nvdc 0.2.0__tar.gz → 0.2.2__tar.gz

{nvdc-0.2.0 → nvdc-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nvdc
-Version: 0.2.0
+Version: 0.2.2
 Summary: Bring your GPU onto the network: one command turns a GPU into a verifiable, OpenAI-compatible inference node.
 Author: NVDC
 License: Apache-2.0
@@ -150,6 +150,16 @@ Attestation is a first-class, pluggable component (`nvdc/attestation.py`):
 A coordinator can enforce policy with `--require-attested` to only route work to
 nodes whose attestation verifies.
 
+**Model identity** is attested separately from hardware. Every node publishes a
+content-addressed commitment of the artifact it serves (the Ollama manifest
+digest) and signs it into each work receipt (`nvdc-work-v2`). The coordinator
+independently checks the claim against `registry.ollama.ai` and surfaces a
+verdict (`verified` / `mismatch` / `unknown`) per node and per receipt;
+`--require-verified-models` restricts routing to verified artifacts. Without a
+TEE this cannot *prove* which bytes ran — what it guarantees is that a node
+claiming one model while serving another has signed a non-repudiable false
+statement that contradicts public ground truth.
+
 > Note: the DGX Spark / GB10 cannot produce hardware attestation (NVIDIA disabled
 > CC on this SKU). It serves inference fine; it just joins as an unattested node.
 

{nvdc-0.2.0 → nvdc-0.2.2}/README.md

@@ -128,6 +128,16 @@ Attestation is a first-class, pluggable component (`nvdc/attestation.py`):
 A coordinator can enforce policy with `--require-attested` to only route work to
 nodes whose attestation verifies.
 
+**Model identity** is attested separately from hardware. Every node publishes a
+content-addressed commitment of the artifact it serves (the Ollama manifest
+digest) and signs it into each work receipt (`nvdc-work-v2`). The coordinator
+independently checks the claim against `registry.ollama.ai` and surfaces a
+verdict (`verified` / `mismatch` / `unknown`) per node and per receipt;
+`--require-verified-models` restricts routing to verified artifacts. Without a
+TEE this cannot *prove* which bytes ran — what it guarantees is that a node
+claiming one model while serving another has signed a non-repudiable false
+statement that contradicts public ground truth.
+
 > Note: the DGX Spark / GB10 cannot produce hardware attestation (NVIDIA disabled
 > CC on this SKU). It serves inference fine; it just joins as an unattested node.
 

{nvdc-0.2.0 → nvdc-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "nvdc"
-version = "0.2.0"
+version = "0.2.2"
 description = "Bring your GPU onto the network: one command turns a GPU into a verifiable, OpenAI-compatible inference node."
 readme = "README.md"
 requires-python = ">=3.9"

{nvdc-0.2.0 → nvdc-0.2.2}/src/nvdc/__init__.py

@@ -1,3 +1,3 @@
 """nvdc: bring your GPU onto the network as a verifiable, OpenAI-compatible inference node."""
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"

{nvdc-0.2.0 → nvdc-0.2.2}/src/nvdc/agent.py

@@ -21,6 +21,7 @@ from .gpu import detect_gpu, detect_gpus, detect_interconnect
 from .hardware import detect_hardware, machine_id as hw_machine_id
 from .inference import Backend, make_backend
 from .keys import Identity
+from .models import local_ollama_commit
 
 log = logging.getLogger("nvdc.agent")
 
@@ -68,6 +69,7 @@ class NodeAgent:
         machine_id: str = "",
         cluster: str = "",
         private: bool = False,
+        auto_update: bool = False,
     ):
         # A node commits to exactly ONE hot-loaded model at a time — the
         # "mining algorithm" it has chosen. It advertises and serves only this
@@ -85,6 +87,8 @@ class NodeAgent:
         self.machine_id = machine_id or hw_machine_id()
         self.cluster = cluster
         self.private = private
+        self.auto_update = auto_update
+        self.model_commit = ""  # set at registration from the backend's store
         self.token = token
         self.require_attestation = require_attestation
         self.status_cb = status_cb
@@ -120,6 +124,16 @@ class NodeAgent:
                 if code == protocol.CLOSE_UPGRADE_REQUIRED:
                     reason = getattr(e.rcvd, "reason", "") \
                         or "coordinator requires a newer agent; run: pipx upgrade nvdc"
+                    if self.auto_update:
+                        # Self-heal: install the new release from PyPI and
+                        # restart this process; on success exec never returns.
+                        log.warning("upgrade required — auto-updating: %s", reason)
+                        self._emit("upgrade_required", detail=reason + " (auto-updating)")
+                        from .update import restart_process, self_update
+                        ok, detail = await asyncio.to_thread(self_update)
+                        if ok:
+                            restart_process()
+                        log.error("auto-update failed: %s", detail[-300:])
                     log.error("not joining network — %s", reason)
                     self._emit("upgrade_required", detail=reason)
                     self._stopped = True
@@ -199,6 +213,17 @@ class NodeAgent:
             raise RuntimeError(
                 f"attestation required but not verified: {att.reason or att.mode}"
             )
+        # Model identity commitment: the content digest of the artifact this
+        # node will serve. Signed into every work receipt (nvdc-work-v2) and
+        # checked by the coordinator against the public registry.
+        if getattr(self.backend, "name", "") == "ollama":
+            self.model_commit = await local_ollama_commit(
+                self.model, getattr(self.backend, "base_url", "http://localhost:11434"))
+            if self.model_commit:
+                log.info("model commitment: %s -> %s", self.model, self.model_commit[:23] + "…")
+            else:
+                log.warning("could not derive a model commitment for '%s'; "
+                            "receipts will not carry a model identity", self.model)
         profile = protocol.NodeProfile(
             name=self.name,
             models=[self.model],
@@ -217,6 +242,7 @@ class NodeAgent:
             machine_id=self.machine_id,
             cluster=self.cluster,
             private=self.private,
+            model_commit=self.model_commit,
             agent_version=__version__,
         )
         await self._send(protocol.MSG_REGISTER, profile=protocol.node_profile_to_dict(profile))
@@ -312,7 +338,8 @@ class NodeAgent:
 
