@rigour-labs/core 6.3.0 → 6.3.1

package/dist/inference/model-download.test.js

@@ -9,7 +9,7 @@ const home = vi.hoisted(() => {
     return p.join(o.tmpdir(), `rigour-models-${process.pid}-${Date.now()}`);
 });
 vi.mock('../storage/db.js', () => ({ RIGOUR_DIR: home }));
-const { downloadModel, getCachedModel } = await import('./model-manager.js');
+const { checkForUpdates, downloadModel, getCachedModel, normalizeModelVersion } = await import('./model-manager.js');
 const { FALLBACK_MODELS, MODELS } = await import('./types.js');
 const modelsDir = path.join(home, 'models');
 const PAYLOAD = Buffer.from('gguf-model-bytes');
@@ -22,7 +22,7 @@ describe('downloadModel', () => {
     beforeEach(async () => {
         await fs.remove(home);
         // A fresh version check: no network call to Hugging Face.
-        await fs.outputJson(path.join(modelsDir, '.latest_version.json'), { version: '2.0.0', checkedAt: new Date().toISOString() });
+        await fs.outputJson(path.join(modelsDir, '.latest_version.json'), { format: 2, version: '5', checkedAt: new Date().toISOString() });
     });
     afterAll(async () => { await fs.remove(home); });
     it('falls back to the stock model when the fine-tuned model is unavailable, and says so', async () => {
@@ -39,6 +39,19 @@ describe('downloadModel', () => {
         const meta = await fs.readJson(`${modelPath}.meta.json`);
         expect(meta).toMatchObject({ sha256: PAYLOAD_SHA, sizeBytes: PAYLOAD.length, sourceUrl: FALLBACK_MODELS.lite.url });
     });
+    it('retries the fine-tuned model once a day when only the stock fallback is cached', async () => {
+        const failing = (url) => (url.includes('rigour-labs/') ? unauthorized : ok(PAYLOAD, PAYLOAD_SHA));
+        const stockPath = await downloadModel('lite', undefined, failing);
+        const requested = [];
+        const again = await downloadModel('lite', undefined, (url) => { requested.push(url); return unauthorized; });
+        expect(requested).toEqual([]); // failed less than a day ago: keep the fallback, no request
+        expect(again).toBe(stockPath);
+        await fs.writeJson(path.join(modelsDir, '.fine-tuned-unavailable-lite.json'), { failedAt: '2000-01-01T00:00:00Z', url: MODELS.lite.url });
+        const fineTuned = await downloadModel('lite', undefined, (url) => { requested.push(url); return ok(PAYLOAD, PAYLOAD_SHA); });
+        expect(requested).toEqual([MODELS.lite.url]);
+        expect(path.basename(fineTuned)).toBe(MODELS.lite.filename);
+        expect(await fs.pathExists(path.join(modelsDir, '.fine-tuned-unavailable-lite.json'))).toBe(false);
+    });
     it('rejects a checksum mismatch and deletes the partial download', async () => {
         const get = () => ok(PAYLOAD, 'f'.repeat(64));
         await expect(downloadModel('lite', undefined, get)).rejects.toThrow('Checksum mismatch');
@@ -65,9 +78,48 @@ describe('getCachedModel', () => {
         const cached = await getCachedModel('deep');
         expect(cached).toMatchObject({ fallback: true, info: { filename: FALLBACK_MODELS.deep.filename } });
     });
+    it('accepts a verified fine-tuned file smaller than the size estimate', async () => {
+        await cacheFile(MODELS.lite.filename, 397_807_360); // the published v5 lite model
+        expect(await getCachedModel('lite')).toMatchObject({ fallback: false, info: { filename: MODELS.lite.filename } });
+    });
+    it('accepts a file verified within the same millisecond it was written', async () => {
+        const file = path.join(modelsDir, FALLBACK_MODELS.deep.filename);
+        await cacheFile(FALLBACK_MODELS.deep.filename, 10);
+        const written = new Date('2026-01-01T00:00:00.000Z');
+        await fs.utimes(file, written, written.getTime() / 1000 + 0.0007); // mtime 0.7 ms into the same millisecond
+        await fs.writeJson(`${file}.meta.json`, { sha256: 'a'.repeat(64), sizeBytes: 10, verifiedAt: written.toISOString(), sourceUrl: 'https://x' });
+        expect(await getCachedModel('deep')).toMatchObject({ fallback: true });
+    });
+    it('rejects a file modified after it was verified', async () => {
+        const file = path.join(modelsDir, FALLBACK_MODELS.deep.filename);
+        await cacheFile(FALLBACK_MODELS.deep.filename, 10);
+        await fs.writeJson(`${file}.meta.json`, { sha256: 'a'.repeat(64), sizeBytes: 10, verifiedAt: '2000-01-01T00:00:00.000Z', sourceUrl: 'https://x' });
+        expect(await getCachedModel('deep')).toBeNull();
+    });
     it('ignores a file without verified metadata', async () => {
         await fs.ensureDir(modelsDir);
         await fs.writeFile(path.join(modelsDir, FALLBACK_MODELS.deep.filename), 'partial');
         expect(await getCachedModel('deep')).toBeNull();
     });
 });
+describe('model versions', () => {
+    beforeEach(async () => { await fs.remove(home); vi.unstubAllGlobals(); });
+    it('keeps published version strings as they are', () => {
+        expect(normalizeModelVersion(5)).toBe('5');
+        expect(normalizeModelVersion('5')).toBe('5');
+        expect(normalizeModelVersion('v2.1.0')).toBe('2.1.0');
+        expect(normalizeModelVersion('5.0')).toBeNull();
+        expect(normalizeModelVersion({})).toBeNull();
+    });
+    it('names the published v5 repositories by default', () => {
+        expect(MODELS.lite.url).toBe('https://huggingface.co/rigour-labs/rigour-lite-v5-gguf/resolve/main/rigour-lite-v5-q4_k_m.gguf');
+        expect(MODELS.deep.url).toBe('https://huggingface.co/rigour-labs/rigour-deep-v5-gguf/resolve/main/rigour-deep-v5-q4_k_m.gguf');
+    });
+    it('ignores a version cache from the old SemVer conversion and re-reads the published version', async () => {
+        await fs.outputJson(path.join(modelsDir, '.latest_version.json'), { version: '5.0.0', checkedAt: new Date().toISOString() });
+        vi.stubGlobal('fetch', vi.fn(async () => ({ ok: true, json: async () => ({ version: 5 }) })));
+        expect(await checkForUpdates()).toBe('5');
+        expect(await fs.readJson(path.join(modelsDir, '.latest_version.json'))).toMatchObject({ format: 2, version: '5' });
+        expect(MODELS.deep.filename).toBe('rigour-deep-v5-q4_k_m.gguf');
+    });
+});

