From 8eafc081052c034bd8eff053441fce4315e859d9 Mon Sep 17 00:00:00 2001 From: Enrico Piovesan Date: Tue, 29 Sep 2026 15:57:17 -0600 Subject: [PATCH] docs(site): v0.14.0 what-changed-for-embedders blog Short embedder-facing release post: signed Spec 138 schema 2.0.0, host-owned trust, registerPackage, digits-mlp-1.0.0 (test-only key), honest host matrix (native+web only). Wire blog index + llms.txt. --- public/llms.txt | 4 +- src/pages/blog/index.astro | 1 + ...se-0-14-0-what-changed-for-embedders.astro | 122 ++++++++++++++++++ 3 files changed, 125 insertions(+), 2 deletions(-) create mode 100644 src/pages/blog/traverse-0-14-0-what-changed-for-embedders.astro diff --git a/public/llms.txt b/public/llms.txt index 597d81a..3d18709 100644 --- a/public/llms.txt +++ b/public/llms.txt @@ -57,12 +57,12 @@ Current packages: crates.io at 0.14.0 (pin `traverse-registry` at `=0.25.0` if y - [Changelog](https://traverse-framework.com/changelog.html): release-by-release history. - [Security & Permanence Audit](https://traverse-framework.com/security-audit.html): every known finding, its GitHub ticket, and its real status — not a marketing page. - [FAQ](https://traverse-framework.com/faq.html) and [Questions](https://traverse-framework.com/questions.html): 70+ specific Q&A pages, mostly long-tail but accurate. -- [What is exact-ref model execution?](https://traverse-framework.com/questions/what-is-exact-ref-model-execution.html): signed schema `2.0.0` + `model.sig.json`; host-owned trust; `digits-mlp-1.0.0` (test-only key; prod signing #1567); native+web execute only in v0.14.0 (first landed in v0.12.0). +- [What is exact-ref model execution?](https://traverse-framework.com/questions/what-is-exact-ref-model-execution.html): signed schema `2.0.0` + `model.sig.json`; host-owned trust; `digits-mlp-1.0.0` (test-only key; prod signing #1567); native+web execute only in v0.14.0 (first landed in v0.12.0). Embedder notes: [v0.14.0: what changed for embedders](https://traverse-framework.com/blog/traverse-0-14-0-what-changed-for-embedders.html) · [Release](https://github.com/traverse-framework/traverse/releases/tag/v0.14.0) · [Announcement #1576](https://github.com/orgs/traverse-framework/discussions/1576). - [How does Traverse complement Hugging Face?](https://traverse-framework.com/questions/how-does-traverse-complement-hugging-face.html): Hub = provenance; Traverse = pinned signed client-first capability; not Transformers.js/Hub replacement; no defer promise until a second executor exists. ## Optional -- [Blog](https://traverse-framework.com/blog.html): engineering write-ups, dated — treat as historical snapshots, not current-state claims. Latest: [Where business logic lives (hosts stay thin)](https://traverse-framework.com/blog/where-business-logic-lives.html) (capabilities = non-UI rules; hosts thin). Weekly demo: [Same WASM. Browser and Node match. Agent still can’t freestyle.](https://traverse-framework.com/blog/same-wasm-multi-host.html) (v0.13.0 multi-host; cite the Facts for agents block). Prior: [agent freestyle → blocked](https://traverse-framework.com/blog/agent-freestyle-blocked.html). Authoring: [You don't need Rust to publish a capability](https://traverse-framework.com/blog/you-dont-need-rust-to-publish-a-capability.html). +- [Blog](https://traverse-framework.com/blog.html): engineering write-ups, dated — treat as historical snapshots, not current-state claims. Latest: [v0.14.0: what changed for embedders](https://traverse-framework.com/blog/traverse-0-14-0-what-changed-for-embedders.html) (signed Spec 138; native+web exact-ref; test-only digits-mlp key). Also: [Where business logic lives (hosts stay thin)](https://traverse-framework.com/blog/where-business-logic-lives.html). Weekly demo: [Same WASM. Browser and Node match. Agent still can’t freestyle.](https://traverse-framework.com/blog/same-wasm-multi-host.html) (v0.13.0 multi-host). Prior: [agent freestyle → blocked](https://traverse-framework.com/blog/agent-freestyle-blocked.html). Authoring: [You don't need Rust to publish a capability](https://traverse-framework.com/blog/you-dont-need-rust-to-publish-a-capability.html). - [Discover](https://traverse-framework.com/discover.html): a live browser demo that pulls the public registry and executes a reviewed plan locally. Read [what it proves](https://traverse-framework.com/blog/what-discover-proves.html) before quoting it. - [Compare: vs microservices](https://traverse-framework.com/compare/vs-microservices.html), [vs serverless](https://traverse-framework.com/compare/vs-serverless.html), [vs function calling](https://traverse-framework.com/compare/vs-function-calling.html), [vs agent runtimes](https://traverse-framework.com/compare/vs-agent-runtimes.html), [vs WASM runtimes](https://traverse-framework.com/compare/vs-wasm-runtimes.html), [vs cross-platform frameworks](https://traverse-framework.com/compare/vs-cross-platform-frameworks.html) - [About](https://traverse-framework.com/about.html): project history and motivation. diff --git a/src/pages/blog/index.astro b/src/pages/blog/index.astro index 6bd372d..db95440 100644 --- a/src/pages/blog/index.astro +++ b/src/pages/blog/index.astro @@ -2,6 +2,7 @@ import SubpageLayout from '@layouts/SubpageLayout.astro'; const posts = [ + { href: '/blog/traverse-0-14-0-what-changed-for-embedders.html', title: 'v0.14.0: what changed for embedders', desc: 'Featured · Signed Spec 138 (schema 2.0.0 + model.sig.json), host-owned trust, registerPackage, digits-mlp-1.0.0 (test-only key). Native + web execute; Swift/Kotlin/.NET do not yet. crates/npm 0.14.0; registry 0.25.0.' }, { href: '/blog/same-wasm-multi-host.html', title: 'Same WASM. Browser and Node match. Agent still can’t freestyle.', desc: 'Featured · Weekly demo: identical core.authorize@1.2.0 bytes on Browser + Node deny junior_analyst $2.4M wire; allow treasury_ops + MFA/dual-control. Traverse v0.13.0 multi-host.' }, { href: '/blog/where-business-logic-lives.html', title: 'Where business logic lives (hosts stay thin)', desc: 'Featured · Narrative companion to the where-logic Q&A: capabilities hold non-UI domain rules; hosts = UI + I/O; utilities ≠ ceiling; apps-not-ready ≠ leave logic in the host.' }, { href: '/blog/what-is-real-today-start-here.html', title: 'Start here: what is real in Traverse today', desc: 'Featured · Narrative companion to /what-is-real-today: discover→execute→trace, skill-first authoring, one shared runtime.wasm, honest consumers, pre-1.0.' }, diff --git a/src/pages/blog/traverse-0-14-0-what-changed-for-embedders.astro b/src/pages/blog/traverse-0-14-0-what-changed-for-embedders.astro new file mode 100644 index 0000000..a705570 --- /dev/null +++ b/src/pages/blog/traverse-0-14-0-what-changed-for-embedders.astro @@ -0,0 +1,122 @@ +--- +import SubpageLayout from '@layouts/SubpageLayout.astro'; + +const _body = ` +
+
+
+ ← Blog + September 29, 2026 + Release + Embedders + Models +
+

