0058: Vetted models, mirrored on R2

Status: accepted. It extends 0013 and the signed builds manifest of 0017 and 0019.

Context

Local dictation, meeting notes and chat need open models of 0.5 to 18 GB and two C++ engines (transcribe.cpp for speech, llama.cpp for language). Invariant 7 asks that every download be verified. Model repositories on Hugging Face often ship no license file, and community conversions of the same model differ by runtime. Compiling the engines in Short Leash's own CI would cost minutes on every pull request.

Decision

• Engines are built in ShortLeash/runtimes from pinned commits, with attestations:
  • transcribe.cpp at the tag the transcribe-cpp-sys crate in Cargo.lock expects;
  • llama.cpp and its common library at the commit the vendored llama-cpp-sys-2 pins, b8146 or later.
  • Each engine keeps its own ggml. fetch-voice-engines.sh checks GitHub's digest and the attestation before unpacking, as fetch-libwebrtc.sh does.
• Speech models are converted and quantized by ShortLeash/runtimes itself from upstream weights at a pinned commit, with transcribe.cpp's converter at the engine's commit, so the file always matches the engine.
• Language models are taken as published, pinned by commit and SHA-256, and never modified. Short Leash's chat template for each one is a signed catalog field applied when the model loads; a file's embedded template is ignored.
• Licenses. ShortLeash/runtimes keeps an allowlist (MIT, Apache-2.0, CC-BY-4.0, OpenMDW-1.1), reads license_name when Hugging Face reports other, and writes a NOTICE per model. The NOTICE names the creator chain, the source and commit, the license, the disclaimer, and that Short Leash converted and quantized the file. OpenMDW ends your rights if you sue claiming the model infringes; that is recorded here.
• Publishing. publish-runtimes verifies the attested catalog (models.yml on main, hosted runners only), streams each model through a SHA-256 check into R2, and lists it in the signed manifest's models array with its NOTICE beside it. The app downloads catalog models only from downloads.shortleash.dev and checks the signed SHA-256. The app also carries the catalog's ids, hashes and sizes, so an old manifest still offers the defaults.
• Updates. A weekly job in ShortLeash/runtimes checks Hugging Face for newer versions of listed models and opens a pull request; nothing ships until it is merged.

Consequences

• A catalog change ships without an app release, and a renamed or deleted upstream repository doesn't break anyone's download.
• R2 holds about 30 GB of models. Egress is free; storage costs cents a month.
• Short Leash owns the conversion of the speech models, so a new speech model needs a conversion recipe as well as a pin.
• The weekly job needs the repository setting that lets Actions open pull requests, and each run on such a pull request waits for approval.