v0.0.23

Chaos v0.0.23

Four things the v0.0.22 audit left open, decided and done.

A CORRUPT MODEL CAN NOW BE TOLD FROM AN INTACT ONE

This is the one that matters. Four kilobytes of zeros written into a container's
weights used to load, exit 0, and answer fluently -- and differently:

intact   " Paris. The capital of France is Paris."
corrupt  " Paris. The capital of Germany is Berlin."

Both plausible. Neither flagged. There was no checksum anywhere.

chaos verify <model> [--expect <sha256>]

Hashes the container and compares it with the record beside it. With nothing on
file, this reading becomes the record -- and says so, because that means
"unchanged since then", not "what the publisher shipped". Pass --expect with a
published digest for the stronger answer. chaos pull now records a digest as
each file finishes.

Size is checked before the hash, because it is free and conclusive: a file of the
wrong length cannot be the right file. That catches a bad resume in a millisecond
instead of minutes.

intact          RECORDED         807,694,368 bytes in 2.44 s
4 KiB zeroed    WRONG CONTENTS   same length, different bytes
5 bytes longer  WRONG SIZE       expected 807694368, found 807694373

SHA-256, written out -- Chaos still has zero third-party dependencies. It was
chosen over a faster hash because publishers publish SHA-256, so your file can be
checked against THEIR value. It agrees byte-for-byte with Python's hashlib on a
real 807 MB model, and with the published FIPS test vectors. About 330 MB/s, so a
144 GB model takes roughly seven minutes -- which is why it is a command you run
rather than something every load pays for.

A NODE NO LONGER TELLS THE NETWORK WHAT IT IS RUNNING

With a key set, anyone who could reach the port used to read /status and /health
freely: the model name, its context size, the node's address. Those are behind the
key now.

The rule is the peer, not the address the node binds. Your own machine is never
gated -- the window checks its own server that way, and so does chaos status.
The network needs the key. The mark and the reader stay open to anyone, because a
stranger's phone has no key and pointing its camera at the code is the whole point
of them.

from the network, no key    /status 401  /health 401  /v1/models 401  /qr 200
from the network, with key  /status 200  /v1/models 200

EVERY BINARY SHIPS

Three of the six benchmarks were in the packaging lists and three were not, for no
stated reason -- the same gap that kept chaos-qr out of every list until
v0.0.22. All of them ship now, and the rule is written down where the list lives.

BUILDS ARE REPRODUCIBLE

Both workflows used to build ggml from whatever llama.cpp's master happened to be
that day, so "the build was green" described an unknown commit. It is pinned now,
in one place per workflow.

953 tests, 0 failed.