Traverse v0.15.0 — governed model execution on every host

[enricopiovesan]

Throughline

Governed model execution on every host. Signed exact-ref packages now run on Swift, Kotlin/Android, and .NET embedders — not only native Rust and the browser. Every host enforces machine-readable model rights. Third-party ONNX models package/sign/verify via the CLI. On Apple hardware, a host can run a package's signed Core ML variant under the same policy, tolerance, and evidence rules. The value loop is still discover → execute → trace. Hosts stay UI + I/O. One shared runtime contract/ABI: web loads a digest-checked runtime/runtime.wasm; Rust links traverse-runtime natively.

Exact-ref on every embedder

• Swift ExactModelHost (Decision 104) via wasmi + traverse_swift_host_model_call; fuel-sliced so Task cancellation interrupts inference
• Kotlin/Android ExactModelHost (Decision 108) via traverse-android-host JNI; AAR for arm64-v8a + x86_64, 16KB page-aligned; emulator CI
• .NET ExactModelHost (Decision 111) via two audited P/Invoke functions; NuGet ships win-x64, win-arm64, linux-x64
• Shared framed protocol crate; signed conformance vectors match byte-for-byte; shared 21-case rights suite

Breaking: model rights enforcement

• Apps with exact_model_dependencies must declare model_usage: commercial | non_commercial (usage_undeclared fails closed)
• commercial rejects prohibited packages (rights_policy_denied)
• Host package-status map: revoked blocks; deprecated is flagged
• Results carry model_evidence
• See docs/upgrade-to-v0.15.0.md

Packaging + ABI

• traverse-cli model: digest / sign / verify / pin / conformance + package-onnx (generic ONNX runner guest); digits-onnx-1.0.0 fixture
• Guest ABI v2 (guest-allocated buffers) and ABI v3 (model_prepare once + pristine snapshot reuse; max_snapshot_bytes)
• Production model-signing key tooling landed (Decision 103 / Production model-signing key custody, distribution, rotation, and revocation (Spec 138) #1567), opt-in via TRAVERSE_MODEL_SIGNING_KEYS. The weekly-demo test key is still a test key.

Core ML on Apple (opt-in)

• Adapter framework: ordered placements (default wasm-cpu), on-device self-check within tolerance, placement_evidence, placement_unavailable fails closed
• Real ONNX→Core ML converter (mlpackage-zip); Swift ExactModelHost gains coreML: / variantFiles: / placements:
• Verified on macOS for digits-onnx-coreml; on-device iPhone evidence still follows in iPhone evidence: BirdNET ≤ 1.5 s per 3 s clip on the governed path (Decision 110) #1630
• No GPU adapters for web/Android/desktop — not shipped

Upgrade

• Lockstep 0.15.0 (Decision 85); traverse-registry 0.28.0
• Declare model_usage on any host that runs pinned models
• Release notes · Swift xcframework · docs/upgrade-to-v0.15.0.md · Spec 138

Published: crates traverse-runtime / traverse-embedder / traverse-contracts / traverse-mcp 0.15.0 · npm traverse-embedder-web@0.15.0 · Maven com.traverse-framework:traverse-embedder 0.15.0 · NuGet TraverseEmbedder 0.15.0 · Swift swift-host-v0.15.0 · registry 0.28.0. Kotlin/.NET ExactModelHost ship in the 0.15.0 packages (#1651).

Honesty footnotes

• Still pre-1.0; no host is Certified under Spec 529
• Not a catalog model.execute capability; this is the host connector path
• Skill-first authoring via traverse-capability-author is unchanged
• Python is still CLI-only (no Python SDK)

[enricopiovesan]

Closing as a duplicate of #1683, which is the canonical v0.15.0 announcement. Please follow up there.