Struct ModelRegistry 

pub struct ModelRegistry { /* private fields */ }

Adopted models, persisted as JSON when opened on a path.

Implementations

impl ModelRegistry

pub fn in_memory() -> Self

A registry that is not persisted.

pub fn with_trust(self, trust: ModelTrust) -> Self

Set what resolve verifies against.

pub fn set_trust(&self, trust: ModelTrust)

Replace the trust (a key was pinned or removed, a revocation list was swapped). Takes effect on the next resolve.

pub fn open(path: impl Into<PathBuf>) -> Result<Self, ModelError>

Open (or start) the registry file at path.

pub fn adopt( &self, scanned: ScannedModel, key: &SigningKey, key_id: &str, anchors: &TrustAnchors, replace: bool, ) -> Result<AdoptedModel, ModelError>

Attest a scanned model with the operator key and register it. The key must be pinned in anchors, otherwise the attestation does not verify and nothing is registered. A different manifest under an existing name is refused unless replace is set.

pub fn attach( &self, envelope: &ManifestEnvelope, root: &Path, anchors: &TrustAnchors, replace: bool, ) -> Result<AdoptedModel, ModelError>

Register an already-attested manifest (for example one fetched from another node) whose files lie under root. Its signature is checked against anchors; file hashes are checked lazily on first use.

pub fn remove(&self, id_or_name: &str) -> Result<(), ModelError>

Forget a model (files are untouched).

pub fn entries(&self) -> Vec<(String, ModelEntry)>

Snapshot of every entry, keyed by package id.

pub fn get(&self, id_or_name: &str) -> Result<(String, ModelEntry), ModelError>

One entry by package id or name.

pub fn check( &self, id_or_name: &str, mode: CheckMode, ) -> Result<ModelCheck, ModelError>

Check a model’s files.

impl ModelRegistry

pub fn set_advertised( &self, id_or_name: &str, advertised: bool, ) -> Result<(), ModelError>

Hide or advertise a model in node facts (local, unsigned opt-out: shard hashes fingerprint which models this node holds).

pub fn resolve(&self, id_or_name: &str) -> Result<ResolvedModel, ModelError>

The model for an adapter to load, verified against the registry’s trust (see with_trust); refused with ModelError::NotReady when none is set.

What a caller may rely on when this returns Ok:

• the attestation verifies against the pinned anchors now, and the package, its signers and its shard hashes are not revoked;
• the registry’s file list equals the attested body;
• every file resolves inside the model root (or its HF blobs/), and the returned paths are those resolved locations;
• the first resolve of a model in this process hashed every byte (a full check, which on a 45 GB model takes minutes); later resolves re-hash only files whose size or mtime changed.

The lazy window: after the first resolve, a file replaced with the same size and the same mtime is not noticed until the next process start or an explicit CheckMode::Full check. Adapters that must close that window call check(.., CheckMode::Full) before loading. Paths are returned, not handles: a file can still change between this call and the adapter opening it.

pub fn resolve_with( &self, id_or_name: &str, trust: &ModelTrust, ) -> Result<ResolvedModel, ModelError>

resolve against an explicit trust (the sharing gate passes the anchors the caller holds right now).

Trait Implementations

impl Debug for ModelRegistry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.