diff --git a/public/assets/img/blog/signed-exact-ref-digits-2026-10-02/01-landing.webp b/public/assets/img/blog/signed-exact-ref-digits-2026-10-02/01-landing.webp new file mode 100644 index 0000000..e59f4db Binary files /dev/null and b/public/assets/img/blog/signed-exact-ref-digits-2026-10-02/01-landing.webp differ diff --git a/public/assets/img/blog/signed-exact-ref-digits-2026-10-02/02-classify-success.webp b/public/assets/img/blog/signed-exact-ref-digits-2026-10-02/02-classify-success.webp new file mode 100644 index 0000000..9e26e44 Binary files /dev/null and b/public/assets/img/blog/signed-exact-ref-digits-2026-10-02/02-classify-success.webp differ diff --git a/public/assets/img/blog/signed-exact-ref-digits-2026-10-02/03-attack-fail-closed.webp b/public/assets/img/blog/signed-exact-ref-digits-2026-10-02/03-attack-fail-closed.webp new file mode 100644 index 0000000..570021f Binary files /dev/null and b/public/assets/img/blog/signed-exact-ref-digits-2026-10-02/03-attack-fail-closed.webp differ diff --git a/public/llms.txt b/public/llms.txt index a519d6d..a17dff1 100644 --- a/public/llms.txt +++ b/public/llms.txt @@ -22,8 +22,9 @@ Current packages: crates.io at 0.14.0 (pin `traverse-registry` at `=0.25.0` if y - [What does “the agent proposes; the runtime decides” mean?](https://traverse-framework.com/questions/what-does-agent-proposes-runtime-decides-mean.html): boundary in one page — agents search/plan/suggest; runtime validates, executes or denies, leaves a trace. - [What is one shared runtime.wasm?](https://traverse-framework.com/questions/what-is-one-shared-runtime-wasm.html): embedders are clients; honest consumer list. - [The agent freestyled a $2.4M wire. The runtime said no.](https://traverse-framework.com/blog/agent-freestyle-blocked.html): project direction in one scene — agent proposes, runtime decides (deny + trace). +- [Signed model. Exact pin. Bit-identical hosts.](https://traverse-framework.com/blog/signed-exact-ref-digits.html): v0.14.0 weekly demo — signed `digits-mlp-1.0.0` exact-ref package, same bytes on Browser + Node (`ExactModelBrowserHost`); tamper → `digest_mismatch`; test-only key (prod signing #1567). Not catalog `model.execute`. Not Hugging Face. - [Same WASM. Browser and Node match. Agent still can’t freestyle.](https://traverse-framework.com/blog/same-wasm-multi-host.html): v0.13.0 multi-host — identical `core.authorize@1.2.0` bytes on Browser + Node; agent treasury cheat still denied. -- Deny / multi-host direction (public write-ups): [agent freestyle → blocked](https://traverse-framework.com/blog/agent-freestyle-blocked.html) · [same-wasm multi-host](https://traverse-framework.com/blog/same-wasm-multi-host.html) · [How do I run the deny demo?](https://traverse-framework.com/questions/how-do-i-run-the-agent-blocked-weekly-demo.html). Note: `traverse-framework/weekly-demos` is **not publicly cloneable yet** (tracked in [.github#30](https://github.com/traverse-framework/.github/issues/30)) — prefer the blogs until that lands. +- Weekly demos (public write-ups; repo still private): [signed exact-ref digits](https://traverse-framework.com/blog/signed-exact-ref-digits.html) · [same-wasm multi-host](https://traverse-framework.com/blog/same-wasm-multi-host.html) · [agent freestyle → blocked](https://traverse-framework.com/blog/agent-freestyle-blocked.html) · [How do I run the deny demo?](https://traverse-framework.com/questions/how-do-i-run-the-agent-blocked-weekly-demo.html). Note: `traverse-framework/weekly-demos` is **not publicly cloneable yet** (tracked in [.github#30](https://github.com/traverse-framework/.github/issues/30)) — prefer the blogs until that lands. Access-only tree for this week: `weekly-demos/2026-10-02-signed-exact-ref`. - [Platforms](https://traverse-framework.com/platforms.html): native + browser