[Release] Ship an immutable commercially admissible separation model artifact

[seonghobae]

Buyer-visible gap

BandScope needs a commercially admissible, immutable local source-separation model artifact for supported Windows/macOS releases. The current Draft Signal/MIR compatibility path can consume an already-present Demucs htdemucs cache object without hidden network fallback, but #1181 establishes that the upstream pretrained weights are not commercially releasable on the currently documented basis.

This issue owns the Distribution/update artifact contract, not MIR accuracy and not the legal decision itself. #770 remains the scientific real-audio acceptance owner. #1181 owns the upstream pretrained-weight rights prerequisite. Resource Admission/Project Persistence and Signal/MIR must not copy model-delivery logic.

Current technical baseline

#970 now does more than a path preflight:

• it opens the registered local cache object with no-follow semantics where supported and verifies opened-descriptor identity;
• it rejects missing, non-regular, empty, over-limit, or checksum-mismatched cache state before model resolution;
• it copies only the admitted descriptor bytes into a private temporary local Demucs repository;
• it calls get_model(signature, repo=snapshot_root), keeping upstream resolution on LocalRepo rather than RemoteRepo;
• a later deletion or replacement of the original torch-cache pathname therefore cannot change the bytes deserialized for that load or reactivate the remote resolver;
• the compatibility snapshot is capped at 128 MiB before materialization;
• RED f4ef3dc86e34432936b2febb152991af70e57bd1 → fix 0d0c6c3263e9b72b5aec554c1824de3d004b5831 binds materialization to the descriptor size observed at fstat: early EOF and any extra post-preflight byte fail before resolver/deserialization;
• RED 3ae3646087f6fe2ae6a9aa709025720fc40beb6c → fix 0d9fb9f983a093fe3868106945677dfa58d10bba rejects PyTorch's documented TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD downgrade before Demucs import/resolution, so inherited process state cannot turn the upstream implicit checkpoint load into unrestricted pickle deserialization;
• RED 4d0b16b6ace0bad9ef5b91fc996034b1ae4001c8 → fix 000fdb57e212be5f08a328bb677be4e0ae1ebb24 rejects PyTorch's documented TORCH_DEVICE_BACKEND_AUTOLOAD=1 before Demucs/torch import, so inherited process state cannot auto-import out-of-tree backend extensions into the CPU-oriented compatibility path.

Upstream code also makes the remaining serialization risk concrete. demucs.states.load_model calls torch.load(path, 'cpu') for path-based packages, then obtains klass, args, kwargs, and state from that serialized package and instantiates the class. That is a code-bearing trusted-artifact boundary, not a passive tensor-file read. PyTorch documents that TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD changes an implicit torch.load to weights_only=False, and separately that TORCH_DEVICE_BACKEND_AUTOLOAD=1 imports out-of-tree backend extensions on import torch. Therefore a release that retains native PyTorch/Demucs loading must own both deserialization and backend-import environment semantics. The private snapshot closes pathname and byte-race problems; it does not make arbitrary checkpoint or backend code execution safe.

These controls are Draft runtime compatibility evidence only. The eight-hex Demucs filename checksum is truncated upstream integrity evidence, and the 128 MiB ceiling is a generic safety limit. Neither is an immutable release manifest, full provenance receipt, commercial-rights basis, or substitute for a safer release serialization boundary.

Required outcome

A supported Windows/macOS BandScope installation contains, or can install through an explicit separately authorized product flow, an immutable source-separation model artifact that ordinary local analysis can open without any implicit remote fallback.

The admitted artifact may be the exact upstream htdemucs weights only if #1181 is resolved by explicit commercial-use/redistribution rights covering the intended BandScope use and distribution. Otherwise Distribution must package a commercially admissible replacement or CWL-owned/retrained model whose model-weight and training-data rights are traceable.