     def _sign_work(self, req_id, prompt_commit, tokens, response_commit, delivery) -> str:
         payload = keys.work_payload(req_id, self.model, prompt_commit, tokens,
-                                    response_commit, delivery)
+                                    response_commit, delivery,
+                                    model_commit=self.model_commit)
         return self.identity.sign(payload)
 
     async def _send(self, msg_type: str, **fields: Any):
@@ -336,6 +363,7 @@ async def serve(
     owner_account: str = "",
     cluster: str = "",
     private: bool = False,
+    auto_update: bool = False,
 ):
     if not model:
         raise ValueError("a single --model must be specified; a node serves exactly one model")
@@ -362,5 +390,6 @@ async def serve(
         owner_account=owner_account,
         cluster=cluster,
         private=private,
+        auto_update=auto_update,
     )
     await agent.run_forever()

{nvdc-0.2.0 → nvdc-0.2.2}/src/nvdc/app.py

@@ -7,6 +7,7 @@ load one into memory (hot), and only then enables "Go Live" on the network.
 
 from __future__ import annotations
 
+import asyncio
 import hashlib
 import json as _json
 import logging
@@ -85,6 +86,28 @@ def create_app(runtime: NodeRuntime) -> FastAPI:
         ok, msg = runtime.go_offline()
         return {"ok": ok, "message": msg}
 
+    def _same_origin(request: Request) -> bool:
+        """The update endpoint is for the local UI only. CORS here is wide
+        open (so nvdc.ai can read state), which means without this check any
+        website could trigger an update/restart of this client. Browsers send
+        an Origin header on POSTs; require it to match this server."""
+        origin = request.headers.get("origin", "")
+        if not origin:
+            return True  # curl / local scripts
+        return origin.split("://", 1)[-1] == request.headers.get("host", "")
+
+    @app.post("/api/update")
+    async def update(request: Request):
+        """One-click self-update: drain, install from PyPI, restart in place."""
+        if not _same_origin(request):
+            return JSONResponse({"ok": False, "error": "forbidden"}, status_code=403)
+        ok, msg = await runtime.apply_update()
+        return {"ok": ok, "message": msg}
+
+    @app.on_event("startup")
+    async def _start_auto_update_loop():
+        asyncio.create_task(runtime.auto_update_loop())
+
     # ---- consumer proxies to the coordinator --------------------------------
     # Keep the UI same-origin (no CORS) by proxying the coordinator's public API
     # through this local app. These power the Home / Chat / Network tabs.

{nvdc-0.2.0 → nvdc-0.2.2}/src/nvdc/cli.py

@@ -67,6 +67,7 @@ def cmd_serve(args: argparse.Namespace) -> int:
             owner_account=args.owner or os.environ.get("NVDC_OWNER", ""),
             cluster=args.cluster,
             private=args.private,
+            auto_update=args.auto_update or bool(os.environ.get("NVDC_AUTO_UPDATE")),
         )
     )
     except KeyboardInterrupt:
@@ -91,6 +92,7 @@ def cmd_coordinator(args: argparse.Namespace) -> int:
         require_payment=not args.no_payment,
         min_agent_version=args.min_agent_version
         or os.environ.get("NVDC_MIN_AGENT_VERSION", ""),
+        require_verified_models=args.require_verified_models or None,
     )
     print(f"nvdc coordinator on http://{args.host}:{args.port}")
     print(f"  OpenAI endpoint : http://{args.host}:{args.port}/v1/chat/completions")
@@ -116,6 +118,7 @@ def cmd_app(args: argparse.Namespace) -> int:
         drain_timeout=args.drain_timeout,
         owner_account=args.owner or os.environ.get("NVDC_OWNER", ""),
         cluster=args.cluster,
+        auto_update=args.auto_update or bool(os.environ.get("NVDC_AUTO_UPDATE")),
     )
     app = create_app(runtime)
     url = f"http://{args.host}:{args.port}"
@@ -178,6 +181,10 @@ def build_parser() -> argparse.ArgumentParser:
     s.add_argument("--drain-timeout", type=float, default=120.0,
                    help="max seconds to wait for in-flight requests when leaving "
                         "before force-failing stuck ones (default: 120)")
+    s.add_argument("--auto-update", action="store_true",
+                   help="when the coordinator requires a newer agent, install "
+                        "the update from PyPI and restart automatically "
+                        "(or NVDC_AUTO_UPDATE=1)")
     s.set_defaults(func=cmd_serve)
 
     c = sub.add_parser("coordinator", help="run the public network hub")
@@ -193,6 +200,9 @@ def build_parser() -> argparse.ArgumentParser:
     c.add_argument("--min-agent-version", default="",
                    help="refuse agents older than this version at registration "
                         "(or NVDC_MIN_AGENT_VERSION); empty = no gate")
+    c.add_argument("--require-verified-models", action="store_true",
+                   help="only route to nodes whose claimed model digest matches "
+                        "the public registry (or NVDC_REQUIRE_VERIFIED_MODELS)")
     c.set_defaults(func=cmd_coordinator)
 
     a = sub.add_parser("app", help="launch the visual node client (web UI)")
@@ -213,6 +223,10 @@ def build_parser() -> argparse.ArgumentParser:
                    help="max seconds to wait for in-flight requests when leaving "
                         "before force-failing stuck ones (default: 120)")
     a.add_argument("--no-browser", action="store_true", help="don't auto-open the browser")
+    a.add_argument("--auto-update", action="store_true",
+                   help="install new releases from PyPI and restart automatically "
+                        "when the network announces one (or NVDC_AUTO_UPDATE=1); "
+                        "default is a one-click prompt in the UI")
     a.set_defaults(func=cmd_app)
 
     st = sub.add_parser("status", help="show local GPU + attestation status")

