Skip to content

Traverse v0.15.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Oct 01:08
· 21 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.15.0
4491553
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Released 2026-10-13.

Traverse v0.15.0 is a minor lockstep crate + npm release. It carries
breaking changes to the Spec 138 exact-ref model surface, and following
this repo's 0.x convention those use a minor bump, not a patch.

Its throughline is governed model execution on every host. Signed
exact-ref packages now run on the Swift, Kotlin/Android and .NET embedders,
not only native Rust and the browser. Every host enforces machine-readable
model rights. Third-party ONNX models can be packaged, signed and verified
with the CLI. A host can also run a package's signed Core ML variant on
Apple hardware under the same policy, tolerance and evidence rules.

Highlights

Exact-ref model execution on every embedder

  • Swift (iOS/macOS) (Decision 104, #1579): ExactModelHost runs
    signed packages on wasmi behind one audited C-ABI symbol,
    traverse_swift_host_model_call (ADR-0078). Execution runs in fuel
    slices, so Swift Task cancellation and deadlines interrupt a running
    inference.
  • Kotlin/Android (Decision 108, #1580): ExactModelHost runs on
    wasmi through the traverse-android-host JNI shim (ADR-0079).
    • The AAR ships arm64-v8a and x86_64 libraries, 16 KB page-aligned.
    • A new emulator CI job runs the instrumented model tests against them
      (#1611).
  • .NET (Decision 111, #1642 / #1643): ExactModelHost runs through two
    audited P/Invoke functions (ADR-0081). The NuGet package ships the native
    engine for win-x64, win-arm64 and linux-x64.
  • All three hosts share one safe framed protocol crate
    (traverse-model-host-frame). They match the signed conformance vectors
    byte for byte and pass the shared 21-case rights suite.

Model rights enforcement (Spec 138 0.8.0, Decision 107, #1599–#1601) — breaking

  • Apps with exact_model_dependencies must declare
    model_usage: commercial | non_commercial. Without it, calls fail closed
    with usage_undeclared.
  • A commercial usage rejects prohibited packages
    (rights_policy_denied).
  • Hosts own a package-status map: revoked blocks calls, and deprecated
    is flagged.
  • Every result carries model_evidence, the verified rights record.
  • Manifest schema 2.1.0 adds an optional rights.derivation.
  • Parity on Rust, the browser, Swift, Kotlin and .NET.

Packaging third-party models

  • traverse-cli model (#1589): digest, sign, verify, pin and
    conformance generate|check, plus docs/model-packaging-guide.md and
    two-tier provenance.
  • Generic ONNX runner guest and model package-onnx (Decisions
    105/106, #1591):
    • turns an ONNX model into a Spec 138 package on an audited, import-free
      tract guest;
    • the runner rebuilds byte for byte in CI;
    • the new digits-onnx-1.0.0 fixture scores 1727/1797 on every engine.
  • Production model-signing key tooling (Decision 103, #1567): key
    generation, opt-in TRAVERSE_MODEL_SIGNING_KEYS, a dispatch-only signing
    workflow, and a runbook.

Faster repeat inference

  • Guest ABI v2 (#1588): the guest allocates its own input and output
    buffers.
  • Guest ABI v3 (Decision 110, #1626 / #1627):
    • the host runs model_prepare once and restores a pristine snapshot
      into a fresh instance on every call, bounded by a new
      max_snapshot_bytes ceiling;
    • output is byte-identical on the fresh path and the snapshot path, on
      every host;
    • ONNX packages now prepare once.

Native accelerators: Core ML on Apple hosts (Decisions 110, 112–114)

  • The adapter framework (#1667):
    • execution policies list ordered placements (default ["wasm-cpu"]),
      with traced fallback and the new reason placement_unavailable;
    • a variant runs only after it passes an on-device self-check against
      its signed conformance vector within tolerance (at most 5×10⁻³);
    • require_fuel_metering keeps a call on metered placements;
    • every result carries placement_evidence.
  • A real ONNX → Core ML converter (#1663):
    • traverse-cli model convert-coreml drives the pinned converter in
      tools/coreml/ and writes a canonical mlpackage-zip;
    • a macOS CI job re-converts every committed variant and requires the
      same bytes (Spec 138 0.13.3, FR-068).
  • The objc2 Core ML adapter (#1629, ADR-0082):
    • Swift's ExactModelHost gains coreML:, variantFiles:,
      placements:, requireFuelMetering: and placementEvidence;
    • on macOS, the signed digits-onnx-coreml package matches wasm-cpu
      within tolerance on every compute-unit setting;
    • BirdNET on the 21-clip set keeps top-5 at 21/21, with a worst
      |Δ sigmoid| of 8.3×10⁻⁴;
    • on-device iPhone evidence follows in #1630.

Fixes

  • model package-onnx docs and CLI match ABI v3 and schema 2.2.0
    (#1660).
  • The web embedder reports its real package version (#1654).
  • The Swift host returns stable RESOURCE_LIMIT codes for fuel and memory
    traps (#1615).
  • Model attribution is validated and preserved (#1459).
  • Browser workflow proposals are ordered deterministically (#1399).
  • A stale Cargo.lock entry is removed (#1648).
  • GitHub Release names follow the Traverse vX.Y.Z convention, enforced on
    every PR and audited live (#1574).
  • The version-bump helper now also bumps the inline sibling-crate pins in
    member manifests.

Upgrade notes

See docs/upgrade-to-v0.15.0.md. In short:

  • Declare model_usage (Rust ExactModelHostConnector::model_usage, web
    modelUsage, Swift modelUsage:) on any host that runs pinned models.
  • Code that builds ExecutionPolicy or HostConnectorHostResult with
    struct literals, or matches every ModelFailureReason, must add the new
    fields and variants.
  • Pin traverse-embedder-web@0.15.0 together with crates at 0.15.0
    (lockstep, Decision 85). traverse-registry moves to 0.28.0.

Validation

  • The tagged commit must pass the GitHub version-guard,
    repository-checks, coverage-gate, and stress jobs before the
    tag-triggered publishes.
  • This cut needed a traverse-registry release (registry#636 /
    registry#637, 0.28.0). The published traverse-registry@0.27.0 capped
    traverse-contracts below 0.15.0, the same recurring pattern as
    v0.13.0 and v0.14.0.

Links

ONNX runner guest distribution (#1687)

The audited ONNX runner guest ships on the dedicated artifact release onnx-runner-v0.15.0 (sha256 f3902703fe79cc161c13b87cf507dcb25cb53ea3c2a68bed6cc753f9df100966). Install the CLI as traverse-cli-rs (rustc ≥ 1.94); crates.io traverse-cli is unrelated. See docs/model-packaging-guide.md.

Assets 3
Loading