inductive-mlxrl 0.2.3__tar.gz → 0.2.4__tar.gz

inductive_mlxrl-0.2.4/.github/scripts/audit_dependencies.py

@@ -0,0 +1,52 @@
+"""Audit every registry version in uv.lock, including other-platform dependencies."""
+
+from __future__ import annotations
+
+import subprocess
+import tempfile
+import tomllib
+from pathlib import Path
+
+
+def main() -> None:
+    lock = tomllib.loads(Path("uv.lock").read_text())
+    groups: list[dict[str, str]] = []
+    for package in lock["package"]:
+        if package["source"] == {"editable": "."}:
+            continue
+        if package["source"].get("registry") != "https://pypi.org/simple":
+            raise ValueError(f"Unrecognized dependency source for {package['name']}.")
+        hashes = {wheel["hash"] for wheel in package.get("wheels", [])}
+        if "sdist" in package:
+            hashes.add(package["sdist"]["hash"])
+        if not hashes:
+            raise ValueError(f"Missing locked hashes for {package['name']}.")
+        requirement = f"{package['name']}=={package['version']} " + " ".join(
+            f"--hash={digest}" for digest in sorted(hashes)
+        )
+        # pip-audit rejects duplicate names even when versions target other Pythons.
+        for group in groups:
+            if package["name"] not in group:
+                group[package["name"]] = requirement
+                break
+        else:
+            groups.append({package["name"]: requirement})
+    with tempfile.TemporaryDirectory(prefix="mlxrl-dependency-audit-") as directory:
+        for index, group in enumerate(groups):
+            requirements = Path(directory) / f"requirements-{index}.txt"
+            requirements.write_text("\n".join(group.values()) + "\n")
+            subprocess.run(
+                [
+                    "pip-audit",
+                    "--strict",
+                    "--disable-pip",
+                    "--require-hashes",
+                    "-r",
+                    str(requirements),
+                ],
+                check=True,
+            )
+
+
+if __name__ == "__main__":
+    main()

inductive_mlxrl-0.2.4/.github/scripts/verify_release.py

@@ -0,0 +1,78 @@
+"""Require versioned tags to identify a main commit with successful push CI."""
+
+from __future__ import annotations
+
+import ast
+import json
+import os
+import re
+import subprocess
+import tomllib
+import urllib.parse
+import urllib.request
+from pathlib import Path
+
+
+def verify_release(ref: str, sha: str, version: str, repository: str, token: str) -> None:
+    if not ref.startswith("refs/tags/"):
+        return
+    if not re.fullmatch(r"refs/tags/v[0-9]+\.[0-9]+\.[0-9]+", ref):
+        raise ValueError("Release tags must use vX.Y.Z.")
+    if ref != f"refs/tags/v{version}":
+        raise ValueError("Release tag must match the package version.")
+    if not re.fullmatch(r"[0-9a-f]{40}", sha):
+        raise ValueError("Release commit must be a full SHA.")
+    tagged = subprocess.check_output(["git", "rev-parse", f"{ref}^{{commit}}"], text=True).strip()
+    if tagged != sha:
+        raise ValueError("Release tag and workflow commit differ.")
+    if subprocess.run(["git", "merge-base", "--is-ancestor", sha, "origin/main"]).returncode:
+        raise ValueError("Release commit must already be on origin/main.")
+    query = urllib.parse.urlencode(
+        {"head_sha": sha, "branch": "main", "event": "push", "status": "success"}
+    )
+    request = urllib.request.Request(
+        f"https://api.github.com/repos/{repository}/actions/workflows/ci.yml/runs?{query}",
+        headers={
+            "Authorization": f"Bearer {token}",
+            "Accept": "application/vnd.github+json",
+            "X-GitHub-Api-Version": "2022-11-28",
+        },
+    )
+    with urllib.request.urlopen(request, timeout=30) as response:
+        runs = json.load(response)["workflow_runs"]
+    if not any(
+        run["head_sha"] == sha
+        and run["head_branch"] == "main"
+        and run["event"] == "push"
+        and run["status"] == "completed"
+        and run["conclusion"] == "success"
+        and run["path"] == ".github/workflows/ci.yml"
+        for run in runs
+    ):
+        raise ValueError("Release commit needs successful push CI on main.")
+
+
+def main() -> None:
+    version = tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"]
+    module = ast.parse(Path("mlxrl/__init__.py").read_text())
+    package_version = next(
+        ast.literal_eval(node.value)
+        for node in module.body
+        if isinstance(node, ast.Assign)
+        and any(
+            isinstance(target, ast.Name) and target.id == "__version__" for target in node.targets
+        )
+    )
+    if package_version != version:
+        raise ValueError("Package and distribution versions must match.")
+    verify_release(
+        os.environ["GITHUB_REF"],
+        os.environ["GITHUB_SHA"],
+        version,
+        os.environ["GITHUB_REPOSITORY"],
+        os.environ.get("GH_TOKEN", ""),
+    )
+
+
+if __name__ == "__main__":
+    main()

