feat: content-addressed, hash-chained model carry manifest - #20
Merged
Conversation
5 tasks
Adds ModelCarryManifest: a content-addressed catalog for the model-router carry layer that names every base and adapter with a verifiable identity, targeting predicate, authoritative SHA-256 content hash, and policy hash. Closes three gaps from the SourceOS-vs-Apple model-carry analysis: - no content-addressed model manifest (identity asserted, not verifiable); - adapter/base version binding not enforced (silent drift at deploy); - integrity-checked transport not an invariant. Teeth (tools/validate_model_carry_manifests.py, wired into make validate): - SHA-256 authoritative (FIPS 180-4); content+policy hashes non-null; - integrityFailureIsHardStop and transportMustBeIntegrityChecked const true; - manifest hash-chain (genesis-only null prev link); - adapter must bind to an existing base and pin its exact content hash. Includes valid example plus negative fixtures for adapter/base drift, missing base, and soft integrity.
mdheller
force-pushed
the
feat/model-carry-content-addressed-manifest
branch
from
August 3, 2026 05:51
349e8fe to
52d3e71
Compare
mdheller
added a commit
that referenced
this pull request
Aug 3, 2026
Adds ConfidentialComputeEscalation (SourceOS-vs-Apple ModelCarry spec section 5.2): model execution escalates to a higher confidential-compute tier (on_device -> sealed_enclave -> attested_tee) based on the data-residency / sensitivity class of the inputs, and the escalation decision is governed and receipted. - contracts/confidential-compute-escalation.schema.json: ordered compute tier lattice, sensitivity/residency class -> minimum-tier map, and a receipted decision record (chosen tier + reason + attestationRef + SHA-256 receipt). SHA-256 is the authoritative receipt hash (FIPS 180-4). - tools/validate_confidential_compute_escalations.py: structural validator with teeth, wired into make validate. Teeth (fail-closed is the core invariant): - a request satisfied by its chosen tier VERIFIES; - a request run BELOW its required minimum tier is REJECTED; - a chosen tier requiring attestation with no attestationRef is REJECTED; - a non-monotonic tier lattice is REJECTED; - an undeclared sensitivity class is REJECTED (never defaulted). Follow-up (@mdheller): live TEE attestation verification; governed staged pre-load + atomic swap (#21). Refs #22, #20.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Integrates the near-term recommendations from the SourceOS-vs-Apple ModelCarry analysis (spec-intake 2026-08-03) into the canonical carry surface as spec-as-code with teeth.
Adds
ModelCarryManifest— a content-addressed, hash-chained catalog the model-router carries — naming every base model and adapter with a verifiable identity, a targeting predicate, an authoritative SHA-256 content hash, and a policy hash. The model-layer analogue of Exodus provenance: model identity is verifiable, not asserted.Why (gaps closed)
contracts/model-carry-manifest.schema.jsoncontentSha256integrityFailureIsHardStop/transportMustBeIntegrityCheckedconsttrueTeeth
tools/validate_model_carry_manifests.py(wired intomake validateviavalidate-model-carry-manifest) enforces:baseContentSha256equal to that base'scontentSha256.Ships a valid example plus negative fixtures: adapter/base drift, missing base, and soft integrity. Verified locally:
make validate-model-carry-manifestpasses (valid accepted, all three negatives rejected).Boundary
Reference/verification object only. Does not authorize runtime execution, prompt egress, tool use, model download, training, or promotion — consistent with the carry-only doctrine.
Follow-ups (filed as issues)
🤖 Generated with Claude Code