shipped; Swift/Kotlin/.NET in progress (not packaged); edge planned; cloud non-goal. ## Start here @@ -36,7 +37,7 @@ Current packages: crates.io at 0.14.0 (pin `traverse-registry` at `=0.25.0` if y ## Building with an agent -- **Direction (same as Required reading above):** [same-wasm multi-host](https://traverse-framework.com/blog/same-wasm-multi-host.html) · [deny demo blog](https://traverse-framework.com/blog/agent-freestyle-blocked.html) · [what-is-real-today](https://traverse-framework.com/what-is-real-today.html) · [run the deny demo (blog-first; weekly-demos not public yet)](https://traverse-framework.com/questions/how-do-i-run-the-agent-blocked-weekly-demo.html). +- **Direction (same as Required reading above):** [signed exact-ref digits](https://traverse-framework.com/blog/signed-exact-ref-digits.html) · [same-wasm multi-host](https://traverse-framework.com/blog/same-wasm-multi-host.html) · [deny demo blog](https://traverse-framework.com/blog/agent-freestyle-blocked.html) · [what-is-real-today](https://traverse-framework.com/what-is-real-today.html) · [run the deny demo (blog-first; weekly-demos not public yet)](https://traverse-framework.com/questions/how-do-i-run-the-agent-blocked-weekly-demo.html). - [For AI Agents](https://traverse-framework.com/agents.html): the real MCP tool list (ten commands: describe_server, list_content_groups, describe_content_group, list_entrypoints, search_capabilities, describe_entrypoint, validate_entrypoint, execute_entrypoint, render_execution_report, shutdown), the discover-inspect-execute-trace flow, and the honest limits (stdio is the packaged bootstrap today; in-process library functions exist on traverse-mcp, but there is no separate HTTP MCP listener as a packaged product). - [traverse-framework/claude-skills](https://github.com/traverse-framework/claude-skills): Claude Skills for building apps with Traverse — starting with `traverse-capability-author` (plus extractor and workflow-planner), which checks the registry before authoring, produces contract + WASM, and validates against the real traverse-cli — including this platform's current execution limitations. - [How do I author a capability in plain English?](https://traverse-framework.com/questions/how-do-i-author-a-capability-in-plain-english.html): Claude skill `traverse-capability-author` — interview → registry check → contract → WASM → human-reviewed PR; under the hood still Rust→WASM; manual Rust is secondary. @@ -70,7 +71,7 @@ Current packages: crates.io at 0.14.0 (pin `traverse-registry` at `=0.25.0` if y ## Optional -- [Blog](https://traverse-framework.com/blog.html): engineering write-ups, dated — treat as historical snapshots, not current-state claims. Latest: [Domain packs are in scope: print-support](https://traverse-framework.com/blog/print-support-domain-pack.html) (capability pack; none published yet). Also: [v0.14.0: what changed for embedders](https://traverse-framework.com/blog/traverse-0-14-0-what-changed-for-embedders.html) (signed Spec 138; native+web+Swift ExactModelHost exact-ref; test-only digits-mlp key). Also: [Where business logic lives (hosts stay thin)](https://traverse-framework.com/blog/where-business-logic-lives.html). Weekly demo: [Same WASM. Browser and Node match. Agent still can’t freestyle.](https://traverse-framework.com/blog/same-wasm-multi-host.html) (v0.13.0 multi-host). Prior: [agent freestyle → blocked](https://traverse-framework.com/blog/agent-freestyle-blocked.html). Authoring: [You don't need Rust to publish a capability](https://traverse-framework.com/blog/you-dont-need-rust-to-publish-a-capability.html). +- [Blog](https://traverse-framework.com/blog.html): engineering write-ups, dated — treat as historical snapshots, not current-state claims. Latest: [Signed model. Exact pin. Bit-identical