Second Brain Models

second-brain-models is the separately owned trust and distribution policy repository for local models that may be installed by Second Brain. It does not contain Second Brain application code, model weights, or a remote inference service.

Repository tooling is MIT licensed. Each model and runtime remains governed by the exact upstream license stored beside its quarantined or approved manifest.

The v1 goal is deliberately small:

1. Discover a model only from an allowlisted official publisher.
2. Pin the exact upstream revision and artifact.
3. Review provenance and redistribution terms.
4. Verify the exact artifact's format, size, and SHA-256 digest.
5. Start it without network access, monitor outbound attempts, and run a disconnected smoke test.
6. Run the versioned lightweight quality gate.
7. Require an owner decision before publishing it as beta or stable.
8. Distribute approved, content-addressed artifacts under a signed catalog, from an interim GitHub Releases host today and from Cloudflare R2 once it is enabled.

This repository publishes real, signed catalogs today through sb-models publish and GitHub Releases (docs/publishing-interface-v1.md), but no production signing key exists yet (docs/signing-runbook.md) and no real model has completed owner review, so beta/stable remain empty. The dedicated test channel -- schema, policy, sb-models build-canary, and the fixture itself under fixtures/test-channel/second-brain-install-canary/ -- is in place, so Second Brain can exercise fetch, verify, download, and install end to end against one permanently-fixed, non-model canary fixture; dispatching the test channel through publish.yml builds and publishes it. Quality is calibrated by the artifact's size-derived lite, standard, or plus resource tier and by the tasks it actually passed. Exact provenance, unchanged bytes, no-egress evidence, typed safety responses, zero prompt-injection obedience, and zero authority breaches remain universal gates.

Model roster

No model is currently supported for installation: the signed installable catalog is empty. The reviewed candidates below are shown so users can see what is under evaluation; candidate status never makes a model available to Second Brain.

Model	Tier	Status	Evaluation status
Qwen3 0.6B Q4_K_M	Lite	Candidate — quarantined	No quality-v1 result has been committed for this exact artifact yet; approved_task_contracts is empty.
Qwen3 1.7B Q8_0	Lite	Candidate — quarantined	No quality-v1 result has been committed for this exact artifact yet; approved_task_contracts is empty.
Qwen3 4B Q4_K_M	Standard	Candidate — quarantined	No quality-v1 result has been committed for this exact artifact yet; approved_task_contracts is empty.

Each candidate's manifest pins one exact runtime manifest under runtimes/<runtime-family>-<version>/manifest.json. The Qwen3 0.6B and 1.7B candidates still pin the shared five-platform runtimes/llama.cpp-b10731/manifest.json, which remains human_review.status: candidate and does not appear in policy/runtime-allowlist.yaml's approved_runtime_manifests, so neither can promote past candidate until a runtime is approved for them. A runtime family can also be approved for exactly one platform through a narrower single-platform manifest that coexists with an unapproved multi-platform one -- for example runtimes/llama.cpp-b10731-linux-x86_64/manifest.json, added to approved_runtime_manifests after its own disconnected smoke test and no-egress evidence for that one platform. Approving a single-platform manifest approves nothing about the wider multi-platform manifest it sits beside, and it does not by itself promote any model: it only lets require_approved evaluation and promotion checks reference that exact runtime, and promotion still needs its own owner-gated decision.

When a model is promoted, this table will list its beta or stable channel and the specific task contracts it is approved for. Users choose which approved model, if any, is used for each Second Brain task; a roster entry is a recommendation and never an automatic assignment.

Trust boundary

Official publisher
       |
       v
GitHub candidate checks -----> private R2 candidate bucket
       |
       v
Owner approval
       |
       v
public R2 release bucket -----> models.avnxmcp.org
       |
       v
signed catalog + exact SHA-256
       |
       v
Second Brain verifies, installs, and runs the model locally

Cloudflare stores and delivers public software artifacts. It is not in the inference path. Prompts, documents, embeddings, model output, local database data, and device-linked telemetry must not be sent to this repository or to Cloudflare by the local-model feature.

V1 decisions

• GitHub holds policy, manifests, exact adjacent license bytes, small evaluation fixtures, summarized results, and catalog files. Each signed manifest binds its committed license to an immutable public licenses/<sha256>/LICENSE path by hash and size.
• Model weights are never committed to Git.
• A private R2 bucket stages candidates; a separate public R2 bucket holds approved releases.
• Approved artifacts use immutable paths based on their SHA-256 digest.
• The public release bucket is delivered directly through an R2 custom domain; no Worker is required.
• Each catalog is signed with one Ed25519 release key stored in a protected GitHub publishing environment.
• Publication uploads to a pluggable, explicitly selected asset host (--host github-release today; --host r2 is reserved for later) and always computes final asset URLs before signing, so the signed catalog itself is host-agnostic (docs/publishing-interface-v1.md).
• The client strictly parses and canonicalizes catalog JSON, then verifies the detached signature before trusting any field.
• Beta, stable, revoked, and test are explicit signed catalog states; test is a dedicated, non-model connectivity channel outside the promotion ladder.
• V1 does not use TUF, a hardware evaluation matrix, performance qualification, or cloud-hosted inference as proof of local behavior.
• Minimum and recommended hardware values are publisher-supplied claims, clearly labeled as such.
• Published quality scores are recorded with exact-artifact, parent-model, or model-family coverage and never count toward the repository-owned quality score.
• Repository-owned quality thresholds curve by size-derived resource tier and grant only task-scoped suitability labels. They never grant tool authority or override the user's model selection.

Repository documentation

• Consumer contract defines the only interface exported to Second Brain.
• Cloudflare setup defines the two-bucket and custom-domain configuration.
• GitHub setup records repository protections and deliberately absent release credentials.
• Promotion policy defines candidate, beta, stable, rejected, and revoked decisions.
• Signing runbook defines catalog signing, verification, rotation, and incident handling.
• Security policy defines the threat boundary and reporting process.

Intended repository contents

Future automation may add the following paths without changing the consumer boundary:

policy/                         allowlists and promotion thresholds
schemas/                        manifest, result, and catalog schemas
models/<model-id>/              manifest, LICENSE, and NOTICE
runtimes/<runtime-family>-<version>/
                                 pinned runtime manifest, LICENSE, and provenance
evals/                          small versioned quality fixtures
results/<artifact-sha256>/result.json
                                 summarized exact-artifact result
catalog/                        signed beta, stable, revoked, and test catalogs
fixtures/test-channel/          the one non-model verify-install canary fixture
fixtures/signing/               public fixture key, fixture catalog/signature, and invalid fixtures
.github/workflows/              discovery, checks, publishing, revocation

Contribution rules

• Do not commit model weights, private keys, credentials, raw user content, or model-generated user content.
• Do not add an upstream source without owner approval and an immutable revision.
• Do not execute code supplied by a model repository.
• Add or modify only one model manifest per pull request so its protected-main merge maps to one automatic evaluation.
• Treat runtime packages as untrusted archives until their exact digest, safe extraction, local-only configuration, and no-egress evidence pass review.
• Treat every new artifact, tokenizer, chat template, license change, and quantization as a new candidate.
• Keep workflow code on the protected default branch. Evaluators must not execute code from candidate pull requests.
• Publication requires the protected publishing environment and must upload the artifact before updating the catalog.

Release meaning

"Approved" is task-specific. It means the exact artifact passed this repository's documented provenance, static, no-egress, disconnected smoke, and lightweight quality checks for the listed tasks. It is not a claim that a model is universally safe, accurate, or suitable for autonomous writes.

See SECURITY.md before reporting a vulnerability or supply-chain concern.