HaloFPX v1.3.0 — Vision, Security & Registry Hardening

Highlights

👁️ Automatic Vision (Multimodal) Support

• Model projectors (mmproj) are now first-class registry assets with repo/size/SHA256 metadata
• halofpx pull downloads and checksum-verifies the vision projector alongside the weights
• halofpx list reports vision readiness as a separate column; pull results include projector path
• Validated end-to-end: Ornith-1.5-35B answers image prompts via the standard OpenAI API

🔒 Security & Portability Sanitize

• CORS: allow_credentials disabled (invalid/unsafe with wildcard origins)
• Server now defaults to loopback (127.0.0.1) instead of 0.0.0.0; Docker still binds explicitly
• Blocking model load/unload/pull moved off the event loop (asyncio.to_thread)
• Version string centralized; machine-specific paths replaced by Path.home() + HALOFPX_HF_CACHE_DIRS / HALOFPX_ENGINE_SEARCH_PATHS overrides

🐛 Registry Fixes

• Fixed false "downloaded" reports from Hugging Face .no_exist negative-cache stubs
• Adopted Vulkan backend default for laguna-s21

📚 Documentation

• README refocused on optimized model serving with measured per-model decode numbers
• New benchmark section: quantization fidelity (perplexity ROCmFP4 5.95 vs Q4_K_M 5.64) and validated 131K/262K long-context results for Ornith-1.5-35B

Full changelog: v1.2.0...v1.3.0