feat(tier2): pin model to a verified hf revision and harden the daemon boundary#16
Merged
Merged
Conversation
…n boundary - pin gravitee-io/Llama-Prompt-Guard-2-22M-onnx via models/pin.json (single source of truth; downloader + sidecar both load it) and lock SHA-256 of every required file in models/prompt-guard-2-22m.lock.json - scripts/download-model.ts streams + hashes per chunk, verifies against the lockfile, atomically rotates the model dir on revision bump, and fails --verify hard on missing/malformed/incomplete lockfiles - sidecar verifies repo + revision + per-file SHA at LOAD time against pin.json before pipeline() runs; refuses remote fetch unless AIRBAG_TIER2_ALLOW_REMOTE=1; structured JSON logs; EPIPE-tolerant - daemon defaults tier-2 ON when the pinned model is on disk, falls back to disabled cleanly when not - supervisor owns tier-2 spawn: bounded exponential-backoff restart, ready-state reset on death, carry-buffered stdout for chunk-safe port discovery, secret-scrubbed env - daemon http boundary: chunked-aware body-cap middleware (rejects 413 before unbounded buffering), CORS allowlist, ws origin guard, recursive payload schema with depth + key + length caps, uuid + page caps on /v1/sessions/:id/actions - ws hub: 30s heartbeat, slow-consumer drop via getBufferedAmount, max inbound size, no-subscriber timer auto-clear - electron renderer sandbox: true, daemon supervisor with health probe before show + escalating shutdown + bounded auto-restart that resets the attempt counter on a successful boot - python sdk split into types.py + exceptions.py, sync/async context managers that close BOTH httpx clients, browser-use bridge now uses a Protocol-typed envelope_from() that raises TypeError on shape drift - drizzle migration 0002 adds DB CHECK constraints on action_ledger enum + range invariants - ci adds desktop build + sidecar smoke + lockfile-shape jobs; pinned setup-uv version; sidecar smoke installs via the bun workspace - docker-compose binds postgres / clickhouse / redis to 127.0.0.1 only - top-level NOTICE reproduces Llama 4 Community License attribution; README rewritten around the pinned-model flow - all transitive deps pinned to exact versions in package.json, sidecar/package.json, apps/desktop/package.json - 65 daemon tests + 7 download tests + 3 python tests passing; bun lint + typecheck + ruff + mypy strict all clean
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
models/pin.jsondriving both the downloader and the runtimesandbox: true; daemon child process gets a health probe before show + escalating SIGTERM→SIGKILL shutdownclient.py, real context managers that close both httpx clients, Protocol-typed bridge that fails loud on shape drift0002_add_check_constraints.sqllocks the action-ledger enum + range invariants at the DB level127.0.0.1only; CI runs desktop build + sidecar smoke + lockfile-shape gate; deps pinned across all manifestsTest plan
bun run typecheckbun run lintbun test src/daemon/*.test.ts scripts/download-model.test.ts→ 65 pass + 1 skip + 0 failbun test src/daemon/check.test.ts→ 7 pass + 1 skip + 0 failbun run model:verifyagainst the committed lockfile/health+/classifybenign + injection promptuv run ruff check,uv run mypy --strict,uv run pytestFollow-ups