package/dist/inference/model-manager.d.ts

@@ -26,6 +26,12 @@ export declare function getModelPath(tier: ModelTier): string;
  * Get model info for a tier.
  */
 export declare function getModelInfo(tier: ModelTier): ModelInfo;
+/**
+ * The version exactly as published. Integer versions (the RLAIF pipeline
+ * before SemVer) are published as `v5`, SemVer versions as `v2.1.0`; either
+ * way the string goes into the repository and file names unchanged.
+ */
+export declare function normalizeModelVersion(raw: unknown): string | null;
 /**
  * Check HuggingFace for a newer model version (like antivirus signature updates).
  * Reads latest_version.json from the RLAIF dataset repo. Non-blocking — if the

package/dist/inference/model-manager.js

@@ -8,6 +8,7 @@ import { createHash } from 'crypto';
 import { RIGOUR_DIR } from '../storage/db.js';
 import { downloadToFile } from './http-download.js';
 import { MODELS, FALLBACK_MODELS, VERSION_CHECK_URL, BUNDLED_MODEL_VERSION, updateModelVersion } from './types.js';
+import { Logger } from '../utils/logger.js';
 const MODELS_DIR = path.join(RIGOUR_DIR, 'models');
 const VERSION_CACHE_PATH = path.join(MODELS_DIR, '.latest_version.json');
 const VERSION_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // Check once per day
@@ -63,13 +64,14 @@ async function isFileCached(model) {
     const metadata = await readModelMeta(model.filename);
     if (!metadata)
         return false;
+    // The metadata is written only after the checksum passed, so its exact size is
+    // the completeness check; ModelInfo sizes are display estimates that differ by version.
     const stat = await fs.stat(modelPath);
-    const tolerance = model.sizeBytes * 0.1;
-    if (stat.size <= model.sizeBytes - tolerance)
-        return false;
     if (metadata.sizeBytes !== stat.size)
         return false;
-    if (new Date(metadata.verifiedAt).getTime() < stat.mtimeMs)
+    // verifiedAt has millisecond precision and mtimeMs a sub-millisecond fraction: compare
+    // whole milliseconds, or a file verified within the same millisecond looks modified.
+    if (new Date(metadata.verifiedAt).getTime() < Math.floor(stat.mtimeMs))
         return false;
     return true;
 }
@@ -161,6 +163,27 @@ async function downloadFromUrl(model, onProgress, get) {
     onProgress?.(`Model ${model.name} ready`, 100);
     return destPath;
 }
+/**
+ * Version cache format. Format 1 turned a published integer version into
+ * SemVer ("5" -> "5.0.0"), which names repositories that were never published,
+ * so those caches are ignored.
+ */
+const VERSION_CACHE_FORMAT = 2;
+/** How long a failed fine-tuned download keeps the stock fallback before retrying. */
+const FINE_TUNED_RETRY_MS = 24 * 60 * 60 * 1000;
+/**
+ * The version exactly as published. Integer versions (the RLAIF pipeline
+ * before SemVer) are published as `v5`, SemVer versions as `v2.1.0`; either
+ * way the string goes into the repository and file names unchanged.
+ */
+export function normalizeModelVersion(raw) {
+    if (typeof raw === 'number' && Number.isInteger(raw) && raw > 0)
+        return String(raw);
+    if (typeof raw !== 'string')
+        return null;
+    const value = raw.trim().replace(/^v/, '');
+    return /^\d+$/.test(value) || /^\d+\.\d+\.\d+$/.test(value) ? value : null;
+}
 /**
  * Check HuggingFace for a newer model version (like antivirus signature updates).
  * Reads latest_version.json from the RLAIF dataset repo. Non-blocking — if the
@@ -175,8 +198,8 @@ export async function checkForUpdates(onProgress) {
         if (await fs.pathExists(VERSION_CACHE_PATH)) {
             const cached = await fs.readJson(VERSION_CACHE_PATH);
