By Herd Latch editorial team · Last verified [date] · Current release [tag]
Runner versus models
The runner is MIT. Each model you pull carries its own licence. Safety reviews should separate those facts.
Official doors
Prefer GitHub Releases, verified winget, and the Homebrew desktop cask. Map: download safely.
Large Setup files
The Windows Setup executable is large. Complete downloads matter. Partial files cause confusing failures that look like malware drama but are often truncated bits.
Network exposure
Keep the local API on loopback for day-one labs. Opening ports needs an explicit network decision.
Pillar: home. Policy: editorial.
Lab checklist habits
Write the installer door beside the machine name before you image a room. Include whether winget, the Windows Setup executable, the Homebrew cask, or the Linux install script was blessed for that ring.
Prove one short CLI chat after every reimage. That single step catches vanished PATH entries, truncated downloads, and adware shortcuts that reappear from old browser folders.
- Record the GitHub tag used for the golden image.
- Note free disk space before large model pulls.
- Keep the local API on loopback until network review says otherwise.
Support tickets that resolve faster
Ask for the operating system build, the door used, and the exact CLI error text. Vague reports that only say artificial intelligence feels wrong waste a day. Attach version command output when the user can copy it.
Proxy desks should test one model pull on a clean path once, then document any required exception. Offline classrooms should pre-stage weights on a well-connected machine instead of launching twelve simultaneous downloads on demo day.
Update and rollback notes
Pick one update door per room and stick to it for a semester. Mixing winget, Setup, and brew without notes creates version drift tickets. Keep the previous Setup on trusted media so rollback is a file copy, not a scavenger hunt.
After an upgrade, prove a small chat again before you seal the image. Large experimental model tags belong on scratch accounts, not on the shared golden profile.
Everyday controls after a clean install
Set expectations for disk growth before the first large pull. Shared lab profiles fill quietly when every student downloads a different multi-gigabyte tag. Publish an allow-list of blessed model names and delete strays during maintenance.
Teach the list and remove commands early so libraries stay reviewable. Custom Modelfiles can wait until the default chat path is boringly reliable. When a course depends on a fixed system prompt, store that Modelfile in version control beside the lab sheet.
Network exposure belongs in a separate decision. Day-one success is a local prompt on loopback, not a public URL. VPN and proxy desks should document one known-good pull path so timeouts do not look like broken Setup.
Classroom and travel notes
Travel laptops on battery may throttle large models. Prefer smaller tags for demos on the road. Docked lab towers with supported GPUs finish longer prompts faster, while CPU-only boxes still work for tiny models when you set expectations.
After imaging season, freeze the golden machine only after a reboot test. Logon scripts and antivirus first-scan delays hide problems that a same-session demo misses. The boring reboot test saves weekend emergency calls when PATH or services start late.
Internal runbooks should quote the winget id, the brew cask token, and the Releases URL without marketing adjectives. Staff skim under stress. Five checkboxes beat a three-page essay that nobody finishes.
Filename matching without drama
Match the GitHub asset name character for character before you override SmartScreen or Gatekeeper. A mismatched publisher string is a reason to delete the file, not to click through faster. Advertising portals that wrap the same search intent with toolbars are the common failure mode.
When bandwidth is limited, schedule the large Windows Setup download overnight and keep the browser shelf visible until the size matches what Releases shows. Partial files cause confusing launch errors that look like security drama but are often truncated bits.
Related reading: the home install panel, the first-hour checklist, and the guides hub.
Frequently asked questions
Is the runner open source?
Yes. Upstream licence is MIT on the public GitHub repository. Prefer official doors, then prove one CLI chat after install so PATH and library paths are confirmed on that machine.
Are mirrors safe?
Advertising mirrors that rename Setup are the common risk. Match filenames to GitHub Releases before you trust a download. Prefer official doors, then prove one CLI chat after install so PATH is confirmed on that machine.
What about model licences?
Model weights have their own terms separate from the MIT runner. Read them before redistribution onto USB drives. Prefer official doors, then prove one CLI chat after install so PATH is confirmed.