Two posts on this site already cover LFM3-Harness in depth and the LFM3 model family behind it. This one is the practical companion: what to do on a machine you actually own, in the order you should do it, and the checks that catch the two failures that waste the most time — a bad download and a port that is already occupied.
Everything below describes version 0.1.1 as the project documents it on November 2, 2026. The app is an independent community project: MIT-licensed, not affiliated with Liquid AI, and honest in its own README about the parts that are unfinished. Read the limitations section before you invest an evening in it.
Verification note: what is quoted, what is measured
- Code behaviour and limits are quoted from the LFM3-Harness source and README at v0.1.1 — confidence floors, timeouts, round caps, acceptance contracts and process supervision — with file paths given so each claim can be checked.
- Packaging facts — installer size, bundle formats, artifact byte counts and SHA-256 hashes — come from the project site and the repository's release notes.
- Model facts — parameter counts, context windows, licences and weight sizes — come from Liquid AI's model cards and launch post. LFM3-Harness is an independent community project, not affiliated with Liquid AI.
- Benchmark numbers are the project's own measurements on one machine in one run (multimodel, 2026-10-31; the 50-job agent suite), not independently replicated here, and are reported with the project's caveats attached.
- This guide is assembled from the README, release artifacts and project site. Local AI Zone did not install or run the app to produce it, so treat the commands as documented procedure rather than a tested transcript.
1. What you are actually installing
The download is about 15 MB. That is the entire application: a Tauri 2 desktop shell around an embedded Rust engine. There is no Python sidecar, no local engine HTTP server, and no shell tool. The models are not in the installer. They are downloaded separately, inside the app, and they total roughly 4.9 GB.
At runtime the app supervises four llama-server children, each pinned to loopback and each given a fixed command line built in one place. The application code is MIT. The weights belong to Liquid AI and ship under the LFM Open License, which is a different document with different terms — read it if you intend to redistribute anything.
2. Check the machine first
| Component | Requirement | Why it matters |
|---|---|---|
| Operating system | Windows 10/11 x64, or Linux x64 | There is no macOS build in v0.1.1. |
| Linux desktop libraries | WebKitGTK 4.1 and GTK 3 | The webview will not start without them, including when you use the AppImage. |
| RAM | 8 GB minimum | About 4.9 GB of weights, plus KV cache, webview and OS. |
| Free disk | About 5.5 GB | Install, four model files, and the run journal. |
| GPU | Not used | Every server is launched with -ngl 0; CPU only, by design. |
| Network | Downloads only | After the weights land, traffic is loopback on ports 8080–8083. |
If you were hoping to point this at a GPU box on your network, note that the packaged build refuses non-loopback endpoints outright. The offline claim is enforced in the binary, not promised in a policy page.
3. Pick the folder before you install
The folder you choose is the entire permission surface. The assistant can list, read and search inside it, and it can propose edits inside it. It cannot open a shell, browse the web, or reach a path outside it — every model-supplied path is resolved and rejected before the filesystem is touched if it tries to escape through .., an absolute path, a symlink or a Windows device name.
Three habits make the first session boring, which is the goal:
- Give it a copy, not the original. Create a working folder, copy the documents into it, and keep your only copy elsewhere.
- Keep secrets out. Read access is confined to the folder, but the model can still read everything in it. Do not put keys, tokens or client material there.
- Prefer something versioned or backed up. If the folder is a git repository or a synced directory, a bad edit is recoverable.
4. Download, then verify the hash
The project publishes a SHA-256 hash for every artifact on lfm3-harness.github.io. Verify before running anything. This is not ceremony: the Windows installer is unsigned, so the hash is the only integrity signal you get.
On Windows, in PowerShell:
Get-FileHash .\LFM3-Harness-Setup.exe -Algorithm SHA256 | Format-ListOn Linux:
sha256sum ./LFM3-Harness.AppImageCompare character by character with the published value. A mismatch means a truncated or tampered download: delete the file and fetch it again from the project site rather than from a mirror you found somewhere else.