{nvdc-0.2.0 → nvdc-0.2.2}/src/nvdc/coordinator.py

@@ -30,6 +30,7 @@ from fastapi.responses import JSONResponse, StreamingResponse
 from starlette.concurrency import run_in_threadpool
 
 from . import __version__, accounts, keys, payments, protocol
+from . import models as model_identity
 from .keys import Identity
 from .protocol import version_tuple
 from .storage import Account, Storage, make_storage, to_micro, to_usd
@@ -140,10 +141,14 @@ def _verify_node(r: Dict[str, Any]) -> bool:
     sig = r.get("node_sig", "")
     if not sig:
         return False
-    payload = keys.work_payload(
-        r.get("req_id", ""), r.get("model", ""), r.get("prompt_commit", ""),
-        r.get("tokens", 0), r.get("response_commit", ""), r.get("delivery", ""))
-    return keys.verify(r.get("miner_account", ""), payload, sig)
+    args = (r.get("req_id", ""), r.get("model", ""), r.get("prompt_commit", ""),
+            r.get("tokens", 0), r.get("response_commit", ""), r.get("delivery", ""))
+    account = r.get("node_account", "") or r.get("miner_account", "")
+    # v2 (signature covers the model artifact digest), then legacy v1.
+    if r.get("model_commit"):
+        if keys.verify(account, keys.work_payload(*args, model_commit=r["model_commit"]), sig):
+            return True
+    return keys.verify(account, keys.work_payload(*args), sig)
 
 
 def build_clusters(machines: List[Dict[str, Any]], live_ids: set) -> List[Dict[str, Any]]:
@@ -181,6 +186,11 @@ class Node:
         self.owner_account = profile.get("owner_account", "") or self.account_id
         self.machine_id = profile.get("machine_id", "") or self.id
         self.cluster = profile.get("cluster", "") or ""
+        # Model identity: the node's claimed artifact digest, and the verdict
+        # from checking that claim against the public registry at registration
+        # ("verified" | "mismatch" | "unknown").
+        self.model_commit = str(profile.get("model_commit", "") or "")
+        self.model_verdict = "unknown"
         self.draining = False
         self.pending: Dict[str, PendingRequest] = {}
         self._send_lock = asyncio.Lock()
@@ -255,6 +265,8 @@ class Node:
             "price_per_mtok": round(self.price_per_mtok, 6),
             "price_per_mtok_input": round(self.price_per_mtok_input, 6),
             "private": self.private,
+            "model_commit": self.model_commit,
+            "model_verdict": self.model_verdict,
             "attested": self.attested,
             "attestation_mode": self.attestation.get("mode", "none"),
             "agent_version": self.profile.get("agent_version", ""),
@@ -339,7 +351,8 @@ class Registry:
 
     def pick(self, model: str = "", models: Optional[List[str]] = None,
              require_attested: bool = False, pin: str = "", min_rating: int = 0,
-             max_price: Optional[float] = None, consumer: str = "") -> Optional[Node]:
+             max_price: Optional[float] = None, consumer: str = "",
+             require_verified: bool = False) -> Optional[Node]:
         def model_ok(n: Node) -> bool:
             if model:
                 return model in n.models
@@ -357,6 +370,8 @@ class Registry:
             # Private nodes serve only their owner (personal AI mode).
             and (not n.private or own(n))
             and (not require_attested or n.attested)
+            # Strict networks only route to registry-verified model artifacts.
+            and (not require_verified or n.model_verdict == "verified")
             and n.rating() >= min_rating
             # A max price never excludes your own node — it's free for you.
             and (max_price is None or own(n)
@@ -455,11 +470,18 @@ class Registry:
 
 def create_app(auth_token: str = "", require_attested: bool = False,
                require_payment: bool = True,
-               min_agent_version: Optional[str] = None) -> FastAPI:
+               min_agent_version: Optional[str] = None,
+               require_verified_models: Optional[bool] = None) -> FastAPI:
     # Minimum agent version allowed to JOIN the network (older agents are
     # refused at the door with a clear upgrade message). Empty = no gate.
     if min_agent_version is None:
         min_agent_version = os.environ.get("NVDC_MIN_AGENT_VERSION", "").strip()
+    # Strict model-identity policy: only route to nodes whose claimed model
+    # digest matches the public registry. Default off — verdicts are always
+    # computed and surfaced either way.
+    if require_verified_models is None:
+        require_verified_models = bool(
+            os.environ.get("NVDC_REQUIRE_VERIFIED_MODELS", "").strip())
     app = FastAPI(title="nvdc coordinator")
     # Allow browser clients (e.g. the Vercel static site) to read the network
     # and stream chat. Inference billing identifies accounts by header, not
@@ -489,6 +511,34 @@ def create_app(auth_token: str = "", require_attested: bool = False,
                 node.restore_stats(rec)
                 return
 