hosts.](https://traverse-framework.com/blog/signed-exact-ref-digits.html) (v0.14.0 weekly demo; Browser+Node; test-only key). Also: [Domain packs are in scope: print-support](https://traverse-framework.com/blog/print-support-domain-pack.html) (capability pack; none published yet). Also: [v0.14.0: what changed for embedders](https://traverse-framework.com/blog/traverse-0-14-0-what-changed-for-embedders.html) (signed Spec 138; native+web+Swift ExactModelHost exact-ref; test-only digits-mlp key). Also: [Where business logic lives (hosts stay thin)](https://traverse-framework.com/blog/where-business-logic-lives.html). Weekly demo: [Same WASM. Browser and Node match. Agent still can’t freestyle.](https://traverse-framework.com/blog/same-wasm-multi-host.html) (v0.13.0 multi-host). Prior: [agent freestyle → blocked](https://traverse-framework.com/blog/agent-freestyle-blocked.html). Authoring: [You don't need Rust to publish a capability](https://traverse-framework.com/blog/you-dont-need-rust-to-publish-a-capability.html). - [Discover](https://traverse-framework.com/discover.html): a live browser demo that pulls the public registry and executes a reviewed plan locally. Read [what it proves](https://traverse-framework.com/blog/what-discover-proves.html) before quoting it. - [Compare: vs microservices](https://traverse-framework.com/compare/vs-microservices.html), [vs serverless](https://traverse-framework.com/compare/vs-serverless.html), [vs function calling](https://traverse-framework.com/compare/vs-function-calling.html), [vs agent runtimes](https://traverse-framework.com/compare/vs-agent-runtimes.html), [vs WASM runtimes](https://traverse-framework.com/compare/vs-wasm-runtimes.html), [vs cross-platform frameworks](https://traverse-framework.com/compare/vs-cross-platform-frameworks.html) - [About](https://traverse-framework.com/about.html): project history and motivation. diff --git a/src/pages/blog/index.astro b/src/pages/blog/index.astro index 1e181c5..e7d62ec 100644 --- a/src/pages/blog/index.astro +++ b/src/pages/blog/index.astro @@ -2,6 +2,7 @@ import SubpageLayout from '@layouts/SubpageLayout.astro'; const posts = [ + { href: '/blog/signed-exact-ref-digits.html', title: 'Signed model. Exact pin. Bit-identical hosts.', desc: 'Featured · Weekly demo: signed digits-mlp-1.0.0 exact-ref package, same bytes on Browser + Node via ExactModelBrowserHost; tamper fail-closed (digest_mismatch). Traverse v0.14.0. Test-only key.' }, { href: '/blog/print-support-domain-pack.html', title: 'Domain packs are in scope: print-support without an app rewrite', desc: 'Featured · Manufacturing-shaped capability pack under discover→execute→trace; apps-not-ready ≠ no domain packs; hosts stay thin; none of the print.* capabilities published yet. registry#596 · #597–#604 · Discussion #1540.' }, { href: '/blog/traverse-0-14-0-what-changed-for-embedders.html', title: 'v0.14.0: what changed for embedders', desc: 'Featured · Signed Spec 138 (schema 2.0.0 + model.sig.json), host-owned trust, registerPackage, digits-mlp-1.0.0 (test-only key). Native + web + Swift ExactModelHost execute; Kotlin/.NET do not yet. crates/npm 0.14.0; registry 0.25.0.' }, { href: '/blog/same-wasm-multi-host.html', title: 'Same WASM. Browser and Node match. Agent still can’t freestyle.', desc: 'Featured · Weekly demo: identical core.authorize@1.2.0 bytes on Browser + Node deny junior_analyst $2.4M wire; allow treasury_ops + MFA/dual-control. Traverse v0.13.0 multi-host.' }, diff --git a/src/pages/blog/signed-exact-ref-digits.astro b/src/pages/blog/signed-exact-ref-digits.astro new file mode 100644 index 0000000..4679410 --- /dev/null +++ b/src/pages/blog/signed-exact-ref-digits.astro @@ -0,0 +1,202 @@ +--- +import SubpageLayout from '@layouts/SubpageLayout.astro'; + +const _body = ` +
+
+
+ ← Blog + October 2, 2026 + Demo + Models + Runtime +
+