{inductive_mlxrl-0.2.3 → inductive_mlxrl-0.2.4}/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to this project are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project uses semantic versioning once releases are cut.
 
+## [0.2.4] - 2026-10-22
+
+### Security
+
+- Require MLX-LM 0.32.0 or later with its MLX 0.32.2 minimum, and disable custom
+  model and tokenizer Python execution in library, example, and benchmark loaders. The older minimum
+  allowed the unsafe `model_file` behavior addressed by upstream's
+  [CVE-2026-5843 fix](https://github.com/ml-explore/mlx-lm/pull/1385).
+- Parse answer and action tags in linear time to prevent malformed model
+  output from stalling reward evaluation and multi-turn rollouts.
+- Reject CLI output paths whose symlinks resolve outside the working directory.
+- Pin release actions to verified commits, freeze build and validation tools,
+  audit all locked dependencies in CI, and require release tags to match a
+  package version on main with successful push CI.
+- Add security reporting guidance, ownership of release controls, and weekly
+  dependency and action updates.
+
 ## [0.2.3] - 2026-10-21
 
 ### Changed

{inductive_mlxrl-0.2.3 → inductive_mlxrl-0.2.4}/CONTRIBUTING.md

@@ -77,6 +77,10 @@ with `datasets>=5.0.1,<6` to avoid CVE-2026-66007. This only affects the externa
 benchmark tools; the published package depends on MLX and MLX-LM. Remove the
 override when mlx-tune accepts a patched datasets release.
 
+Certifi and Pillow use a one-day package-age cutoff so their October 2026
+security patches can be installed promptly. Other dependencies retain the
+configured default cutoff.
+
 ## Release Cycle
 
 Releases are tag-driven and publish to PyPI through Trusted Publishing. Do not
@@ -90,21 +94,34 @@ One-time PyPI setup:
 - set environment name to `pypi`;
 - require manual approval on the GitHub `pypi` environment before publishing.
 
+Restrict the environment to tags matching `v*`, disable administrator bypass
+for environment approval, and protect release-tag creation, updates, and
+deletion so only repository administrators can perform them. Require the
+`Linux CPU-safe checks` status on main and retain pull-request review.
+
+The publisher runs the official PyPA container by digest. When updating it,
+resolve the upstream release's commit-tagged image from
+`ghcr.io/pypa/gh-action-pypi-publish`, verify its content digest and source
+metadata, and update the digest and source-commit comment together. Other
+actions use commit pins maintained by Dependabot.
+
 For each release:
 
-1. Update the version in `pyproject.toml`.
+1. Update the version in `pyproject.toml` and `mlxrl/__init__.py`, then run `uv lock`.
 2. Add the release notes to `CHANGELOG.md`.
 3. Run the local gates:
 
 ```bash
-UV_CACHE_DIR=.uv-cache uv run pytest
-UV_CACHE_DIR=.uv-cache uv run ruff check .
-UV_CACHE_DIR=.uv-cache uv run pyright
-UV_CACHE_DIR=.uv-cache uv build
-UV_CACHE_DIR=.uv-cache uv run --no-project --python 3.11 --with twine twine check dist/*
+UV_CACHE_DIR=.uv-cache uv sync --frozen --all-groups
+UV_CACHE_DIR=.uv-cache uv run --no-sync pytest
+UV_CACHE_DIR=.uv-cache uv run --no-sync ruff check .
+UV_CACHE_DIR=.uv-cache uv run --no-sync pyright
+UV_CACHE_DIR=.uv-cache uv run --no-sync python .github/scripts/audit_dependencies.py
+UV_CACHE_DIR=.uv-cache uv build --no-build-isolation --python .venv/bin/python
+UV_CACHE_DIR=.uv-cache uv run --no-sync twine check dist/*
 ```
 