+    # Registry ground truth for model digests, cached so registration doesn't
+    # hammer registry.ollama.ai (tags are mutable, hence the TTL refresh).
+    _model_digest_cache: Dict[str, tuple] = {}
+
+    async def expected_model_digest(model: str) -> str:
+        hit = _model_digest_cache.get(model)
+        if hit and time.time() - hit[1] < 6 * 3600:
+            return hit[0]
+        digest = await model_identity.fetch_registry_digest(model)
+        _model_digest_cache[model] = (digest, time.time())
+        return digest
+
+    async def _verify_node_model(node: Node) -> None:
+        """Check the node's claimed artifact digest against the registry."""
+        if not node.model_commit:
+            return  # no claim made -> verdict stays "unknown"
+        try:
+            expected = await expected_model_digest(node.model)
+        except Exception:
+            expected = ""
+        node.model_verdict = model_identity.model_verdict(node.model_commit, expected)
+        if node.model_verdict == "mismatch":
+            log.warning(
+                "model commitment MISMATCH: node '%s' claims %s for '%s' but the "
+                "registry says %s", node.profile.get("name"),
+                node.model_commit[:19] + "…", node.model,
+                (expected[:19] + "…") if expected else "?")
+
     # House node: a coordinator-hosted miner backed by the Cerebras API, so
     # the network always has at least one live node. Created only here from
     # the coordinator's own environment — the public node protocol has no way
@@ -543,6 +593,7 @@ def create_app(auth_token: str = "", require_attested: bool = False,
             node_id = uuid.uuid4().hex[:12]
             node = Node(node_id, ws, first.get("profile", {}))
             _rehydrate_stats(node)  # a reconnect is not a brand-new miner
+            await _verify_node_model(node)  # registry-anchored model identity
             registry.add(node)
             # Persist this machine under its owner so the account can list its
             # clusters/machines even after the node disconnects.
@@ -691,7 +742,8 @@ def create_app(auth_token: str = "", require_attested: bool = False,
         node = registry.pick(model, models=models_filter or None,
                              require_attested=require_attested, pin=pin,
                              min_rating=min_rating, max_price=max_price,
-                             consumer=consumer_id)
+                             consumer=consumer_id,
+                             require_verified=require_verified_models)
         if node is None:
             why = f"no available miner for model '{model or ','.join(models_filter)}'"
             if pin:
@@ -774,6 +826,7 @@ def create_app(auth_token: str = "", require_attested: bool = False,
             "max_price": round(max_price, 8) if max_price is not None else -1,
             "nonce": nonce, "auth_ts": auth_ts, "hold_u": hold_u,
             "price_in": price_in, "self_serve": self_serve,
+            "model_commit": node.model_commit, "model_verdict": node.model_verdict,
             "consumer_sig": consumer_sig, "consumer_sig_valid": consumer_sig_valid,
         }
         base_headers = {
@@ -801,13 +854,26 @@ def create_app(auth_token: str = "", require_attested: bool = False,
         # Refresh the persisted machine record so lifetime stats (TPS, rating
         # inputs, earnings) survive reconnects and coordinator restarts.
         ledger.record_machine(node.owner_account, node.machine_record())
-        # Verify the node's completion signature over what it delivered.
+        # Verify the node's completion signature over what it delivered. A
+        # node that registered a model commitment signs nvdc-work-v2 (the
+        # signature also covers the artifact digest); older agents sign v1.
+        # The v1 fallback keeps legacy receipts verifiable but records that
+        # the model identity was NOT covered by the signature.
         node_sig_valid = False
+        model_commit_signed = False
         if node_sig:
-            work = keys.work_payload(req_id, ctx["model"], ctx["prompt_commit"],
-                                     tokens, response_commit, delivery)
-            # The machine signs with its own key; earnings credit the owner.
-            node_sig_valid = keys.verify(ctx["node_account"], work, node_sig)
+            mc = ctx.get("model_commit", "")
+            if mc:
+                work2 = keys.work_payload(req_id, ctx["model"], ctx["prompt_commit"],
+                                          tokens, response_commit, delivery,
+                                          model_commit=mc)
+                # The machine signs with its own key; earnings credit the owner.
+                node_sig_valid = keys.verify(ctx["node_account"], work2, node_sig)
+                model_commit_signed = node_sig_valid
+            if not node_sig_valid:
+                work = keys.work_payload(req_id, ctx["model"], ctx["prompt_commit"],
+                                         tokens, response_commit, delivery)
+                node_sig_valid = keys.verify(ctx["node_account"], work, node_sig)
         receipt = ledger.settle(ctx["consumer_id"], ctx["miner_account"], cost, {
             "req_id": req_id, "model": ctx["model"], "req_model": ctx["req_model"],
             "miner_node": ctx["node_id"], "node_account": ctx["node_account"], "tokens": tokens,
@@ -815,6 +881,9 @@ def create_app(auth_token: str = "", require_attested: bool = False,
             "price_per_mtok": round(price, 6),
             "price_per_mtok_input": round(ctx["price_in"], 6),
             "self_serve": ctx["self_serve"],
+            "model_commit": ctx.get("model_commit", ""),
+            "model_commit_signed": model_commit_signed,
+            "model_verdict": ctx.get("model_verdict", "unknown"),
             "delivery": delivery,
             "attested": ctx["attested"], "prompt_commit": ctx["prompt_commit"],
             "response_commit": response_commit,

{nvdc-0.2.0 → nvdc-0.2.2}/src/nvdc/keys.py

@@ -44,13 +44,26 @@ def auth_payload(consumer: str, model: str, prompt_commit: str,
 
 
 def work_payload(req_id: str, model: str, prompt_commit: str, tokens: int,
-                 response_commit: str, delivery: str) -> Dict[str, Any]:
-    """What the NODE signs at the end: attestation of work delivered."""
-    return {
+                 response_commit: str, delivery: str,
+                 model_commit: str = "") -> Dict[str, Any]:
+    """What the NODE signs at the end: attestation of work delivered.
+
+    When the node knows the content digest of the artifact it served
+    (``model_commit``), the payload upgrades to v2 and the signature also
+    covers the model's identity — claiming one model while serving another
+    becomes a signed, non-repudiable false statement. With no commitment the
+    payload is byte-identical to v1, so existing nodes and receipts verify
+    unchanged.
+    """
+    payload = {
         "kind": "nvdc-work-v1", "req_id": req_id, "model": model,
         "prompt_commit": prompt_commit, "tokens": int(tokens),
         "response_commit": response_commit, "delivery": delivery,
     }
+    if model_commit:
+        payload["kind"] = "nvdc-work-v2"
+        payload["model_commit"] = model_commit
+    return payload
 
 
 def account_from_pubkey(pub: Ed25519PublicKey) -> str:

nvdc-0.2.2/src/nvdc/models.py

@@ -0,0 +1,100 @@
+"""Model identity: content-addressed commitments for served models.
+
+Hardware attestation says WHERE work ran; this module is about WHAT was run.
+Without a TEE we cannot cryptographically prove which bytes sat in GPU memory,
+so the goal is different and honest: every node publishes a content-addressed
+commitment (digest) of the artifact it serves, signs it into each work receipt
+(``nvdc-work-v2`` in keys.py), and the coordinator independently checks the
+claim against the same public registry nodes pull from. A node can still lie —
+but the lie is now a signed, non-repudiable statement that contradicts public
+ground truth, so it is detectable, attributable and punishable.
+
+Ollama's model store is already content-addressed: every model resolves to an
+OCI-style manifest whose sha256 digest uniquely identifies weights + config.
+``registry.ollama.ai`` serves those manifests publicly, which gives the
+coordinator an authoritative expected digest for every catalog tag.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+from typing import Any, Dict
+
+import httpx
+
+log = logging.getLogger("nvdc.models")
+
+OLLAMA_REGISTRY = "https://registry.ollama.ai"
+
+
+def _norm_digest(d: str) -> str:
+    d = str(d or "").strip()
+    if not d:
+        return ""
+    return d if d.startswith("sha256:") else "sha256:" + d
+
+
+def _pick_digest(tags_json: Dict[str, Any], model: str) -> str:
+    """Pull the digest of ``model`` out of an Ollama ``/api/tags`` response."""
+    want = model if ":" in model else model + ":latest"
+    for m in tags_json.get("models", []):
+        if m.get("name") == want or m.get("model") == want:
+            return _norm_digest(m.get("digest", ""))
+    return ""
+
+
+async def local_ollama_commit(model: str, ollama_url: str) -> str:
+    """The content digest of the locally installed model, or "" if unknown.
+
+    Reported by the same daemon that will execute the inference — i.e. the
+    runtime's own claim of identity, which the node then signs.
+    """
+    try:
+        async with httpx.AsyncClient(timeout=10) as c:
+            r = await c.get(f"{ollama_url.rstrip('/')}/api/tags")
+            r.raise_for_status()
+            return _pick_digest(r.json(), model)
+    except Exception as e:
+        log.debug("could not read local model digest for %s: %s", model, e)
+        return ""
+
+
+async def fetch_registry_digest(model: str) -> str:
+    """Authoritative digest for a library tag from registry.ollama.ai.
+
+    Returns "" when unavailable (custom/private models, network failure) —
+    callers must treat that as "unknown", never as a mismatch.
+    """
+    if "/" in model:  # only library/* tags have a public canonical digest
+        return ""
+    name, _, tag = model.partition(":")
+    if not name:
+        return ""
+    url = f"{OLLAMA_REGISTRY}/v2/library/{name}/manifests/{tag or 'latest'}"
+    headers = {"Accept": "application/vnd.docker.distribution.manifest.v2+json"}
+    try:
+        async with httpx.AsyncClient(timeout=8, follow_redirects=True) as c:
+            r = await c.get(url, headers=headers)
+            if r.status_code != 200:
+                return ""
+            dcd = r.headers.get("docker-content-digest", "")
+            if dcd:
+                return _norm_digest(dcd)
+            # OCI content addressing: the digest IS the sha256 of the bytes.
+            return "sha256:" + hashlib.sha256(r.content).hexdigest()
+    except Exception as e:
+        log.debug("registry digest fetch failed for %s: %s", model, e)
+        return ""
+
+
+def model_verdict(claimed: str, expected: str) -> str:
+    """Compare a node's claimed digest with registry ground truth.
+
+    'unknown' whenever either side is missing — absence of evidence is not a
+    mismatch. 'mismatch' only when both digests exist and differ.
+    """
+    claimed, expected = _norm_digest(claimed), _norm_digest(expected)
+    if not claimed or not expected:
+        return "unknown"
+    return "verified" if claimed == expected else "mismatch"

{nvdc-0.2.0 → nvdc-0.2.2}/src/nvdc/protocol.py

@@ -95,6 +95,7 @@ class NodeProfile:
     machine_id: str = ""         # stable per-machine id (survives reconnects)
     cluster: str = ""            # optional cluster label grouping machines
     private: bool = False        # personal mode: serve only the owner account
+    model_commit: str = ""       # content digest of the served model artifact
     agent_version: str = ""
     node_id: Optional[str] = None
 

{nvdc-0.2.0 → nvdc-0.2.2}/src/nvdc/runtime.py

@@ -54,11 +54,18 @@ class NetworkState:
     detail: str = ""
 
 
+@dataclass
+class UpdateState:
+    status: str = "idle"      # idle | updating | restarting | error
+    detail: str = ""
+
+
 class NodeRuntime:
     def __init__(self, name: str, mock: bool = False,
                  coordinator: str = DEFAULT_COORDINATOR_WS,
                  token: str = "", drain_timeout: float = 120.0,
-                 owner_account: str = "", cluster: str = ""):
+                 owner_account: str = "", cluster: str = "",
+                 auto_update: bool = False):
         self.name = name
         self.mock = mock
         self.drain_timeout = drain_timeout
@@ -73,6 +80,8 @@ class NodeRuntime:
         self.active_model = ""
         self.price_per_mtok = 0.0   # miner's minimum USD per 1M tokens
         self.private = False        # personal mode: serve only the owner account
+        self.auto_update = auto_update
+        self.update = UpdateState()
         self.wallet = Wallet()      # consumer-side USD wallet
         # Earnings owner account: defaults to this machine's own wallet.
         self.owner_account = owner_account or self.wallet.account_id
@@ -158,6 +167,8 @@ class NodeRuntime:
         return {
             "name": self.name,
             "version": __version__,
+            "auto_update": self.auto_update,
+            "update": asdict(self.update),
             "mock": self.mock,
             "hardware": hw,
             "attestation": asdict(self.attestation),
@@ -364,6 +375,7 @@ class NodeRuntime:
             machine_id=self.machine_id,
             cluster=self.cluster,
             private=self.private,
+            auto_update=self.auto_update,
         )
         self._agent = agent
         self._agent_task = asyncio.create_task(agent.run_forever())
@@ -390,6 +402,55 @@ class NodeRuntime:
         asyncio.create_task(self._agent.drain())
         return True, "draining"
 