             const age = Date.now() - new Date(cached.checkedAt).getTime();
-            if (age < VERSION_CHECK_INTERVAL_MS && cached.version) {
-                const v = String(cached.version);
+            const v = cached.format === VERSION_CACHE_FORMAT ? normalizeModelVersion(cached.version) : null;
+            if (age < VERSION_CHECK_INTERVAL_MS && v) {
                 updateModelVersion(v);
                 return v;
             }
@@ -193,13 +216,10 @@ export async function checkForUpdates(onProgress) {
         clearTimeout(timeout);
         if (response.ok) {
             const data = await response.json();
-            // Handle both legacy integer versions (5 → "5.0.0") and SemVer strings ("2.0.0")
-            let rawVersion = data.version ?? BUNDLED_MODEL_VERSION;
-            const latestVersion = typeof rawVersion === 'number'
-                ? `${rawVersion}.0.0`
-                : String(rawVersion);
+            const latestVersion = normalizeModelVersion(data.version) ?? BUNDLED_MODEL_VERSION;
             // Cache the result locally
             await fs.writeJson(VERSION_CACHE_PATH, {
+                format: VERSION_CACHE_FORMAT,
                 version: latestVersion,
                 checkedAt: new Date().toISOString(),
                 source: 'huggingface',
@@ -226,22 +246,42 @@ export async function downloadModel(tier, onProgress, get) {
     // Check for newer model version (non-blocking, cached 24h)
     await checkForUpdates(onProgress);
     const cached = await getCachedModel(tier);
-    if (cached) {
+    if (cached && !cached.fallback) {
         onProgress?.(`Model ${cached.info.name} already cached`, 100);
         return cached.path;
     }
+    // Only the stock fallback is cached: try the fine-tuned model again, at most once a day,
+    // so one failed download does not pin a user to the stock model forever.
+    if (cached && !(await fineTunedRetryDue(tier)))
+        return cached.path;
     const model = MODELS[tier];
     onProgress?.(`Downloading ${model.name} (${model.sizeHuman})...`, 0);
     try {
-        return await downloadFromUrl(model, onProgress, get);
+        const downloaded = await downloadFromUrl(model, onProgress, get);
+        await fs.remove(retryMarker(tier)).catch(() => { });
+        return downloaded;
     }
     catch (error) {
         const fallback = FALLBACK_MODELS[tier];
-        if (fallback && fallback.url !== model.url) {
-            onProgress?.(`Fine-tuned model unavailable (${error?.message ?? 'unknown error'}); using stock ${fallback.name}`, 0);
-            return downloadFromUrl(fallback, onProgress, get);
-        }
-        throw error;
+        if (!fallback || fallback.url === model.url)
+            throw error;
+        const reason = error?.message ?? 'unknown error';
+        Logger.warn(`Fine-tuned model ${model.name} could not be downloaded from ${model.url} (${reason}); using the stock ${fallback.name}. Deep findings will be less accurate.`);
+        onProgress?.(`Fine-tuned model unavailable (${reason}); using stock ${fallback.name}`, 0);
+        await fs.writeJson(retryMarker(tier), { failedAt: new Date().toISOString(), url: model.url, reason }).catch(() => { });
+        return cached?.path ?? downloadFromUrl(fallback, onProgress, get);
+    }
+}
+function retryMarker(tier) {
+    return path.join(MODELS_DIR, `.fine-tuned-unavailable-${tier}.json`);
+}
+async function fineTunedRetryDue(tier) {
+    try {
+        const marker = await fs.readJson(retryMarker(tier));
+        return Date.now() - new Date(marker.failedAt).getTime() >= FINE_TUNED_RETRY_MS || marker.url !== MODELS[tier].url;
+    }
+    catch {
+        return true;
     }
 }
 /**

