Module net 

Shared transport-level guards for everything the worker downloads.

Model files, sd-cli archives, ONNX runtimes, and auto-update installers all arrive over HTTP and are then either loaded into an engine or executed — so a plaintext-http fetch is a man-in-the-middle away from model poisoning or remote code execution. Every downloader routes its URL through validate_download_url before the first byte is requested.

Functions

validate_download_url

Refuse any download URL that is not https. Loopback http is allowed so test suites (wiremock) and air-gapped local mirrors keep working; everything else — remote http, file, ftp, garbage — is rejected before any request is made. what names the artefact class (e.g. "model file", "installer") so the error tells the operator which config/registry entry to fix.