5. Install the app
Windows. Run the NSIS installer normally. SmartScreen will warn you because the build is unsigned — that is documented, not a red flag on its own. Confirm the hash first, then choose the option to run it anyway. Installing to a path containing spaces is supported; the project's own smoke test installs into a directory with spaces on purpose.
Linux. The .deb installs with apt:
sudo apt install ./lfm3-harness_0.1.1_amd64.debThe AppImage needs no installation, but it still needs the system desktop libraries:
chmod +x ./LFM3-Harness.AppImage
./LFM3-Harness.AppImageBoth bundles still need WebKitGTK 4.1 and GTK 3 present on the system. If the window never appears and the terminal mentions a missing webkit2gtk-4.1 or GTK 3 library, install those packages and try again; the project's Linux bootstrap script prints the exact command when they are missing. This is the single most common Linux first-run failure.
6. First launch: the 4.9 GB download
Nothing downloads on its own. Open Models in the chat header and start each role's download explicitly; the app streams it to a partial file, checks the published byte length and SHA-256, and only then moves it into place. The four files have separate jobs:
| Role | Model | Weight size | Loopback port | Context |
|---|---|---|---|---|
| Actor / writer | LFM3-1.7B | 1.10 GB | 8080 | 32,000 |
| Router / judge | d1-2B | 1.10 GB | 8083 | 8,192 |
| Vision | LFM3-VL-2B | 1.25 GB | 8081 | 8,192 |
| Voice | LFM3-Audio-2B | 1.40 GB | 8082 | 8,192 |
The downloads happen inside the app and are verified, and the packaged build does not accept user-supplied download switches or an external server URL. When a model file is ready, the engine starts its server with a fixed command line — a hallucinated flag has nowhere to go — then polls that server's identity endpoint. If the model answering on a port is not the model that port is assigned to, the boot fails hard with an identity mismatch rather than quietly running the wrong weights.
Expect the first start of each server to take a while and the machine to feel heavy. Four processes holding roughly 4.9 GB of weights plus their caches is the normal state, not a leak.
7. Your first chat, and what the approval card means
Chat is the default mode. A router classifies each message into one of seven intents — general, explore, summarize, related, report, vision, voice — and the intent only decides which capabilities get hinted to the writer. It never grants permission to write. Messages shorter than 24 characters skip the model entirely, and a route is only accepted at 55% confidence or better; below that, a keyword table decides.
When you ask for a change, three things stand between the proposal and the file:
- Path resolution — the target must be inside your folder, canonically, after symlinks and platform quirks are accounted for.
- A preflight gate — a separate decision model, not the writer, scores the proposal against your actual request at a 75% confidence floor. A confident contradicts becomes a hold: no approval card is shown at all, nothing is written, and the writer is told not to retry. A confident uncertain adds an advisory note instead. Below the floor, or after a 12-second timeout, the gate abstains and your approval decides.
- You — a surviving proposal arrives as an exact diff, in a review expander, with Allow once and Deny. There is no allow-always, and approvals expire after ten minutes; an old card cannot be applied later.
If a card never appears, a confident contradiction is the likely reason, not a bug. The refusal message names the target and the confidence it scored.
8. Run a verified task
Free chat is gated but conversational. Verified tasks are stricter: the mission carries a frozen acceptance contract, hashed with SHA-256 the moment it loads, and only the deterministic checks in that contract decide whether the task passed. Checks are things like file exists, content matches, content absent, JSON schema, numeric consistency, report complete. The model's opinion is not one of them, and the contract cannot be weakened during retries or replanning.
Of the four missions shipped in v0.1.1, only desk_task has passed end-to-end acceptance against real models. Its reference run completed in 5.99 seconds with a peak llama-server memory of about 1.6 GB, writing its required artifact to out/summary.md. The other three — screen QA, voice intake and document extraction — are explicitly marked human-review-only, because the qualification run that would justify automatic grading has never been performed. That is a deliberate refusal, and it is the most trustworthy thing in the release.
