Traverse v0.14.0 — signed exact-ref models + digits-mlp

[enricopiovesan]

Traverse v0.14.0

Tagged 2026-09-29 (v0.14.0). Published surfaces today: traverse-runtime / traverse-contracts / traverse-embedder / traverse-mcp 0.14.0 on crates.io, traverse-embedder-web@0.14.0 on npm, and registry client traverse-registry@0.25.0. Product GitHub Release: Traverse v0.14.0.

Throughline

Governed signed exact-ref model execution on the shared runtime.wasm path. Hosts stay UI + WASI/WIT I/O. Capabilities still discover → execute → trace. Model packages are signed, bound to the application that pins them, carry machine-readable rights, and the first real trained model runs through that pipeline identically on native and browser hosts.

Spec 138 0.4.0 — signed exact-ref packages (Decision 101)

• Breaking: model manifests move to schema 2.0.0. Every package ships a detached Ed25519 model.sig.json over the exact model.manifest.json bytes.
• App pins bind the SHA-256 of those manifest bytes and declare target, expected rights, and optional signer key_id.
• Host-owned trust roots (TrustedModelKeys / trustedPublicKeysHex). Apps can never add trust.
• Packages enter the cache only through register_package / registerPackage (signature + trusted key + digest + schema/rights/target/limits). Every execute re-hashes cached bytes.
• Failures keep model_unavailable / model_incompatible and add a stable reason (signature_invalid, key_untrusted, digest_mismatch, …).

Spec 138 0.5.0 — first trained model: digits-mlp-1.0.0 (Decision 102)

• 64→32→10 MLP on UCI Optical Recognition of Handwritten Digits (CC BY 4.0); 96.10% held-out; bit-identical trainer / native / browser.
• Signed with the test-only key. Production model signing is tracked in #1567 (Decision 103).

Host honesty for exact-ref execute

• Native (Rust) + web implement exact-ref execute today.
• Swift / Kotlin / .NET do not execute exact-ref models yet (in-tree embedders otherwise continue).

Release presentation note

Product cut is the GitHub Release Traverse v0.14.0 on tag v0.14.0. Dedicated swift-host-v* / runtime-wasm-v* tags are artifact releases, not the product cut. #1574 covered a manual Latest/product naming fix for this cut; CI automation for product naming + artifact --latest=false is a follow-up Task.

Where to look

• Product Release: https://github.com/traverse-framework/traverse/releases/tag/v0.14.0
• Git tag: https://github.com/traverse-framework/traverse/tree/v0.14.0
• Upgrade notes: https://github.com/traverse-framework/traverse/blob/v0.14.0/docs/upgrade-to-v0.14.0.md
• Spec 138: https://github.com/traverse-framework/traverse/blob/main/specs/138-governed-exact-model-execution/spec.md

For agents / readers

If you land on a swift-host-v* or runtime-wasm-v* GitHub Release, treat it as a binary distribution for Package.swift / native hosts — not the product cut. Cite package pins from crates.io / npm / llms.txt (0.14.0; registry =0.25.0), not artifact release titles.