-4. Commit and merge the release prep.
+4. Commit and merge the release prep, then wait for main's push CI to pass.
 5. Tag the release from `main`:
 
 ```bash
@@ -112,12 +129,13 @@ git tag -a vX.Y.Z -m "Release vX.Y.Z"
 git push origin vX.Y.Z
 ```
 
-The `Release` workflow builds the source distribution and wheel, checks package
-metadata with Twine, stores the artifacts, publishes them to PyPI from the
-`pypi` environment, and creates a GitHub Release with the built distributions
-attached. Running the workflow manually builds and checks artifacts without
-publishing because the publish and GitHub Release jobs only run for `v*.*.*`
-tags.
+The `Release` workflow first checks that the tag matches the package version,
+identifies a commit already on main, and has successful main push CI. It builds
+with frozen validation and build tools, checks metadata with Twine, stores the
+artifacts, and publishes signed distributions from the protected `pypi`
+environment after maintainer approval. The GitHub Release receives the same
+files. Manual runs on branches only build and check artifacts; manual runs on
+version tags must satisfy all publication controls.
 
 The PyPI distribution name is `inductive-mlxrl`; the Python import package and
 CLI command remain `mlxrl`.

{inductive_mlxrl-0.2.3 → inductive_mlxrl-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: inductive-mlxrl
-Version: 0.2.3
+Version: 0.2.4
 Summary: Small single-process RL post-training for LLMs on Apple Silicon with MLX.
 Project-URL: Homepage, https://github.com/inductiveML/mlxrl
 Project-URL: Repository, https://github.com/inductiveML/mlxrl
@@ -19,8 +19,8 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
 Requires-Python: >=3.11
-Requires-Dist: mlx-lm>=0.31.3; python_version < '3.15' and platform_system == 'Darwin' and platform_machine == 'arm64'
-Requires-Dist: mlx>=0.31.2; python_version < '3.15' and platform_system == 'Darwin' and platform_machine == 'arm64'
+Requires-Dist: mlx-lm>=0.32.0; python_version < '3.15' and platform_system == 'Darwin' and platform_machine == 'arm64'
+Requires-Dist: mlx>=0.32.2; python_version < '3.15' and platform_system == 'Darwin' and platform_machine == 'arm64'
 Description-Content-Type: text/markdown
 
 # mlxrl
@@ -43,6 +43,9 @@ fields may change before a 1.0 release.
 
 ## Quickstart
 
+Requires Apple Silicon, Python 3.11–3.14, MLX 0.32.2+, and MLX-LM 0.32.0+.
+See [SECURITY.md](SECURITY.md) for model trust boundaries and private reporting.
+
 ```bash
 git clone https://github.com/inductiveML/mlxrl.git
 cd mlxrl

{inductive_mlxrl-0.2.3 → inductive_mlxrl-0.2.4}/README.md

@@ -18,6 +18,9 @@ fields may change before a 1.0 release.
 
 ## Quickstart
 
+Requires Apple Silicon, Python 3.11–3.14, MLX 0.32.2+, and MLX-LM 0.32.0+.
+See [SECURITY.md](SECURITY.md) for model trust boundaries and private reporting.
+
 ```bash
 git clone https://github.com/inductiveML/mlxrl.git
 cd mlxrl

inductive_mlxrl-0.2.4/SECURITY.md

@@ -0,0 +1,35 @@
+# Security policy
+
+Security fixes target the latest released version. Use inductive-mlxrl 0.2.4 or
+later and MLX-LM 0.32.0 or later. Earlier supported MLX-LM versions could execute
+Python from a model's `model_file` configuration without an explicit trust flag.
+See the [upstream fix](https://github.com/ml-explore/mlx-lm/pull/1385).
+
+Report vulnerabilities through the repository's
+[private vulnerability reporting form](https://github.com/inductiveML/mlxrl/security/advisories/new).
+Include the affected version, a minimal reproduction, and the expected impact.
+Keep credentials and private training data out of reports and public issues.
+
+## Trust boundaries
+
+Model completions and action text are untrusted data. Built-in tag parsers scan
+fixed delimiters without regex backtracking. Model loading explicitly disables
+custom remote Python code.
+
+Training configurations, custom Python reward functions, environment callbacks,
+benchmark command adapters, model repositories, and adapter files must come from
+sources you trust. The library runs in the caller's process and does not provide
+a sandbox for these extensions or for native tensor parsers. CLI output paths
+must resolve inside the working directory; this check does not isolate a
+process from another user who can concurrently change its files or symlinks.
+
+## Release controls
+
+Release tags must match the package version, identify a commit already on main,
+and have successful main push CI. CI audits every locked dependency version,
+including packages for other platforms and Python versions. Release actions
+use verified commit pins and build tools come from the frozen lockfile.
+
+GitHub's `pypi` environment restricts publication to protected release tags and
+requires a maintainer's approval. PyPI publication uses OIDC Trusted Publishing
+and signed attestations. Local Metal tests remain a release requirement.

