Files
ModelForge/docs/security/QUARANTINE_AND_VERIFICATION.md

24 lines
1.6 KiB
Markdown

# Quarantine and Verification
Every selected file first lands below `<approved-root>/.quarantine/<job-id>`. Repository paths are
normalized as relative POSIX paths, traversal and absolute paths are rejected, resolved paths must
remain beneath the root, and symlink roots/files are blocked. The agent runs non-root with a
read-only container filesystem, dropped capabilities and narrow data mounts.
Verification never imports or deserializes model content. It checks regular-file size, streams
SHA-256 in bounded chunks, compares available upstream LFS SHA-256, parses only the bounded JSON
header of Safetensors, inspects small JSON configuration for `auto_map`, and blocks known
pickle/executable serialization and repository Python. `trust_remote_code=false` is the invariant.
Hub scanner signals remain separate upstream evidence.
All required files must pass before the job-scoped directory is atomically renamed to
`repositories/<repo>/<exact-sha>`. Only then does the agent report completion. The control plane
validates the report against the immutable plan and transactionally creates `ModelArtifact`,
`ArtifactLocation`, `ArtifactInspection`, and `ArtifactSetMember` records. The set becomes
`availability=local`, `completeness=complete`, and `status=verified`; its security state is
`static_checks_passed_unapproved`, not supply-chain approved.
Failed or cancelled work never creates verified DB records. Retained partials remain job-scoped for
safe retry; cleanup is an explicit lifecycle operation. A manifest beside promoted bytes records
job, repository, commit and file digests for crash reconciliation.