Acceptance criteria

• Commercial model-use and redistribution basis is documented with primary evidence for the exact artifact.
• Exact model identity/version, exact byte size, full SHA-256 digest or stronger signed manifest, and provenance are immutable release inputs.
• The actual shipped model is tracked in supply-chain/supplemental-component-inventory.json; ecosystem SBOM + supplemental inventory + NOTICE explain the packaged desktop contents.
• The artifact is packaged into signed Windows and signed/notarized macOS release graphs with deterministic placement and bounded storage.
• Ordinary analysis uses a local-only loader that consumes only the verified released artifact. No RemoteRepo, implicit load_state_dict_from_url, hidden model download, paid fallback, or developer torch-cache prerequisite is reachable.
• Artifact bytes are verified against the exact release manifest before deserialization/model load; symlink/reparse/path substitution, corrupt/truncated/oversized artifacts, descriptor-size drift, and incompatible app/model versions fail closed with bounded diagnostics.
• The updater defines model/app compatibility, migration, rollback, partial-update recovery, and disk-space behavior so app/model versions cannot silently diverge.
• Release architecture explicitly chooses the model serialization boundary. Prefer a non-code-executing or materially narrower artifact format such as safetensors/ONNX when it can preserve the required model and metrics. If native Demucs/PyTorch checkpoint deserialization remains necessary, document why, bind it to immutable full-digest/signature provenance, isolate the loader as narrowly as practical, and define a removal condition.
• Loader/runtime security semantics cannot be weakened by inherited process environment. If an owned or third-party call still leaves weights_only implicit, TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD and equivalent downgrade controls are rejected or neutralized before deserialization. If the released CPU path does not explicitly package and admit out-of-tree backends, TORCH_DEVICE_BACKEND_AUTOLOAD=1 is rejected before importing torch. Negative tests run on every packaged platform.
• Any intentionally supported accelerator/backend is explicit, versioned, packaged, inventoried, signed, and admitted by the release contract; inherited backend autoload is not a capability-discovery mechanism.
• No claim that weights_only=True or a filename checksum alone solves this boundary unless the exact packaged model is demonstrated to load under that restriction and the allowed object graph is documented; current upstream Demucs packages include class/constructor metadata.
• The exact packaged model is exercised on supported Windows/macOS with rights-cleared real decoded audio and linked to [Product Gap] Add real-audio MIR accuracy acceptance benchmarks #770's recognized source-separation metrics, uncertainty, and claim boundary.
• Release evidence links exact app/model/backend hashes, signing/notarization identity, SBOM/provenance, updater/rollback state, and offline audible-analysis receipts.
• Public/release documentation does not imply model rights or quality beyond the actual evidence.

Security Notes

Attack surface

Model artifact acquisition, package extraction, filesystem lookup, integrity verification, inherited loader/backend environment, Python/native extension import, PyTorch/model deserialization, temporary compatibility snapshots, updater replacement, rollback, and release inventory.

Trust boundary

Distribution owns remote acquisition/package provenance and immutable artifact/backend delivery. Signal/MIR may consume only an admitted local artifact through a narrow verified adapter. #970's torch-cache snapshot and pre-import environment guards are technical compatibility controls, not Distribution authority. #1181 owns whether the upstream pretrained weights are legally admissible at all.

Upstream Demucs LocalRepo narrows where the model is loaded from, but demucs.states.load_model still performs torch.load(path, 'cpu') and consumes serialized class/constructor metadata. PyTorch may also import out-of-tree backend extensions if process environment enables backend autoload. Therefore release trust must be established before those boundaries, or the release model/backend format must remove them. A default-safe PyTorch version is insufficient if inherited process state can reverse deserialization or import defaults.

Realistic threats

• missing weights trigger an implicit network fetch;
• a compromised, corrupt, oversized, growing, or truncated local object reaches deserialization or exhausts storage;
• a symlink/reparse/path substitution changes the model after verification;
• a malicious or incorrectly admitted native checkpoint exploits code-bearing deserialization semantics;
• inherited TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD state downgrades an implicit third-party checkpoint load to unrestricted pickle;
• inherited TORCH_DEVICE_BACKEND_AUTOLOAD=1 causes unadmitted out-of-tree backend extension code to load during torch import;
• an app/model/backend update mismatch silently changes separation behavior;
• rollback leaves an incompatible artifact or backend;
• a scientific-use-only upstream checkpoint is packaged as a commercial dependency;
• a mirror/conversion is mistaken for a new rights grant;
• logs or artifacts expose local paths or acquisition credentials.