{inductive_mlxrl-0.2.3 → inductive_mlxrl-0.2.4}/benchmarks/external_baseline_worker.py

@@ -317,7 +317,9 @@ def run_mlx_lm_lora(args: argparse.Namespace) -> BenchResult:
         prompt_token_lengths = [
             encoded_prompt_token_count(tokenizer, row["prompt"]) for row in rows
         ]
-        ref_loaded = load(args.model)
+        ref_loaded = load(
+            args.model, tokenizer_config={"trust_remote_code": False}, trust_remote_code=False
+        )
         ref_model = ref_loaded[0]
         ref_model.freeze()
         optimizer = optim.Adam(learning_rate=args.learning_rate)
@@ -453,6 +455,7 @@ def run_mlx_tune(args: argparse.Namespace) -> BenchResult:
         model_name=args.model,
         max_seq_length=args.max_context,
         load_in_4bit=True,
+        trust_remote_code=False,
     )
     prompt_token_lengths = [
         encoded_prompt_token_count(tokenizer, row["prompt"]) for row in rows

{inductive_mlxrl-0.2.3 → inductive_mlxrl-0.2.4}/benchmarks/run_phase4.py

@@ -536,7 +536,9 @@ def run_mlx_lm_worker(args: argparse.Namespace) -> BenchResult:
 
     set_mlx_wired_limit(mx, args.wired_limit_mb)
     mx.random.seed(args.seed)
-    loaded = mlx_lm.load(args.model)
+    loaded = mlx_lm.load(
+        args.model, tokenizer_config={"trust_remote_code": False}, trust_remote_code=False
+    )
     model = loaded[0]
     tokenizer = loaded[1]
     sampler = make_sampler(

{inductive_mlxrl-0.2.3 → inductive_mlxrl-0.2.4}/examples/personal_taste_grpo/compare.py

@@ -107,7 +107,9 @@ def main() -> None:
         top_k=int(sampling_config["top_k"]),
     )
     prompt = naming_prompt(args.prompt)
-    base_model, base_tokenizer = load(str(run["model_id"]))
+    base_model, base_tokenizer = load(
+        str(run["model_id"]), tokenizer_config={"trust_remote_code": False}, trust_remote_code=False
+    )
     if hasattr(base_model, "eval"):
         base_model.eval()
     base = sample_name(

{inductive_mlxrl-0.2.3 → inductive_mlxrl-0.2.4}/mlxrl/__init__.py

@@ -2,4 +2,4 @@
 
 __all__ = ["__version__"]
 
-__version__ = "0.2.3"
+__version__ = "0.2.4"

{inductive_mlxrl-0.2.3 → inductive_mlxrl-0.2.4}/mlxrl/config.py

@@ -247,6 +247,12 @@ def validate_output_path(value: str, field_name: str = "output") -> Path:
     output_path = Path(value.strip())
     if output_path.is_absolute() or ".." in output_path.parts:
         raise ConfigError(f"{field_name} must be a relative path inside the working directory.")
+    try:
+        contained = output_path.resolve().is_relative_to(Path.cwd().resolve())
+    except (OSError, RuntimeError) as error:
+        raise ConfigError(f"{field_name} could not be resolved safely.") from error
+    if not contained:
+        raise ConfigError(f"{field_name} must be a relative path inside the working directory.")
     return output_path
 
 

{inductive_mlxrl-0.2.3 → inductive_mlxrl-0.2.4}/mlxrl/data/rewards.py

@@ -9,7 +9,8 @@ from typing import TypeAlias
 RewardFn: TypeAlias = Callable[..., float]
 
 _REWARD_REGISTRY: dict[str, RewardFn] = {}
-_ANSWER_TAG_RE = re.compile(r"<answer>\s*(.*?)\s*</answer>", re.IGNORECASE | re.DOTALL)
+_ANSWER_OPEN_RE = re.compile(r"<answer>", re.IGNORECASE)
+_ANSWER_CLOSE_RE = re.compile(r"</answer>", re.IGNORECASE)
 _NUMBER_RE = re.compile(r"[-+]?(?:\d[\d,]*)(?:\.\d+)?")
 
