feat(weight-custody-manifest): add load_guard, verify weights before loading - #67
Merged
Conversation
…loading load_guard.py is the smallest useful integration: a drop-in guard that verifies the checkpoint before the loader touches it. It checks the manifest's joint signature and that the bytes on disk hash to exactly what the builder bound, and refuses a tampered or swapped fork before the load. guarded_load() drops in front of an existing safetensors / transformers load; --load --model gates and loads a real file (run-local). Offline demo (certified loads, one-byte-flipped fork refused) runs in CI. Wired into the CI feature-examples step and documented in the README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
load_guard.py, the smallest useful WCM integration: verify the checkpoint before your loader ever touches it.guarded_load()checks two things before a single byte reaches the loader:Either mismatch raises
RefusedToLoadbefore the load. Drop it in front of an existingsafetensors/transformersload.Verified
Ran against the published
weight-custody-manifest0.22.1: exit 0, certified checkpoint loads, a one-byte-flipped fork is refused with the hash mismatch shown. Wired into the CI feature-examples step (offline path) and documented under a new "Gate your model load" section in the README. Real-load path (--load) uses the lazily-imported infer extras and is run-local, not in CI. No em dashes.🤖 Generated with Claude Code