Mitigations

Exact artifact allowlist, exact size, full digest/signature verification, regular-file/no-link or descriptor-bound acquisition, exact-size private materialization, local-only resolver, explicit loader/backend environment policy, rejection of inherited unsafe overrides/autoload, signed release/update manifests, bounded storage, explicit version compatibility, fail-closed offline behavior, rights evidence tied to the artifact, a documented serialization/backend choice and removal condition, and release-time Windows/macOS real-audio execution.

Remaining risk

#970 closes the documented mutable torch-cache reopen/remote-fallback, post-preflight descriptor-size-drift, inherited no-weights-only downgrade, and inherited backend-autoload paths for its Draft compatibility load by resolving an exact-size private snapshot through LocalRepo and refusing unsafe pre-import process state. The remaining release gap is different: the repository still lacks a commercially admitted Distribution-owned model/backend artifact set with full immutable provenance, and #1181 currently blocks commercial use/redistribution of the upstream pretrained htdemucs weights absent an explicit grant.

Native Demucs checkpoint loading also remains a trusted deserialization boundary because upstream load_model uses torch.load and serialized class metadata. A technically sound checksum/snapshot/environment guard cannot by itself remove that risk. Conversely, a rights grant alone cannot replace #770 scientific acceptance, immutable package provenance, serialization/backend hardening, or updater/rollback evidence.

Test points

• missing, modified, oversized, size-racing, symlinked, or non-regular compatibility cache object never reaches model resolution;
• mutation of the original cache pathname after snapshot acquisition does not change resolver bytes;
• truthy TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD cannot reach the implicit upstream loader;
• TORCH_DEVICE_BACKEND_AUTOLOAD=1 cannot import an out-of-tree backend on the CPU-oriented released path before admission;
• exact release artifact full digest/size/signature mismatch fails before deserialization;
• exact release artifact serialization/backend/environment policy is exercised on every supported platform, including negative corrupt/object-graph/downgrade/autoload cases where applicable;
• ordinary packaged analysis performs no hidden model or backend network request;
• updater interruption and rollback preserve a compatible admitted model/backend set;
• Windows/macOS packaged builds execute rights-cleared real audio through the exact released artifact;
• [Product Gap] Add real-audio MIR accuracy acceptance benchmarks #770 report records recognized source-separation metrics and claim boundaries.

Traceability

• docs/traceability/demucs-local-model-admission.md
• docs/traceability/pytorch-runtime-environment-admission.md
• fix(project): stage saves before atomic publication #970 current integration lineage for local technical model admission
• licensing: Demucs pretrained weights are scientific-use only; block commercial packaging #1181 for upstream pretrained-weight commercial rights
• fix(supply-chain): correct unused model inventory claims #1054 for correction of prior inaccurate model inventory claims
• [Product Gap] Add real-audio MIR accuracy acceptance benchmarks #770 for scientific real-audio accuracy acceptance

References

Défossez, A., Usunier, N., Bottou, L., & Bach, F. (2021). Music source separation in the waveform domain. Transactions of the International Society for Music Information Retrieval, 4(1), 197–208. https://doi.org/10.5334/tismir.76

Rouard, S., Massa, F., & Défossez, A. (2023). Hybrid transformers for music source separation. Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). https://doi.org/10.1109/ICASSP49357.2023.10097003

Défossez, A. (2022). Re: License of pre-trained models (Issue comment 1134828611). facebookresearch/demucs (Issue #327). facebookresearch/demucs#327 (comment)

Meta Platforms, Inc. (2023). demucs.pretrained: loading pretrained models. facebookresearch/demucs. https://github.com/facebookresearch/demucs/blob/v4.0.1/demucs/pretrained.py

