Skip to content

ModelForge v0.1.3-beta.1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@yanzhao77 yanzhao77 released this 01 Sep 02:53
· 8 commits to master since this release
v0.1.3-beta.1
0cfdd3c

ModelForge v0.1.3-beta.1

Local-first AI Agent Runtime Platform — Beta Release Candidate

A single-application, locally-deployable platform covering model management, fine-tuning, and Agent Run/Event/Tool/Policy/MCP/Scheduler/Multi-Agent/Composable Plugin.

What's New in This Release

Chat API Error Contract

  • Typed, consistent error responses for chat and streaming endpoints.

OpenAI-Compatible Input Governance

  • Input validation, sanitization, and safe error propagation for /v1/chat/completions and /v1/responses.

Per-User Concurrency, Rate Limiting & Inference Timeout

  • Per-user concurrent request gating, rate limiting with configurable windows, and total inference timeout for streaming and non-streaming requests.

Streaming Request Cancellation & Resource Cleanup

  • Proper lease-based lifecycle for streaming requests with guaranteed resource release on cancellation, timeout, or completion.

JWT Development Secret Persistence

  • Auto-generated 36-byte JWT secret persisted to config.yaml on first run, preventing accidental lockout from ephemeral secrets.

Scheduler, Downloader & Runtime Coverage

  • schedule_service, downloader, openai_api_runtime, and local_runtime modules at 100% test coverage.

Desktop Theme, Accessibility, Empty States & Task Center Fixes

  • Improved theme consistency, keyboard navigation, empty-state messaging, and task-center UX.

Docker / PostgreSQL / Alembic Release Validation

  • Full CI pipeline for Docker image build, non-root verification, Alembic migration, API smoke test, log secret audit, and SIGTERM graceful shutdown.

Verification Results

Gate Result
Tests 866 passed, 3 skipped, 0 failures, 0 warnings
Backend coverage threshold 75%
pip-audit (runtime) 61 packages, 0 vulnerabilities
pip-audit (development) 36 packages, 0 vulnerabilities
pip-audit (Docker image) 62 packages, 0 vulnerabilities
Image setuptools 84.0.0
Image pip 26.2.1
Lint (ruff) Clean

CI

  • CI Run: #33463505790
  • Candidate SHA: 0cfdd3c335ad219b3badee0014e40e5f9500dddd
  • Image Digest: sha256:29779bec15959e48abe49f230271e30234ba64a80d855890305ed01217e467e7
  • Database Migration Head: 0002_api_platform
  • Python: 3.10.21 (CI)

Why 3 Tests Are Skipped

The 3 skipped tests are environment-gated (e.g., require GPU, local Ollama, or AI-specific dependencies not present in CI). They do not represent core Beta quality gates and are excluded from the release candidacy threshold.

Known Boundaries

  • Single-application replica only: This release is validated for a single-instance deployment. Multi-replica or horizontal scaling is not covered.
  • CPU/GPU local models: Require requirements-ai.txt to be installed separately (torch, transformers, llama-cpp-python, peft, datasets). Not bundled in the base image.
  • No production deployment: This is a pre-release candidate. No production deployment has been performed or validated.

Upgrade Notes

  • If upgrading from v0.1.1-beta.1, run alembic upgrade head after deploying the new code.
  • The JWT secret is now auto-generated and persisted in config.yaml. If you have a custom JWT_SECRET environment variable, it will continue to take precedence.
  • Docker users: rebuild the image from this tag. The new image includes pip 26.2.1 and setuptools 84.0.0 with 0 known vulnerabilities.

Rollback Notes

  • To roll back, redeploy the previous version and run alembic downgrade -1 if needed.
  • The 0002_api_platform migration adds columns that are additive; rolling back the code without rolling back the DB should not cause data loss.

Artifacts & Checksums

All release artifacts include SHA-256 checksums in SHA256SUMS. Verify before use:

shasum -a 256 -c SHA256SUMS

Included Artifacts

Artifact Description
candidate-metadata.json Candidate SHA, Python version, timestamp
pip-audit-runtime.json Runtime dependency audit (0 vulnerabilities)
pip-audit-dev.json Development dependency audit (0 vulnerabilities)
pip-audit-image.json Docker image package audit (0 vulnerabilities)
image-installed-requirements.txt Exact packages installed in the Docker image
sbom-runtime.cdx.json CycloneDX SBOM for runtime dependencies
sbom-image.cdx.json CycloneDX SBOM for Docker image packages
SHA256SUMS SHA-256 checksums for all artifacts

Disclaimer

This is a beta pre-release. It has not been production-deployed, has not been validated with multi-replica configurations, and has not been validated with GPU workloads or all real-world models. Use at your own risk in non-production environments only.

Assets 10
Loading