24 lines
1.6 KiB
Markdown
24 lines
1.6 KiB
Markdown
# Quarantine and Verification
|
|
|
|
Every selected file first lands below `<approved-root>/.quarantine/<job-id>`. Repository paths are
|
|
normalized as relative POSIX paths, traversal and absolute paths are rejected, resolved paths must
|
|
remain beneath the root, and symlink roots/files are blocked. The agent runs non-root with a
|
|
read-only container filesystem, dropped capabilities and narrow data mounts.
|
|
|
|
Verification never imports or deserializes model content. It checks regular-file size, streams
|
|
SHA-256 in bounded chunks, compares available upstream LFS SHA-256, parses only the bounded JSON
|
|
header of Safetensors, inspects small JSON configuration for `auto_map`, and blocks known
|
|
pickle/executable serialization and repository Python. `trust_remote_code=false` is the invariant.
|
|
Hub scanner signals remain separate upstream evidence.
|
|
|
|
All required files must pass before the job-scoped directory is atomically renamed to
|
|
`repositories/<repo>/<exact-sha>`. Only then does the agent report completion. The control plane
|
|
validates the report against the immutable plan and transactionally creates `ModelArtifact`,
|
|
`ArtifactLocation`, `ArtifactInspection`, and `ArtifactSetMember` records. The set becomes
|
|
`availability=local`, `completeness=complete`, and `status=verified`; its security state is
|
|
`static_checks_passed_unapproved`, not supply-chain approved.
|
|
|
|
Failed or cancelled work never creates verified DB records. Retained partials remain job-scoped for
|
|
safe retry; cleanup is an explicit lifecycle operation. A manifest beside promoted bytes records
|
|
job, repository, commit and file digests for crash reconciliation.
|