+    # ---- self-update ---------------------------------------------------------
+    async def apply_update(self):
+        """One-click upgrade: drain off the network, pip-upgrade from PyPI,
+        then restart this process in place."""
+        if self.update.status in ("updating", "restarting"):
+            return False, "update already in progress"
+        from .update import restart_process, self_update
+        self.update = UpdateState(status="updating", detail="installing from PyPI…")
+        if self._agent is not None:  # leave gracefully; in-flight work finishes
+            try:
+                await asyncio.wait_for(self._agent.drain(),
+                                       timeout=self.drain_timeout + 10)
+            except Exception:
+                pass
+        ok, detail = await asyncio.to_thread(self_update)
+        if not ok:
+            log.error("self-update failed: %s", detail)
+            self.update = UpdateState(status="error", detail=detail[-300:])
+            return False, "update failed"
+        self.update = UpdateState(status="restarting", detail="restarting client…")
+        # Give the HTTP response a moment to flush before exec replaces us.
+        asyncio.get_running_loop().call_later(0.7, restart_process)
+        return True, "restarting"
+
+    async def auto_update_loop(self):
+        """Opt-in (--auto-update): periodically compare our version with the
+        coordinator's announced release and self-update when behind. The
+        upgrade always comes from PyPI — the network only provides the hint."""
+        from .protocol import version_tuple
+        delay = 20.0  # first check shortly after boot, then every 6 hours
+        while True:
+            await asyncio.sleep(delay)
+            delay = 6 * 3600
+            if not self.auto_update or self.update.status != "idle":
+                continue
+            base = self.coordinator_http
+            if not base:
+                continue
+            try:
+                async with httpx.AsyncClient(timeout=10) as c:
+                    info = (await c.get(base + "/api/version")).json()
+            except Exception:
+                continue
+            target = str(info.get("coordinator", "") or "")
+            if version_tuple(target) > version_tuple(__version__):
+                log.info("auto-update: %s -> %s announced by coordinator",
+                         __version__, target)
+                await self.apply_update()
+
     def _on_agent_status(self, status: str, info: dict):
         self.network.status = status
         if status == "live":

nvdc-0.2.2/src/nvdc/update.py

@@ -0,0 +1,53 @@
+"""Self-update: upgrade the nvdc package in place and restart the process.
+
+Trust model — the network only ever signals THAT a newer version exists. The
+upgrade itself always installs from PyPI through this environment's own
+package manager (``python -m pip install --upgrade nvdc``), never from a URL
+supplied by the coordinator, so enabling auto-update grants the network no
+more power than running ``pipx upgrade nvdc`` yourself. Auto mode is opt-in
+(``--auto-update`` / ``NVDC_AUTO_UPDATE=1``); the default experience is a
+one-click "Update & restart" prompt in the client UI.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import subprocess
+import sys
+from typing import Tuple
+
+log = logging.getLogger("nvdc.update")
+
+PACKAGE = "nvdc"
+
+
+def update_command() -> list:
+    """The exact command used to upgrade this installation. Pinned to the
+    current interpreter's environment, which is the pipx venv for installer/
+    pipx installs and the active venv/site for pip installs."""
+    return [sys.executable, "-m", "pip", "install", "--upgrade", PACKAGE]
+
+
+def self_update(timeout: float = 600) -> Tuple[bool, str]:
+    """Upgrade the package inside the current environment. Returns (ok, detail)."""
+    cmd = update_command()
+    log.info("self-update: %s", " ".join(cmd))
+    try:
+        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+    except Exception as e:  # pip missing, timeout, etc.
+        return False, f"updater failed to run: {e}"
+    out = ((proc.stdout or "") + (proc.stderr or "")).strip()
+    if proc.returncode != 0:
+        return False, out[-1500:] or f"pip exited {proc.returncode}"
+    return True, out[-1500:]
+
+
+def restart_process() -> None:
+    """Replace this process with a fresh one running the same command line.
+
+    Python opens sockets close-on-exec, so the listening port is freed and
+    the restarted process can rebind it. Never returns on success.
+    """
+    log.info("restarting: %s %s", sys.executable, " ".join(sys.argv))
+    os.execv(sys.executable, [sys.executable] + sys.argv)

{nvdc-0.2.0 → nvdc-0.2.2}/src/nvdc/web/index.html

@@ -708,11 +708,20 @@ let VERSION_INFO = null;
 function vparts(v){ return String(v||"").split("+")[0].split(".").map(x=>parseInt(x,10)||0); }
 function vOlder(a,b){ const x=vparts(a),y=vparts(b); for(let i=0;i<Math.max(x.length,y.length);i++){ const d=(x[i]||0)-(y[i]||0); if(d) return d<0; } return false; }
 function renderUpdateBanner(s){
-  const b=$("updateBanner"); if(!b||!s||!VERSION_INFO) return;
+  const b=$("updateBanner"); if(!b||!s) return;
+  const up=s.update||{};
+  if(up.status==="updating"){ b.style.display="block"; b.textContent="Updating client — "+(up.detail||"installing from PyPI…"); return; }
+  if(up.status==="restarting"){ b.style.display="block"; b.textContent="Update installed — restarting… this page will reconnect automatically."; return; }
+  if(!VERSION_INFO) return;
   const mine=s.version||"", min=VERSION_INFO.min_agent_version||"", cur=VERSION_INFO.coordinator||"";
-  if(min && vOlder(mine,min)){ b.style.display="block"; b.textContent="Upgrade required — this client (v"+mine+") can no longer join the network (minimum v"+min+"). Run: "+(VERSION_INFO.upgrade_command||"pipx upgrade nvdc"); }
-  else if(cur && vOlder(mine,cur)){ b.style.display="block"; b.textContent="Update available — v"+cur+" is out (you run v"+mine+"). Run: "+(VERSION_INFO.upgrade_command||"pipx upgrade nvdc"); }
-  else b.style.display="none";
+  let msg="";
+  if(min && vOlder(mine,min)) msg="Upgrade required — this client (v"+mine+") can no longer join the network (minimum v"+min+").";
+  else if(cur && vOlder(mine,cur)) msg="Update available — v"+cur+" is out (you run v"+mine+").";
+  if(up.status==="error") msg=(msg||"Update")+" Last attempt failed: "+String(up.detail||"see logs").replace(/[<>]/g,"")+".";
+  if(!msg){ b.style.display="none"; return; }
+  b.style.display="block";
+  b.innerHTML=msg.replace(/[<>]/g,"")+' <button class="btn" id="updateBtn" style="margin-left:10px">Update &amp; restart</button>'+(s.auto_update?' <span style="opacity:.7">(auto-update is on)</span>':'');
+  $("updateBtn").onclick=async()=>{ $("updateBtn").disabled=true; $("updateBtn").textContent="Updating…"; try{ await fetch("/api/update",{method:"POST"}); }catch(e){} };
 }
 
