidence and the benign reference transaction must still succeed. Missing telemetry is an incomplete verdict, not a green one.
LimitProposed later demonstration in an isolated lab. Lab infrastructure is not yet qualified.
Local DeepSeek on four DGX Sparks
IRONWARD is designed to work with API models and locally served models. Our local deployment plan uses DeepSeek on four NVIDIA DGX Sparks, with task routing governed by data policy, measured quality and available capacity. External benchmarks support investigating this configuration; IRONWARD’s own end-to-end performance still needs qualification.
Four 128 GB machines provide 512 GB of aggregate physical memory. That is not a single 512 GB allocation, and not the memory left after weights, runtime and context. The purchased configuration must be confirmed.
External benchmark records
Two separate external measurements of DeepSeek-V4.1-Flash on four DGX Spark GB10 nodes in a switchless ring with the TensorFold engine. AIFLOWLABS has not reproduced either. They are not merged or averaged, and neither is an IRONWARD result. The founder’s earlier 120 tokens/s estimate is withdrawn as unsourced and is not used.
| Record | Workload | Concurrency | Aggregate tok/s | Per request tok/s | Time to first token | Measured by |
|---|---|---|---|---|---|---|
| B1 | Single user decode | 1 | — | 70.2 | 32K prompt read in 8.8 s | External post, founder-supplied transcription |
| B1 | Decode | 8 | 139 | — | — | External post, founder-supplied transcription |
| B2 | Prose, thinking on | 1 | 65.8 | 65.8 | 186 ms | Recipe author, 25 Oct 2026 |
| B2 | Prose, thinking on | 8 | 165.3 | 21.7 | 901 ms | Recipe author, 25 Oct 2026 |
| B2 | Prose at 128K starting context | 8 | 132.3 | 19.2 | 4.67 s | Recipe author, 25 Oct 2026 |
| B2 | Code, thinking off | 1 | 117.4 | 117.4 | 192 ms | Recipe author, 25 Oct 2026 |
| B2 | Code, thinking off | 8 | 183.7 | 25.3 | 833 ms | Recipe author, 25 Oct 2026 |
| B2 | Cold prefill, 32,787 tokens | 1 | 4,127 prefill tok/s | — | 8.1 s | Recipe author, 25 Oct 2026 |
Aggregate throughput sums delivered output across concurrent requests; single-request throughput measures one request. Dividing an aggregate by the concurrency gives an arithmetic allocation, not a measured per-agent rate. Prefill and decode exclude scanner, queue, approval, tool and verification time. A fast answer with invalid tool arguments is failed work.
- B1Niklas Lenz, X post (returned 403 at retrieval; values transcribed by the founder)
- B2Mia’s AI Lab, DeepSeek-V4.1-Flash on 4× DGX Spark with TensorFold (retrieved 26 Oct 2026)
- NVIDIANVIDIA DGX Spark product page (checked 26 Oct 2026)
Before any IRONWARD number is published
- Pin node inventory, memory, OS and driver, interconnect, engine commit, recipe patches, weight revision and hash, quantization, tokenizer, context pool and licences.
- Qualify Prime against the actual endpoint: tool-call round trip, streaming, structured output, token accounting, cancellation and error behaviour.
- Test local-only denial of API fallback, including timeouts and retries. Record every allowed egress path.
- Compare 1, 2, 4 and 8 concurrent requests at fixed 4K, 32K and 128K inputs, cold and warm, prose and tool-use, at least three repetitions for screening.
- Run held-out IRONWARD tasks with equal tool access across local and API routes. Score correct findings, invalid tool calls, false remediation, verified fixes and end-to-end time.
Public claims register
Every statement on this site maps to one of these claims and keeps its status. A status is part of the content, not a footnote to remove for a cleaner design.
| ID | Claim | Status | Required wording or evidence |
|---|---|---|---|
| C01 | The product is IRONWARD by AIFLOWLABS | Confirmed direction | Founder-selected name; no trademark clearance implied. |
| C02 | 42 component specs and 63 work packets prepared | Prepared specification | Never described as implemented modules. |
| C03 | Small teams need better security follow-up | Buyer hypothesis | Interview and workflow evidence before any market-wide assertion. |
| C04 | Investigate, repair and independently verify | Planned capability | “Designed to”; requires exact-version accepted end-to-end results. |
| C05 | Approval and execution happen outside the AI | Planned capability | Policy, isolation and effect tests; no universal safety claim. |
| C06 | Cloud models and local DeepSeek on four Sparks | Confirmed direction, unqualified integration | Planned deployment; actual topology and versions identified when tested. |
| C07 | Local model speed | External measurement | Separate B1 and B2 records with workload, date and attribution; no IRONWARD benchmark claim. |
| C08 | Recovery after crashes | Planned capability | Requires specific fault-matrix results; no kernel-panic immunity. |
| C09 | Block two attackers while the business keeps running | Proposed later demonstration | Synthetic lab, design preview until qualification. Not real incident footage. |
| C10 | Paid pilot, subscription and local-market value | Commercial hypothesis | No customers, revenue, pricing validation or savings invented. |
| C11 | Delivery effort and build capacity | Planning estimate | Units, confidence, exclusions and new-scope caveat preserved. |
| C12 | Team experience and company eligibility | Missing founder input | Verified bios and company records; nothing fabricated. |
| C13 | Cyberport relationship and requested introductions | Proposed ask | “Seeking”; no admission, partnership, award or guaranteed access. |
| C14 | ironward.aiflowlabs.io | Confirmed future destination | “Website in preparation” until real publication is checked. |
| C15 | Locally controlled or uncensored model options | Requested technical direction | Separate checkpoint qualification; no permission or quality inferred. |
Words we use, and words we do not
| We say | We do not say |
|---|---|
| We are building | We protect companies today |
| External benchmark | Our cluster achieves |
| Verified in this defined lab scenario (after a qualifying run) | Stops attacks |
| Local inference option | Data never leaves |
| Prepared acceptance cases | Tests passed |