Meta Platforms, Inc. (2023). demucs.repo: remote and local model repositories. facebookresearch/demucs. https://github.com/facebookresearch/demucs/blob/v4.0.1/demucs/repo.py

Meta Platforms, Inc. (2023). demucs.states: model serialization/loading. facebookresearch/demucs. https://github.com/facebookresearch/demucs/blob/v4.0.1/demucs/states.py

PyTorch Contributors. (2026). Miscellaneous environment variables. PyTorch documentation. https://docs.pytorch.org/docs/stable/miscellaneous_environment_variables.html

[seonghobae]

Fresh consumer evidence from Project Persistence / Signal-MIR exact lineage: services/analysis-engine/uv.lock currently resolves torch==2.12.1, while Demucs 4.0.1 compatibility loading still consumes native serialized package metadata. PyTorch changed torch.load to default weights_only=True starting in 2.6 when no custom pickle module is supplied. A checksum-valid local technical cache can therefore fail with pickle.UnpicklingError when a serialized Demucs global is not admitted by the weights-only loader.

#970 now carries RED 5789562e716d955c758a7eb728140c5fcb02f779 → fix d395c6055bb16cfc4a76f490f16e9e6540590fae: Signal/MIR converts that identified compatibility failure to the existing bounded local-model-unavailable diagnostic and deliberately does not set weights_only=False, re-enable remote resolution, or treat the compatibility cache as a commercially trusted object graph. TRACEABILITY is being kept with the source lineage.

Please retain this as Distribution acceptance evidence: the eventual immutable commercial model artifact must prove its exact serialization/loader contract under the exact shipped PyTorch/runtime stack. If native PyTorch/Demucs serialization remains necessary, require full immutable provenance/signature, an explicit allowed-object/loader-isolation policy and removal condition; do not treat blanket weights_only=False as an admission control. Prefer a materially narrower non-code-executing format when scientific/platform parity can actually be demonstrated. This is independent of #1181 rights clearance and of real-audio scientific acceptance.

[seonghobae]

Traceability update from the current BandScope writer:

• Stale-base PR fix(supply-chain): correct unused model inventory claims #1054 was closed only after verified succession into Draft fix(supply-chain): correct Demucs release evidence on current develop #1184.
• fix(supply-chain): correct Demucs release evidence on current develop #1184 is based on protected develop@314ddeae7b775a4957594b599358c8255617eb2e; current exact head is 75e767945a07d610ad03b78f5cafbb3fba86b6b4, ordinary ahead 11 / behind 0, merge base exactly protected develop.
• The higher ancestry count comes from ordinary adoption of canonical formatter prerequisite repair(ci): format consolidated supply-chain policy test #1176 exact 8fe6b6d…. Fresh repair(ci): format consolidated supply-chain policy test #1176→fix(supply-chain): correct Demucs release evidence on current develop #1184 compare is ahead 4 / behind 0 with exactly two changed files, proving fix(supply-chain): correct Demucs release evidence on current develop #1184's unique semantic delta remains only docs/security/dependency-policy.md plus supply-chain/supplemental-component-inventory.json.
• The inventory now states that bandsplit-v1-profile is not used by current separation runtime and that its recorded SHA256 is not runtime enforcement.
• The dependency policy now also corrects two stale security claims: protected runtime is not bundled/checksum-only (get_model defaults to upstream remote resolution), and GHSA-53q9-r3pm-6pq6 is not an active Python exception because the cited repo-local dependency-review and analysis-engine OSV exception files no longer exist. The retained security-backstop is strict pip-audit --local --strict, so a reported advisory stays fail closed.

Protected develop still lacks the Distribution-owned release contract. Draft #970 contains a narrower already-present/local compatibility loader, but Draft behavior is not released truth. #1180 acceptance remains unchanged: immutable exact model identity, full digest/signature/provenance, safe serialization/backend boundary, signed Windows/macOS package placement, updater compatibility/rollback and rights-safe release evidence are still required. #1181 remains the independent commercial-rights blocker.

Treat current #1184—not closed #1054—as the live evidence-correction owner. All predecessor #1054/#1184 review and checks are historical after 75e7679….