Adopt and diagnose

InferCrane can add control-plane evidence around an existing OpenAI-compatible workload without replacing it. Adoption is incremental and does not silently transfer lifecycle ownership.

Adopt an existing workload

infercrane adopt endpoint coder-production \
  --url https://vllm.internal.example/v1 \
  --model coder \
  --upstream-model Qwen/Qwen3-8B \
  --ownership observe-only

observe-only records health and evidence but never publishes a route. traffic-managed may route through the existing target after its qualified runtime health check succeeds. Neither mode creates, scales, updates, or deletes the imported workload. lifecycle-managed is available only through an InferCrane Deployment binding. The URL, source, logical model and physical upstream model form an immutable adoption identity. A safe retry returns the same adoption; changing immutable identity fails with a conflict.

Diagnose an adapter qualification gap

infercrane integrations --output json
infercrane models inspect MODEL_CATALOG_NAME --output json
infercrane observe coder-production --output json
infercrane doctor coder-production --window 1h

Read the evidence as an intersection, not a checklist of independently implemented parts:

registered means an adapter exists; it is not qualification.
local-qualified proves the maintained hermetic contract only.
experimental or in qualification requires the named real environment evidence.
a model recipe proves immutable configuration and license metadata, not GPU fit or protocol behavior.
unknown capability or missing exact-combination evidence fails closed.

Use compatibility to identify the missing provider/runtime/mode/model/accelerator evidence. If lifecycle qualification is absent but the existing endpoint is healthy, keep observe-only; move to traffic-managed only after direct protocol qualification. Do not choose lifecycle-managed for an externally owned workload. For a candidate revision that already exists, follow the retry-safe provisioning and validation procedure. It reuses the persisted revision and provider identities, checks orphan inventory, and preserves the active route. Adoption is the fallback only when the workload is genuinely externally owned; it is not a way to hide a failed InferCrane lifecycle operation. Promote ownership explicitly after reviewing health evidence:

The next command publishes a route through InferCrane. Verify upstream model identity, every client protocol, authentication behavior, streaming termination, and the ownership boundary first. It does not transfer create, scale, update, or delete ownership and does not change the existing upstream URL; keep clients on that URL until the managed path passes qualification.

infercrane adopt promote coder-production --ownership traffic-managed

Inspect one request

infercrane request inspect req_fa098a6488ec2bedcf025844adda5f45
infercrane request inspect req_fa098a6488ec2bedcf025844adda5f45 --output json

Use the X-Request-Id response header as the lookup key. The JSON result reconstructs one persisted request without reading prompt or output content:

Evidence	Fields
Stable application identity	`logical_model`, `endpoint`, `environment`, `serving_plan`
Selected route	`binding`, `deployment`, `revision`, `target`, `provider`, `runtime`, `compute_mode`
Timing	`queue_ms`, `ttft_ms`, `generation_ms`, `latency_ms`
Usage	`input_tokens`, `output_tokens`, `streaming`
Outcome	`status_code`, `retry_count`, `fallback_reason`, `error_type`
Privacy	`content_recorded: false`

For standalone managed replicas, target identifies the selected registered replica target. Some provider-native Serverless and external APIs do not expose a worker identity; InferCrane leaves that boundary unavailable instead of inventing a replica ID. Missing upstream timing or token fields are also reported as unavailable. content_recorded is always false: prompts, outputs, tool arguments, embedding vectors, and authorization values are not part of request evidence. Request lookup is tenant-scoped; an ID from another tenant is returned as not found rather than disclosed.

When the request ID is missing

InferCrane does not currently expose a broad request search endpoint. Without X-Request-Id, it cannot prove that one request record belongs to a particular client call. Do not infer an individual route from aggregate metrics. Preserve the incident window and inspect only evidence that can still be attributed safely:

infercrane observe coder-production --window 1h --output json
infercrane endpoint inspect coder-production --output json
infercrane rollout inspect coder-runtime --output json
infercrane events coder-runtime --output json
infercrane logs coder-runtime --since 1h
curl -fsS "$INFERCRANE_URL/api/v1/audit-events?limit=100" \
  -H "Authorization: Bearer $INFERCRANE_API_KEY"

Record endpoint, active/candidate plan, revision, event timestamps, aggregate sample window, status, and explicitly unavailable request-level fields. Keep the current active plan and policy unchanged: do not run endpoint promote, rollout promote, admission set, or another mutation whose decision depends on the missing correlation. If policy requires request-level auditability, the correct outcome is an unauditable incident and a stopped change, not a reconstructed request ID. Capture X-Request-Id at the application or ingress boundary before retrying the qualification. For slow or unreachable providers, uncertain buffered/streaming outcomes, duplicate-submission prevention, and provider ownership reconciliation, use the Provider outage runbook.

Deterministic Doctor

infercrane doctor coder-production --window 1h

Doctor persists reproducible Evidence → Rule → Finding results. Current rules cover unavailable endpoint routes, statistically bounded elevated error rate, and queue-dominant latency. A healthy result explicitly reports that no deterministic issue is active; it does not guess a cause.

Signed alerts

infercrane secret create alert-signing --from-env INFERCRANE_ALERT_SIGNING_SECRET
infercrane alert configure coder-production \
  --webhook https://alerts.example.com/infercrane \
  --secret-reference sec_123 \
  --minimum-severity warning
infercrane alert evaluate coder-production

Deliveries include InferCrane-Delivery, InferCrane-Timestamp, and InferCrane-Signature: v1=<HMAC-SHA256>. The signed input is <timestamp>.<exact request body>. Delivery is idempotent per policy/finding, retries are bounded, and public-network validation rejects private, loopback, link-local and unspecified destinations by default. Resolved signing secrets are never persisted or returned.

Adoption does not import provider credentials or guarantee ownership of the workload. Keep the existing workload available until traffic-managed health and request evidence have been verified.

Start here

Deploy and connect

Operate

Evidence and decisions

Adopt an existing workload

Diagnose an adapter qualification gap

Inspect one request

When the request ID is missing

Deterministic Doctor

Signed alerts

​Adopt an existing workload

​Diagnose an adapter qualification gap

​Inspect one request

​When the request ID is missing

​Deterministic Doctor

​Signed alerts

Adopt an existing workload

Diagnose an adapter qualification gap

Inspect one request

When the request ID is missing

Deterministic Doctor

Signed alerts