 
@@ -49,9 +50,8 @@ def extract_answer(text: str | None) -> str | None:
 
     if text is None:
         return None
-    tagged = _ANSWER_TAG_RE.search(text)
-    if tagged:
-        answer = tagged.group(1).strip()
+    answer = _answer_tag_content(text)
+    if answer is not None:
         return answer or None
     if "####" in text:
         answer = text.rsplit("####", maxsplit=1)[-1].strip()
@@ -94,8 +94,15 @@ def extract_answer_from_tag(text: str | None) -> str | None:
 
     if text is None:
         return None
-    tagged = _ANSWER_TAG_RE.search(text)
-    if not tagged:
+    return _answer_tag_content(text) or None
+
+
+def _answer_tag_content(text: str) -> str | None:
+    # Fixed delimiters avoid backtracking or repeated body rescans on malformed output.
+    opening = _ANSWER_OPEN_RE.search(text)
+    if opening is None:
+        return None
+    closing = _ANSWER_CLOSE_RE.search(text, opening.end())
+    if closing is None:
         return None
-    answer = tagged.group(1).strip()
-    return answer or None
+    return text[opening.end() : closing.start()].strip()

{inductive_mlxrl-0.2.3 → inductive_mlxrl-0.2.4}/mlxrl/env/reference.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import re
 from collections.abc import Callable, Hashable, Mapping
 from dataclasses import dataclass, field
 from typing import Any
@@ -13,9 +12,12 @@ from mlxrl.env.base import StepResult
 def default_action_parser(text: str) -> str:
     """Extract <action>...</action> when present, otherwise return stripped text."""
 
-    match = re.search(r"<action>\s*(.*?)\s*</action>", text, flags=re.DOTALL)
-    if match is not None:
-        return match.group(1).strip()
+    opening = text.find("<action>")
+    if opening != -1:
+        start = opening + len("<action>")
+        closing = text.find("</action>", start)
+        if closing != -1:
+            return text[start:closing].strip()
     return text.strip()
 
 

{inductive_mlxrl-0.2.3 → inductive_mlxrl-0.2.4}/mlxrl/policy/model.py

@@ -288,7 +288,9 @@ def load_policy_with_lora(
     """Load a 4-bit MLX-LM policy and attach trainable LoRA adapters."""
 
     lora_config = config or LoRAConfig()
-    loaded = load(model_id)
+    loaded = load(
+        model_id, tokenizer_config={"trust_remote_code": False}, trust_remote_code=False
+    )
     model = loaded[0]
     tokenizer = loaded[1]
     target_keys = inject_lora_adapters(model, lora_config)

{inductive_mlxrl-0.2.3 → inductive_mlxrl-0.2.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "inductive-mlxrl"
-version = "0.2.3"
+version = "0.2.4"
 description = "Small single-process RL post-training for LLMs on Apple Silicon with MLX."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -18,8 +18,8 @@ classifiers = [
     "Topic :: Scientific/Engineering :: Artificial Intelligence",
 ]
 dependencies = [
-    "mlx>=0.31.2; python_version < '3.15' and platform_system == 'Darwin' and platform_machine == 'arm64'",
-    "mlx-lm>=0.31.3; python_version < '3.15' and platform_system == 'Darwin' and platform_machine == 'arm64'",
+    "mlx>=0.32.2; python_version < '3.15' and platform_system == 'Darwin' and platform_machine == 'arm64'",
+    "mlx-lm>=0.32.0; python_version < '3.15' and platform_system == 'Darwin' and platform_machine == 'arm64'",
 ]
 
 [project.urls]
@@ -39,17 +39,28 @@ dev = [
     "pytest>=8.3.0",
     "ruff>=0.8.0",
 ]
+ci = [
+    "hatchling==1.32.4",
+    "pip-audit==2.10.1",
+    "pyright>=1.1.390",
+    "pytest>=8.3.0",
+    "ruff>=0.8.0",
+    "twine==7.0.0",
+]
 
 [build-system]
-requires = ["hatchling"]
+requires = ["hatchling==1.32.4"]
 build-backend = "hatchling.build"
 
 [tool.uv]
 # mlx-tune 0.6 still pins datasets<4; use the patched series for CVE-2026-66007.
 override-dependencies = ["datasets>=5.0.1,<6"]
+# Newly patched security advisories require shorter cooldowns for these packages.
+exclude-newer-package = { certifi = "1 day", pillow = "1 day" }
 