Signed model. Exact pin. Bit-identical hosts.

+
+ By Enrico Piovesan + 5 min read +
+
+
+ +
+
+ +
+ +

An agent tries to swap a model. Traverse only admits the exact signed package. Friday’s demo classifies a handwritten digit with the same digits-mlp-1.0.0 bytes on Browser and Node. Change one WASM byte and the host fails closed. This is not a pricing explainer, and it is not Hugging Face.

+ +
+ Short version: pin the SHA-256 of the manifest bytes, check an Ed25519 model.sig.json against host-owned trust roots, then registerPackage on ExactModelBrowserHost. Same package. Same npm embedder. Browser and Node. Discover → execute → trace. +
+ +

Public proof is this write-up and the screenshots. The runnable folder weekly-demos/2026-10-02-signed-exact-ref is for people who already have access. weekly-demos is still not publicly cloneable (.github#30). There is no public-clone CTA. Status of the earlier deny demo: How do I run the agent-blocked weekly demo?.

+ +
+ Signed exact-ref demo landing: pin and trust root, Browser host waiting to register, Node proof JSON +
Landing: pin + host-owned trust, Browser host, and the Node proof column. Same traverse-embedder-web@0.14.0 package.
+
+ +

Why the pin is the product

+ +

Traverse v0.14.0 ships signed exact-ref model packages. Manifest schema 2.0.0. A detached Ed25519 model.sig.json covers the manifest bytes. Trust roots live on the host — the app cannot add a key. Pins bind the SHA-256 of those manifest bytes and declare target, expected rights, and an optional key_id.

+ +

The first trained package in this demo is digits-mlp-1.0.0 (traverse.digits-mlp@1.0.0): a 64→32→10 MLP on UCI Optical Recognition of Handwritten Digits (CC BY 4.0), 96.10% held-out, as recorded with the package. One shared runtime.wasm. Hosts are UI + I/O, not a second runtime.

+ +

The Node column is that published web embedder under Node — ExactModelBrowserHost plus registerPackage. It is not a separate native Rust CLI, and it is not a different runtime.

+ +

What happened

+ +
+ + + + + + + + + + +
CheckResult
Node classifyDigits 0 → 0, 7 → 7, 4 → 4. Output frames match the conformance fixture byte for byte.
Browser ↔ NodeLabel 0 on the browser host is bit_identical to the Node case (same package bytes, same outputHex).
TamperSwap one WASM byte → fail closed. Code model_incompatible, reason digest_mismatch.
Empty trustNo host trust roots → key_untrusted.
+
+ +
+ Classify success: digit 0 predicted 0 with matching Browser and Node output hex +
Register + classify: predicted 0, and the Browser output hex matches Node.
+
+ +
+ Tamper attack fail-closed: ExactModelError digest_mismatch after one WASM byte swap +
Attack: one WASM byte swapped. Signature still covers the manifest; the WASM digest check fails closed.
+
+ +

Hosts in this demo

+ +
+ + + + + + + + + +
ColumnWhat it is
BrowserExactModelBrowserHost from traverse-embedder-web@0.14.0. registerPackage(manifestBytes, wasm, signatureBytes).
NodeThe same npm host under Node. Not a native Rust CLI invoke.
Not in this proofSwift, Kotlin, and .NET do not execute exact-ref on the published v0.14.0 pins used here.
+
+ +

Facts for agents

+ +
+
    +
  • Theme: Signed model. Exact pin. Bit-identical hosts (week of 2026-10-02).
    • +
  • Public proof: this post and its screenshots. Runnable tree (access required, repo private): 2026-10-02-signed-exact-ref. Not a public clone — .github#30.
    • +
  • Product pins: tags v0.14.0 and web-v0.14.0 @ 4dac877c2fe0b28491848016747850ae31327ebc. npm traverse-embedder-web@0.14.0.
    • +
  • Model: traverse.digits-mlp@1.0.0. Manifest schema 2.0.0. Governing spec 138-governed-exact-model-execution.
    • +
  • Manifest / pin sha256: 3068f3ae464fbbb43b45b089ab225a1371060a94a214c10629b4d8e402e8eadf
    • +
  • WASM sha256: 6eeea06029ce4210842edfe70d7e0d8d7e926953ead5f18a0dca3c351ad5dc88
    • +
  • Path: ExactModelBrowserHost + registerPackage (not insertVerified). Host-owned trust roots only.
    • +
  • Smoke: 0→0, 7→7, 4→4 on Node; Browser label 0 bit-identical to Node; tamper → digest_mismatch; empty trust → key_untrusted.
    • +
  • Signing key: test-only fixture. Production signing is traverse#1567. Do not trust this key in a real host.
    • +
  • Not claimed: Hugging Face. Catalog model.execute (the catalog still has none). Swift / Kotlin / .NET exact-ref execute on published 0.14.0. A separate native CLI. A second runtime.
    • +
  • Lead claim: one shared runtime.wasm. Hosts = UI + I/O. Discover → execute → trace.
    • +
+
+ +

Same signed bytes. Visible trace. A swapped byte does not get to run.

+ +
+ + + +
+
+ +
+
+

Signed bytes. Runtime decides.

+

Browser and Node share the pinned model package. A tampered WASM byte fails closed.

+
+ For AI agents → + Embedder notes → + Weekly demos are blog-first → +
+
+
+`; +--- + + + +