9. Troubleshooting the first hour
| Symptom | Likely cause | What to do |
|---|---|---|
| SmartScreen blocks the installer | Build is unsigned | Verify the SHA-256, then run it anyway. |
| A model server will not start | Something else owns 8080–8083 | Find the listener (netstat -ano | findstr :8080 on Windows, ss -ltnp on Linux) and stop it. |
| Boot fails with an identity mismatch | Wrong or partial weights on a port | Re-download that model; do not rename files between roles. |
| The window never opens on Linux | Missing WebKitGTK 4.1 or GTK 3 | Install the desktop libraries; the AppImage still needs them. |
| Download stops partway | Interrupted transfer | Restart it in the app; the file is verified before use. |
| “finish refused: … does not exist or is empty” | The guard doing its job | Let it keep working, or restate the deliverable. Nothing was written. |
A llama-server is still running after a crash | The parent was force-killed | End it in Task Manager or with ps. Normal exits are cleaned up by the supervisor. |
10. What it will not do
The writer is a 1.7B model on a CPU. Its prose is 1.7B-grade, its planning is short-horizon, and the project's own 50-job benchmark passes 43/50 with two false passes and a 1/5 score in its weakest category, search. One mission is end-to-end qualified; three are not. Every benchmark figure is one machine and one run.
There are also documented rough edges worth knowing before you file a bug: output token caps are hardcoded in the executor and planner rather than read from the configured limit, in-app voice playback is exercised only at the component level, interrupted jobs are reported as interrupted rather than resumed, and there is no macOS or GPU build. Set your expectations at “a careful 2B assistant inside one folder” and the app is coherent; set them at “a local Claude” and it is not.
11. A five-minute hygiene checklist
- Hash verified against the project site before the first launch.
- Working folder is a copy, under version control or backed up.
- No credentials, keys or client data inside the folder.
- Nothing else listening on 8080–8083.
- First write reviewed in the diff view, not accepted from the summary line.
If you want the reasoning behind those gates rather than the steps, read the source-level deep dive. If you want to port the gates into your own agent, the verification-patterns guide is the companion piece.
Frequently asked questions
How much RAM does LFM3-Harness need?
The project states a minimum of 8 GB on a CPU-only x64 machine. The four weights total about 4.9 GB, and they run alongside the KV cache, the webview and the operating system. There is no GPU path: every model server is launched with GPU offload disabled.
Why does Windows SmartScreen warn about the installer?
Because the 15.2 MB NSIS installer is unsigned. The project publishes a SHA-256 hash for every artifact instead of paying for code signing, so hash the file you downloaded, compare it to the published value, and only then run it.
Does it work on macOS or with a GPU?
No to both, as of v0.1.1. Builds are Windows 10/11 x64 and Linux x64 only, and the engine deliberately launches every server with -ngl 0, so a GPU is not used even when one is present.
Why did the assistant say “finish refused”?
Because that guard is working. The harness rejects a completion claim unless the promised deliverable exists and is non-empty on disk, and asks the actor to re-read the output before finishing. It is a refusal of an unproven claim, not an error.
Which ports does the app use?
Four loopback ports: 8080 for the text actor, 8081 for vision, 8082 for audio and 8083 for the decision model, all pinned to 127.0.0.1. Anything else listening there will prevent a server from starting.
References
- LFM3-Harness project site — lfm3-harness.github.io: downloads, published SHA-256 hashes, model table, FAQ, accessed November 2, 2026.
- LFM3-Harness/LFM3-Harness — README.md (requirements, architecture, Known gaps), PLAN.md and STEPS.md, accessed November 2, 2026.
- Liquid AI LFM3 model cards and the LFM Open License, for the weights themselves.
- Local AI Zone: LFM3-Harness Deep Dive and LFM3: A Technical Deep Dive.