What shipped in Traverse. Each release is backed by versioned, reviewable work.
Traverse v0.14.0 lands signed Spec 138: schema 2.0.0 manifests and a detached Ed25519 model.sig.json over the exact model.manifest.json bytes. App manifests pin those bytes (SHA-256), plus target, expected rights, and an optional signer key_id. Embedder notes: what changed for embedders. Announcement: Discussion #1576.
Host-owned trust roots
- Trust lists live on the host (TrustedModelKeys on Rust, trustedPublicKeysHex on web). Applications cannot inject keys. Registration verifies the signature against a trusted key, the digest against exactly one pin, and the manifest schema (unknown fields fail closed), rights, target, and limits. Every execute re-hashes cached bytes. Failures stay typed (model_unavailable / model_incompatible) with a stable reason.
+ Trust lists live on the host (TrustedModelKeys on Rust, trustedPublicKeysHex on web and Swift ExactModelHost). Applications cannot inject keys. Registration verifies the signature against a trusted key, the digest against exactly one pin, and the manifest schema (unknown fields fail closed), rights, target, and limits. Every execute re-hashes cached bytes. Failures stay typed (model_unavailable / model_incompatible) with a stable reason.
Test-only key vs production
The first trained package digits-mlp-1.0.0 is signed with a test-only key so CI and demos can exercise the path. Production model signing is tracked separately as #1567. Do not treat the test key as a production trust root.
Host honesty
- Exact-ref execute is implemented on native Rust and the web embedder today. Swift, Kotlin, and .NET embedders do not execute exact-ref models yet — check Platforms. This page is about signed-model trust for Spec 138 exact-ref; it does not claim a generic ONNX runner is shipped. Deeper loop: What is exact-ref model execution?
+ Exact-ref execute is implemented on native Rust, the web embedder, and Swift ExactModelHost (xcframework swift-host-v0.14.0-1 + Package.swift pin). Kotlin and .NET do not execute exact-ref yet — check Platforms. This page is about signed-model trust for Spec 138 exact-ref; it does not claim a generic ONNX runner is shipped. Deeper loop: What is exact-ref model execution?
diff --git a/src/pages/questions/what-is-exact-ref-model-execution.astro b/src/pages/questions/what-is-exact-ref-model-execution.astro
index d1fb44d..c993565 100644
--- a/src/pages/questions/what-is-exact-ref-model-execution.astro
+++ b/src/pages/questions/what-is-exact-ref-model-execution.astro
@@ -9,7 +9,7 @@ const jsonLd = JSON.stringify({
name: 'What is exact-ref model execution in Traverse?',
acceptedAnswer: {
'@type': 'Answer',
- text: 'Exact-ref model execution is how Traverse runs a WASM model package that an app has pinned by digest and signature — never by a naked URL. Hosts call the Spec 137 model.execute surface with opaque input_ref / output_ref handles. As of Traverse v0.14.0, packages use schema 2.0.0 manifests plus a detached Ed25519 model.sig.json; host-owned trust roots gate register_package; the first trained digits-mlp-1.0.0 ships signed with a test-only key (production signing is separate). Exact-ref execute is implemented on native Rust and web only — Swift, Kotlin, and .NET do not execute exact-ref yet. First landed in v0.12.0.',
+ text: 'Exact-ref model execution is how Traverse runs a WASM model package that an app has pinned by digest and signature — never by a naked URL. Hosts call the Spec 137 model.execute surface with opaque input_ref / output_ref handles. As of Traverse v0.14.0, packages use schema 2.0.0 manifests plus a detached Ed25519 model.sig.json; host-owned trust roots gate register_package; the first trained digits-mlp-1.0.0 ships signed with a test-only key (production signing is separate). Exact-ref execute is implemented on native Rust, web, and Swift ExactModelHost (Package.swift pin to swift-host-v0.14.0-1); Kotlin and .NET do not execute exact-ref yet. First landed in v0.12.0; Swift parity closed #1579 on 2026-09-30.',
},
}],
});
@@ -26,7 +26,7 @@ const relatedLinks = [
---
Traverse app manifests declare exact model references. As of v0.14.0, manifests use schema 2.0.0 and every package ships a detached Ed25519 model.sig.json over the exact model.manifest.json bytes. An application's exact_model_dependencies pin binds the SHA-256 of those manifest bytes and declares target, expected rights, and an optional signer key_id. You cannot “upgrade” a model by swapping the file behind a URL.
Host-owned trust
- Trust roots are host-owned (TrustedModelKeys on Rust, trustedPublicKeysHex on web). Apps can never add trust. Packages enter the cache only through register_package / registerPackage, which verifies the signature and trusted key, the digest against exactly one pin, and the manifest schema (unknown fields fail closed), rights, target, and limits. Every execute re-hashes the cached bytes. Failures keep model_unavailable / model_incompatible and add a stable reason.
+ Trust roots are host-owned (TrustedModelKeys on Rust, trustedPublicKeysHex on web and Swift ExactModelHost). Apps can never add trust. Packages enter the cache only through register_package / registerPackage, which verifies the signature and trusted key, the digest against exactly one pin, and the manifest schema (unknown fields fail closed), rights, target, and limits. Every execute re-hashes the cached bytes. Failures keep model_unavailable / model_incompatible and add a stable reason.
One envelope, any host that implements it
The call surface is the existing Spec 137 model.execute host-connector command — not a new public guest import, and not Spec 045’s candidate/LLM resolution track. Request and response are versioned. Inputs and outputs travel as opaque input_ref / output_ref handles. Browser and native use the same envelopes when both implement execute.
What landed in v0.14.0
Spec 138 first shipped in v0.12.0 (see the historical v0.12.0 write-up). v0.14.0 adds signed packages, host-owned trust, machine-readable rights, and the first trained model digits-mlp-1.0.0 (64→32→10 MLP on UCI digits, CC BY 4.0, 96.10% held-out, bit-identical trainer / native / browser). That package is signed with the test-only key; production model signing is #1567.
- Host honesty: exact-ref execute is implemented in the Rust native runtime and the web embedder today. The Swift, Kotlin, and .NET embedders do not execute exact-ref models yet. Pin crates.io and npm at 0.14.0 (and traverse-registry at =0.25.0 if you consume it directly).
+ Host honesty: exact-ref execute is implemented in the Rust native runtime, the web embedder, and Swift ExactModelHost (published xcframework swift-host-v0.14.0-1; Package.swift binary pin; digits conformance byte-identical). Kotlin and .NET do not execute exact-ref yet. Pin crates.io and npm at 0.14.0 (and traverse-registry at =0.25.0 if you consume it directly).
What it is not
- It is not “the model is in charge.” It is not Spec 045. It is not a guest model_invoke import — that stays out of scope for Spec 138 v1. And it is not permission to treat a URL as a model identity, or to assume every native embedder language already executes exact-ref.
+ It is not “the model is in charge.” It is not Spec 045. It is not a guest model_invoke import — that stays out of scope for Spec 138 v1. And it is not permission to treat a URL as a model identity, or to assume Kotlin/.NET already execute exact-ref.