modelvet 0.1.1

Internal legibility release. No public API, cap, violation-code, or verdict-behavior change; every existing input produces the same report. Already published to PyPI as modelvet 0.1.1.

Changes

• Verdict completion consolidated into report.c (mvet_report_finish), so exactly one function writes the ACCEPT verdict.
• Align-up padding computation shared through the checked-arithmetic module (mvet_checked_align_padding_u64) instead of duplicated in the GGUF tensor pass.
• safetensors frame pass and work-array carving use explicit status checks instead of MVET_TRY on acquiring call chains.
• Derived constants computed from their string literals instead of restated (the __metadata__ key length, the dtype-table name lengths).
• Missing invariant assertions added in the GGUF tensor pass; the unused MVET_ST_FRAME_BYTES constant removed.

Full CHANGELOG entry: CHANGELOG.md.

In this release

modelvet-0.1.1.tar.gz contains the vendorable two-file amalgamation (modelvet.c + modelvet.h), LICENSE, README, CHANGELOG, the integration guide, and the modelvet(1) man page. Violation-code numbers remain append-only ABI (docs/RELEASE.md).

Verifying the artifacts

sha256sum -c modelvet-0.1.1.tar.gz.sha256
echo "release ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAkVhb6oApERrII+VGYS6/xIW8gvceMDm2AOD5aMGxW/ tetsuo@tetsuo-corporation" > allowed_signers
ssh-keygen -Y verify -f allowed_signers -I release -n file \
  -s modelvet-0.1.1.tar.gz.sig < modelvet-0.1.1.tar.gz

The tarball and the git tag are signed with the maintainer's SSH key (an SSH signature, .sig; there is no GPG .asc). The tarball is reproducible: make dist from this tag produces byte-identical output.

Scope

An ACCEPT verdict is structural only. It says nothing about model behavior, provenance, poisoned weights, or tokenizer semantics, and pickle-based formats are out of scope by design. See the threat model and the integration guide.

modelvet 0.1.0

First public release: a verify-before-load boundary for model files. modelvet decides whether a GGUF or safetensors file is structurally safe to hand to a model loader. Freestanding C11, no allocation, one fixed caller-provided arena, checked arithmetic on every file-derived integer, bounded work.

Evidence

• CVE regression corpus: 18 files, one per verified advisory or audit finding (the 2024 Talos cluster, CVE-2025-53630 and its 2026 bypass CVE-2026-27940, CVE-2026-33298, Ollama's CVE-2026-7482, MLX's CVE-2025-62609, the live alignment gap, TOB-SFTN-1/-2 and the upstream abuse shapes), each rejected with its exact violation code as a required CI gate.
• GGUF differential parity (docs/PARITY.md): 249 inputs against the upstream loader, with zero cases where modelvet accepts and upstream rejects. Confirmed against the pinned llama.cpp revision; the single remaining divergence is upstream's still unbounded general.alignment.
• safetensors differential parity (docs/PARITY-ST.md): 68 inputs against the canonical Rust implementation at the exact audited commit. Zero more-permissive cases, zero canonical panics, and every divergence maps to a documented policy code.
• Fixed memory and bounded work: the whole corpus runs in one 64 KiB arena under the documented profile, and every input-scaling loop is counted against a closed-form budget in CI.

In this release

modelvet-0.1.0.tar.gz contains the vendorable two-file amalgamation (modelvet.c + modelvet.h), LICENSE, README, CHANGELOG, the integration guide, and the modelvet(1) man page. The repository additionally provides the CLI (exit code = verdict, --json), a Python binding, and the full gate suite. Violation-code numbers are append-only ABI from this release onward (docs/RELEASE.md).

Verifying the artifacts

sha256sum -c modelvet-0.1.0.tar.gz.sha256
echo "release ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAkVhb6oApERrII+VGYS6/xIW8gvceMDm2AOD5aMGxW/ tetsuo@tetsuo-corporation" > allowed_signers
ssh-keygen -Y verify -f allowed_signers -I release -n file \
  -s modelvet-0.1.0.tar.gz.sig < modelvet-0.1.0.tar.gz

The tarball and the git tag are signed with the maintainer's SSH key (an SSH signature, .sig; there is no GPG .asc). The tarball is reproducible: make dist from this tag produces byte-identical output.

Scope

An ACCEPT verdict is structural only. It says nothing about model behavior, provenance, poisoned weights, or tokenizer semantics, and pickle-based formats are out of scope by design. See the threat model and the integration guide.