Release a model

A model release needs three things: a pinned version, weights anyone can check, and a say in where they live. Permafrost covers all three with features you already have. There is nothing new to install.

The shape of a release

A release is a folder plus a manifest that lists every file’s sha256. The manifest’s own sha256 is the release id. Store the folder under a prefix, and add a small pointer object at by-id/<release id> that names the prefix. Then a release id alone is enough to find and check the whole release.

This is a convention, not a Permafrost format: any manifest that lists hashes works.

Upload

Use S3 access keys with path-style addressing (S3 compatibility):

aws --endpoint-url "$HOST" s3 sync ./my-model-v1 s3://model-releases/my-model/v1/ \
  --metadata permafrost-fingerprint-kind=plaintext
printf 'my-model/v1/\n' > pointer
aws --endpoint-url "$HOST" s3 cp pointer "s3://model-releases/my-model/by-id/$RELEASE_ID" \
  --metadata permafrost-fingerprint-kind=plaintext

Weights anyone can check need a plain fingerprint, which --metadata asks for; an encrypted file’s is salted by default.

Large weights go up in parts. Every file, the manifest included, gets its own receipt on Sui. Upload a new version under the same key and its receipt points back to the one it replaced.

Choose encryption before you upload

• Every file is encrypted at rest by default, whether it goes up in one request or in parts. The receipt still fingerprints your original bytes and records their size.
• Read it: each receipt says whether its file was stored encrypted witnessed.
• Your own keys: use your own key service, or encrypt before upload. The receipt then covers your encrypted copy.
• Public weights: store them as they are. Anyone can then read them straight from Walrus, without us (Leaving).

Anyone can check the weights

Hash the file and ask, with no credential (Verify a file):

curl -sS "$HOST/v1/api/verify?hash=$(shasum -a 256 model.safetensors | cut -d' ' -f1)"

The answer names the receipt on Sui; open it in any explorer. pf-verify (provided at onboarding) checks it from Sui alone: pf-verify receipt <id> --file model.safetensors verifiable.

Readers

Your own keys read the release. To let someone else download it, give them a grant with get and list on the release’s prefix. They read it over plain S3, and you can revoke it with one signature.

Where it lives, and for how long

Decide where each release lives with placement and how long with retention. Deleting a version removes it from your bucket. Its receipt stays on Sui as the record of what was published verifiable.

Worked example

A classifier release of 17 files and 1.02 GB, with 834 MB of weights in 100 parts, uploaded with the stock AWS CLI at its defaults; every part was encrypted at rest. All 17 files got receipts on Sui. Fetched into an empty directory from the release id alone, every sha256 matched the manifest, and the manifest matched the id.