 async function tick(){

{nvdc-0.2.0 → nvdc-0.2.2}/src/nvdc.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nvdc
-Version: 0.2.0
+Version: 0.2.2
 Summary: Bring your GPU onto the network: one command turns a GPU into a verifiable, OpenAI-compatible inference node.
 Author: NVDC
 License: Apache-2.0
@@ -150,6 +150,16 @@ Attestation is a first-class, pluggable component (`nvdc/attestation.py`):
 A coordinator can enforce policy with `--require-attested` to only route work to
 nodes whose attestation verifies.
 
+**Model identity** is attested separately from hardware. Every node publishes a
+content-addressed commitment of the artifact it serves (the Ollama manifest
+digest) and signs it into each work receipt (`nvdc-work-v2`). The coordinator
+independently checks the claim against `registry.ollama.ai` and surfaces a
+verdict (`verified` / `mismatch` / `unknown`) per node and per receipt;
+`--require-verified-models` restricts routing to verified artifacts. Without a
+TEE this cannot *prove* which bytes ran — what it guarantees is that a node
+claiming one model while serving another has signed a non-repudiable false
+statement that contradicts public ground truth.
+
 > Note: the DGX Spark / GB10 cannot produce hardware attestation (NVIDIA disabled
 > CC on this SKU). It serves inference fine; it just joins as an unattested node.
 

{nvdc-0.2.0 → nvdc-0.2.2}/src/nvdc.egg-info/SOURCES.txt

@@ -14,10 +14,12 @@ src/nvdc/hardware.py
 src/nvdc/house.py
 src/nvdc/inference.py
 src/nvdc/keys.py
+src/nvdc/models.py
 src/nvdc/payments.py
 src/nvdc/protocol.py
 src/nvdc/runtime.py
 src/nvdc/storage.py
+src/nvdc/update.py
 src/nvdc/wallet.py
 src/nvdc.egg-info/PKG-INFO
 src/nvdc.egg-info/SOURCES.txt
@@ -29,8 +31,10 @@ src/nvdc/web/index.html
 tests/test_accounts_auth.py
 tests/test_coordinator_security.py
 tests/test_house_node.py
+tests/test_model_attestation.py
 tests/test_persistence.py
 tests/test_self_serve.py
+tests/test_self_update.py
 tests/test_split_pricing.py
 tests/test_storage_money.py
 tests/test_stripe_webhook.py