 [tool.hatch.build.targets.sdist]
 include = [
+    ".github/scripts",
     "benchmarks",
     "examples",
     "mlxrl",
@@ -59,8 +70,10 @@ include = [
     "DESIGN.md",
     "LICENSE",
     "README.md",
+    "SECURITY.md",
     "THIRD_PARTY_LICENSES.md",
     "pyproject.toml",
+    "uv.lock",
 ]
 
 [tool.hatch.build.targets.wheel]
@@ -82,7 +95,7 @@ select = ["E", "F", "I", "UP", "B", "SIM", "RUF"]
 pythonVersion = "3.11"
 typeCheckingMode = "basic"
 reportMissingTypeStubs = "none"
-include = ["mlxrl", "tests", "benchmarks"]
+include = ["mlxrl", "tests", "benchmarks", ".github/scripts"]
 
 [tool.pytest.ini_options]
 markers = [

{inductive_mlxrl-0.2.3 → inductive_mlxrl-0.2.4}/tests/test_policy_model.py

@@ -1,10 +1,13 @@
 from __future__ import annotations
 
+import json
 from typing import Any, cast
 
 import mlx.core as mx
 import mlx.nn as nn
 import pytest
+from mlx.utils import tree_flatten
+from mlx_lm.models.llama import Model, ModelArgs
 from mlx_lm.tuner.lora import LoRALinear
 
 from mlxrl.policy.model import (
@@ -15,6 +18,7 @@ from mlxrl.policy.model import (
     count_parameters,
     enable_grad_checkpointing,
     inject_lora_adapters,
+    load_policy_with_lora,
     lora_module_counts_by_layer,
     strict_lora_config,
 )
@@ -22,6 +26,60 @@ from mlxrl.policy.model import (
 pytestmark = pytest.mark.metal
 
 
+def test_model_loading_rejects_custom_code_without_executing_it(tmp_path) -> None:
+    marker = tmp_path / "executed.txt"
+    (tmp_path / "config.json").write_text(json.dumps({"model_file": "custom.py"}))
+    (tmp_path / "custom.py").write_text(
+        "from pathlib import Path\n"
+        "Path(__file__).with_name('executed.txt').write_text('executed')\n"
+        "raise RuntimeError('custom model code ran')\n"
+    )
+    mx.save_safetensors(tmp_path / "model.safetensors", {"dummy": mx.array([0.0])})
+
+    with pytest.raises(ValueError, match="trust_remote_code"):
+        load_policy_with_lora(str(tmp_path))
+
+    assert not marker.exists()
+
+
+def test_tokenizer_loading_rejects_custom_code_without_prompting(tmp_path, monkeypatch) -> None:
+    config = {
+        "model_type": "llama",
+        "hidden_size": 8,
+        "num_hidden_layers": 1,
+        "intermediate_size": 16,
+        "num_attention_heads": 2,
+        "rms_norm_eps": 1e-5,
+        "vocab_size": 16,
+    }
+    model = Model(ModelArgs.from_dict(config))
+    mx.save_safetensors(tmp_path / "model.safetensors", dict(tree_flatten(model.parameters())))
+    (tmp_path / "config.json").write_text(json.dumps(config))
+    (tmp_path / "tokenizer_config.json").write_text(
+        json.dumps(
+            {
+                "tokenizer_class": "CustomTokenizer",
+                "auto_map": {"AutoTokenizer": ["tokenization_custom.CustomTokenizer", None]},
+            }
+        )
+    )
+    marker = tmp_path / "tokenizer-executed.txt"
+    (tmp_path / "tokenization_custom.py").write_text(
+        "from pathlib import Path\n"
+        "Path(__file__).with_name('tokenizer-executed.txt').write_text('executed')\n"
+        "raise RuntimeError('custom tokenizer code ran')\n"
+    )
+
+    def reject_prompt(*args, **kwargs):
+        pytest.fail("Loading a model must not prompt to execute tokenizer code.")
+
+    monkeypatch.setattr("builtins.input", reject_prompt)
+    with pytest.raises(ValueError, match="trust_remote_code"):
+        load_policy_with_lora(str(tmp_path))
+
+    assert not marker.exists()
+
+
 class ToyDenseAttention(nn.Module):
     def __init__(self) -> None:
         super().__init__()