package/dist/inference/types.d.ts

@@ -86,12 +86,16 @@ export interface ModelInfo {
  * At startup, model-manager checks HF for the latest version and downloads
  * it automatically (like antivirus signature updates).
  *
- * Version format: SemVer (MAJOR.MINOR.PATCH)
+ * The fallback is the last version actually published: v5, from the RLAIF
+ * pipeline's integer versions. SemVer versions (MAJOR.MINOR.PATCH) are
+ * published under their SemVer names.
+ *
+ * Version format: SemVer (MAJOR.MINOR.PATCH), or a legacy integer
  *   - MAJOR: Training data format change, base model change, pipeline architecture
  *   - MINOR: New training repos, updated dataset, hyperparameter improvements
  *   - PATCH: Bug fixes, retraining with same data/format
  */
-export declare const BUNDLED_MODEL_VERSION = "2.0.0";
+export declare const BUNDLED_MODEL_VERSION = "5";
 /** HuggingFace dataset repo where latest_version.json lives */
 export declare const VERSION_CHECK_URL = "https://huggingface.co/datasets/rigour-labs/rigour-rlaif-data/resolve/main/latest_version.json";
 /** Build model info for a given tier and version */

package/dist/inference/types.js

@@ -5,19 +5,23 @@
  * At startup, model-manager checks HF for the latest version and downloads
  * it automatically (like antivirus signature updates).
  *
- * Version format: SemVer (MAJOR.MINOR.PATCH)
+ * The fallback is the last version actually published: v5, from the RLAIF
+ * pipeline's integer versions. SemVer versions (MAJOR.MINOR.PATCH) are
+ * published under their SemVer names.
+ *
+ * Version format: SemVer (MAJOR.MINOR.PATCH), or a legacy integer
  *   - MAJOR: Training data format change, base model change, pipeline architecture
  *   - MINOR: New training repos, updated dataset, hyperparameter improvements
  *   - PATCH: Bug fixes, retraining with same data/format
  */
-export const BUNDLED_MODEL_VERSION = '2.0.0';
+export const BUNDLED_MODEL_VERSION = '5';
 /** HuggingFace dataset repo where latest_version.json lives */
 export const VERSION_CHECK_URL = 'https://huggingface.co/datasets/rigour-labs/rigour-rlaif-data/resolve/main/latest_version.json';
 /** Build model info for a given tier and version */
 export function buildModelInfo(tier, version) {
     const meta = {
         deep: { base: 'Qwen2.5-Coder-1.5B', size: 900_000_000, sizeH: '900MB' },
-        lite: { base: 'Qwen2.5-Coder-0.5B', size: 500_000_000, sizeH: '500MB' },
+        lite: { base: 'Qwen2.5-Coder-0.5B', size: 400_000_000, sizeH: '400MB' },
         legacy: { base: 'Qwen2.5-Coder-0.5B', size: 350_000_000, sizeH: '350MB' },
     };
     const m = meta[tier];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.3.0",
+  "version": "6.3.1",
   "description": "AI-native quality gate engine with local Bayesian learning. AST analysis, drift detection, Fix Packet generation, and agent self-healing across TypeScript, JavaScript, Python, Go, Ruby, and C#.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -67,11 +67,11 @@
     "pg": "^8.16.3",
     "sqlite3": "^5.1.7",
     "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-arm64": "6.3.0",
-    "@rigour-labs/brain-darwin-x64": "6.3.0",
-    "@rigour-labs/brain-linux-arm64": "6.3.0",
-    "@rigour-labs/brain-win-x64": "6.3.0",
-    "@rigour-labs/brain-linux-x64": "6.3.0"
+    "@rigour-labs/brain-darwin-x64": "6.3.1",
+    "@rigour-labs/brain-darwin-arm64": "6.3.1",
+    "@rigour-labs/brain-linux-x64": "6.3.1",
+    "@rigour-labs/brain-linux-arm64": "6.3.1",
+    "@rigour-labs/brain-win-x64": "6.3.1"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",