v0.14.0: what changed for embedders

+
+ By Enrico Piovesan + 4 min read +
+
+
+ +
+
+ +
+ +

Traverse v0.14.0 is the signed exact-ref model cut. One shared runtime.wasm. Hosts stay UI + WASI/WIT I/O. Capabilities still discover → execute → trace. The agent proposes; the runtime decides.

+ +
+ Short version for embedders: model packages are signed, bound to the app that pins them, and checked against host-owned trust roots. Native Rust and the web embedder execute exact-ref models today. Swift / Kotlin / .NET do not — yet. +
+ +

Breaking for Spec 138 consumers

+ +
    +
  • Manifests move to schema 2.0.0. Every package ships a detached Ed25519 model.sig.json over the exact model.manifest.json bytes.
    • +
  • Host-owned trust roots: TrustedModelKeys (Rust) / trustedPublicKeysHex (web). Apps never add trust.
    • +
  • register_package / registerPackage replaces insertVerified — signature, trusted key, digest, schema, rights, target, and limits are checked before the package enters the cache. Every execute re-hashes cached bytes.
    • +
  • Pins bind the SHA-256 of those manifest bytes and declare target, expected rights, and an optional signer key_id.
    • +
+ +

First trained model

+ +

digits-mlp-1.0.0 — a 64→32→10 MLP on UCI Optical Recognition of Handwritten Digits (CC BY 4.0). 96.10% held-out. Bit-identical trainer / native / browser. Signed with the test-only key; production model signing is traverse#1567.

+ +

Honest host matrix

+ +
    +
  • Rust native + web — exact-ref execute ships in this cut.
    • +
  • Swift / Kotlin / .NET — in-tree embedders continue; they do not execute exact-ref models yet.
    • +
+ +

SDKs, MCP, and CLI are embedders and clients of the same orchestrator — not different Traverse runtimes.

+ +

Pins

+ +

crates.io lockstep at 0.14.0 with traverse-embedder-web@0.14.0. Pin traverse-registry =0.25.0 if you consume the registry crate directly.

+ +

Upgrade

+ +

Re-sign and re-pin every Spec 138 model package. Schema 1.0.0 manifests no longer verify. Constructors now require trust roots. Switch callers from insertVerified to registerPackage.

+ +

Step-by-step: upgrade-to-v0.14.0.md.

+ +

Full notes: GitHub Release · Announcement #1576 · Q&A What is exact-ref model execution?.

+ +
+ + + +
+
+`; +--- + + + +