Model Lab v0.2.0-rc.2 — source release

This is a source release of Model Lab for local/private, single-host use.
Version 0.2.0-rc.2 includes the default loopback listener repair that is absent
from rc.1. It also blocks framing of the operator UI, removes fixture-vote
writes from comparison reads, and improves diagnostic credential redaction.
See the audit verification
for claim-by-claim results and the remaining workload, probe, judge-integrity and
operator credential questions. This is not a claim that every audit item is closed.

Install the pinned dependencies and browser using the repository's
README, then start with forced mock providers. Paid provider
calls require the operator's own configuration. The included examples do not
establish new model rankings.

The candidate repairs generated-artifact isolation, request-origin checks,
provider limits and budget admission; preserves run evidence for replay; and
adds SQLite recovery, evaluation consistency and an export workflow. See the
changelog for the complete changes and migration notes.

The source archive contains the verified Git tree. It includes no installed
Node dependencies, browser executable, container image or operator data.
SOURCE_REVISION identifies its commit; SHA256SUMS verifies the archive and
revision file. Dependencies installed by the operator retain their own terms.

Application tests, browser regressions, typechecking, lint, formatting, build,
the JavaScript dependency audit and the redacted source/history secret scan
must pass for this exact commit before the workflow prepares the draft.

Container publication is not certified by this source release. The image
advisory gate and binary redistribution review remain separate requirements.
Supabase is experimental. The app has no built-in authentication; remote
private installations require an authenticating reverse proxy on every route. Generated
code is hostile input, and the documented browser controls do not constitute
an OS-level sandbox. Read SECURITY.md and
deployment guidance before operating it.

Security and conduct reports can be sent privately to info@webstudiolabs.com.

Verified source commit: e8b4bf510ddd328e74c3b24db63ef9d56f748b2b

Verification run: https://github.com/hugosmoreira/model-lab/actions/runs/35739618140

Model Lab v0.2.0-rc.1 — source release

Local startup update (2026-09-21, America/Los_Angeles): This tag's source development and production commands listen on all network interfaces by default. For this release, use pnpm --filter @model-lab/web dev --hostname 127.0.0.1 or, after building, pnpm --filter @model-lab/web start --hostname 127.0.0.1, and open http://127.0.0.1:3000. Restart existing servers to apply the binding. The loopback default is fixed on main in PR #15, but the immutable source archive attached here is unchanged. Remote access still requires an authenticated proxy; Origin headers are not authentication.

This is a source release of Model Lab for local/private, single-host use.
Install the pinned dependencies and browser using the repository's
README, then start with forced mock providers. Paid provider
calls require the operator's own configuration. The included examples do not
establish new model rankings.

The candidate repairs generated-artifact isolation, request-origin checks,
provider limits and budget admission; preserves run evidence for replay; and
adds SQLite recovery, evaluation consistency and an export workflow. See the
changelog for the complete changes and migration notes.

The source archive contains the verified Git tree. It includes no installed
Node dependencies, browser executable, container image or operator data.
SOURCE_REVISION identifies its commit; SHA256SUMS verifies the archive and
revision file. Dependencies installed by the operator retain their own terms.

Application tests, browser regressions, typechecking, lint, formatting, build,
the JavaScript dependency audit and the redacted source/history secret scan
passed for the exact source commit linked below.

Container publication is not certified by this source release. The image
advisory gate and binary redistribution review remain separate requirements.
Supabase is experimental. The app has no built-in authentication; remote
writable installations require an authenticating reverse proxy. Generated
code is hostile input, and the documented browser controls do not constitute
an OS-level sandbox. Read SECURITY.md and
deployment guidance before operating it.

Security and conduct reports can be sent privately to info@webstudiolabs.com.

Verified source commit: d60431a1f2fa8efb68be97f911e50758f092f510

Verification run: https://github.com/hugosmoreira/model-lab/actions/runs/35353105305

Preparation: the maintainer prepared the original private draft using the version, clean-tree, Git archive and checksum commands from the source-release workflow. At that time GitHub rejected private branch rules and required environment reviewers on the current plan; no protected workflow deployment or environment approval is claimed. All three uploaded assets were downloaded and verified against their checksums and GitHub digests.

Publication: the maintainer authorized this public source prerelease. Before publication, the repository became public and the main-branch PR/check rules, immutable version-tag rules, main-only release environment with a required maintainer reviewer and disabled administrator bypass, and private vulnerability reporting were activated and read back from GitHub. The source tag and archive are unchanged. Container publication remains blocked by the separate native advisory and binary redistribution gates.