nvdc-0.2.2/tests/test_model_attestation.py

@@ -0,0 +1,195 @@
+"""Model identity: signed commitments, registry verdicts, routing policy."""
+
+import hashlib
+import json
+
+import pytest
+from starlette.testclient import TestClient
+
+from nvdc import keys, models, protocol
+from nvdc.coordinator import Node, Registry, create_app
+from nvdc.models import _pick_digest, model_verdict
+
+DIG = "sha256:" + "a" * 64
+OTHER = "sha256:" + "b" * 64
+
+
+# ---- pure pieces -------------------------------------------------------------
+def test_work_payload_v1_is_byte_identical_without_commitment():
+    p = keys.work_payload("r1", "m1", "pc", 5, "rc", "complete")
+    assert p == {"kind": "nvdc-work-v1", "req_id": "r1", "model": "m1",
+                 "prompt_commit": "pc", "tokens": 5, "response_commit": "rc",
+                 "delivery": "complete"}
+
+
+def test_work_payload_v2_signature_covers_model_identity(identity):
+    v2 = keys.work_payload("r1", "m1", "pc", 5, "rc", "complete", model_commit=DIG)
+    assert v2["kind"] == "nvdc-work-v2" and v2["model_commit"] == DIG
+    sig = identity.sign(v2)
+    assert keys.verify(identity.account_id, v2, sig)
+    # The same signature must NOT verify a payload claiming a different model.
+    forged = keys.work_payload("r1", "m1", "pc", 5, "rc", "complete", model_commit=OTHER)
+    assert not keys.verify(identity.account_id, forged, sig)
+    # ...nor strip the commitment and pass as v1.
+    v1 = keys.work_payload("r1", "m1", "pc", 5, "rc", "complete")
+    assert not keys.verify(identity.account_id, v1, sig)
+
+
+def test_verdict_logic():
+    assert model_verdict("", DIG) == "unknown"      # no claim
+    assert model_verdict(DIG, "") == "unknown"      # no ground truth
+    assert model_verdict(DIG, DIG) == "verified"
+    assert model_verdict("a" * 64, DIG) == "verified"   # prefix normalization
+    assert model_verdict(DIG, OTHER) == "mismatch"
+
+
+def test_pick_digest_from_ollama_tags():
+    tags = {"models": [
+        {"name": "llama3.1:8b", "digest": "a" * 64},
+        {"name": "mistral:latest", "digest": "sha256:" + "c" * 64},
+    ]}
+    assert _pick_digest(tags, "llama3.1:8b") == DIG
+    assert _pick_digest(tags, "mistral") == "sha256:" + "c" * 64
+    assert _pick_digest(tags, "missing:1b") == ""
+
+
+# ---- registration verdicts ---------------------------------------------------
+def _register(client, commit, model="llama3.1:8b"):
+    ws = client.websocket_connect("/node/ws")
+    ws.__enter__()
+    ws.send_text(protocol.encode(protocol.MSG_REGISTER, profile={
+        "name": "gpu", "account_id": "nvdc_machinekey",
+        "owner_account": "nvdc_owner", "machine_id": "m1",
+        "models": [model], "price_per_mtok": 1.0,
+        "model_commit": commit, "agent_version": "0.2.2",
+        "attestation": {"verified": False}}))
+    ack = json.loads(ws.receive_text())
+    return ws, ack
+
+
+@pytest.mark.parametrize("claimed,expected,verdict", [
+    (DIG, DIG, "verified"),
+    (OTHER, DIG, "mismatch"),
+    ("", DIG, "unknown"),       # legacy agent: no claim, never penalized
+])
+def test_registration_checks_claim_against_registry(monkeypatch, claimed, expected, verdict):
+    async def fake_registry(model):
+        return expected
+    monkeypatch.setattr(models, "fetch_registry_digest", fake_registry)
+    app = create_app(require_payment=False)
+    client = TestClient(app)
+    ws, ack = _register(client, claimed)
+    node = app.state.registry.nodes[ack["node_id"]]
+    assert node.model_verdict == verdict
+    d = node.to_dict()
+    assert d["model_verdict"] == verdict and d["model_commit"] == claimed
+    ws.__exit__(None, None, None)
+
+
+def test_registry_unreachable_is_unknown_not_mismatch(monkeypatch):
+    async def broken(model):
+        raise RuntimeError("registry down")
+    monkeypatch.setattr(models, "fetch_registry_digest", broken)
+    app = create_app(require_payment=False)
+    ws, ack = _register(TestClient(app), DIG)
+    assert app.state.registry.nodes[ack["node_id"]].model_verdict == "unknown"
+    ws.__exit__(None, None, None)
+
+
+# ---- routing policy ----------------------------------------------------------
+def _node(verdict, node_id="n1"):
+    n = Node(node_id, None, {"name": node_id, "models": ["m1"],
+                             "price_per_mtok": 1.0})
+    n.model_verdict = verdict
+    return n
+
+
+def test_strict_mode_routes_only_to_verified():
+    reg = Registry()
+    reg.add(_node("mismatch", "bad"))
+    reg.add(_node("unknown", "meh"))
+    assert reg.pick("m1", require_verified=True) is None
+    ok = _node("verified", "good")
+    reg.add(ok)
+    assert reg.pick("m1", require_verified=True) is ok
+    # Default policy: verdicts are informational, everyone routable.
+    assert reg.pick("m1") is not None
+
+
+# ---- receipts ----------------------------------------------------------------
+class _SigningNode(Node):
+    """In-process node that signs its work like a real v2 agent."""
+
+    def __init__(self, identity, commit):
+        super().__init__("s1", None, {
+            "name": "signer", "account_id": identity.account_id,
+            "owner_account": "nvdc_sowner", "machine_id": "sm1",
+            "models": ["m1"], "price_per_mtok": 1.0, "model_commit": commit,
+            "attestation": {"verified": False}})
+        self._identity = identity
+        self.model_verdict = "verified"
+
+    async def send(self, msg_type, **fields):
+        if msg_type != protocol.MSG_INFER:
+            return
+        req_id, body = fields["id"], fields["body"]
+        pc = hashlib.sha256(json.dumps(body.get("messages", []),
+                                       sort_keys=True).encode()).hexdigest()
+        rc = hashlib.sha256(b"ok").hexdigest()
+        sig = self._identity.sign(keys.work_payload(
+            req_id, "m1", pc, 7, rc, "complete", model_commit=self.model_commit))
+        self.pending[req_id].queue.put_nowait({
+            "t": protocol.MSG_RESULT, "id": req_id,
+            "body": {"choices": [{"message": {"role": "assistant", "content": "ok"}}],
+                     "usage": {"prompt_tokens": 3, "completion_tokens": 7}},
+            "tokens": 7, "prompt_tokens": 3, "response_commit": rc, "sig": sig})
+
+
+def test_receipt_carries_signed_model_commitment(identity):
+    app = create_app(require_payment=False)
+    app.state.registry.add(_SigningNode(identity, DIG))
+    client = TestClient(app)
+    r = client.post("/v1/chat/completions",
+                    headers={"X-NVDC-Account": "nvdc_consumer"},
+                    json={"model": "m1", "messages": [{"role": "user", "content": "hi"}]})
+    assert r.status_code == 200
+    receipt = app.state.ledger.recent(1)[0]
+    assert receipt["model_commit"] == DIG
+    assert receipt["model_commit_signed"] is True
+    assert receipt["node_sig_valid"] is True
+    assert receipt["model_verdict"] == "verified"
+    # /api/verify independently re-verifies the v2 node signature.
+    verdict = client.post("/api/verify", json=receipt).json()
+    assert verdict["node"] is True
+
+
+def test_legacy_v1_nodes_still_verify_but_commitment_unsigned(identity):
+    class _LegacyNode(_SigningNode):
+        def __init__(self, ident):
+            super().__init__(ident, commit="")   # pre-0.2.2: no commitment
+
+        async def send(self, msg_type, **fields):
+            if msg_type != protocol.MSG_INFER:
+                return
+            req_id, body = fields["id"], fields["body"]
+            pc = hashlib.sha256(json.dumps(body.get("messages", []),
+                                           sort_keys=True).encode()).hexdigest()
+            rc = hashlib.sha256(b"ok").hexdigest()
+            sig = self._identity.sign(keys.work_payload(req_id, "m1", pc, 7, rc, "complete"))
+            self.pending[req_id].queue.put_nowait({
+                "t": protocol.MSG_RESULT, "id": req_id,
+                "body": {"choices": [{"message": {"role": "assistant", "content": "ok"}}],
+                         "usage": {"prompt_tokens": 3, "completion_tokens": 7}},
+                "tokens": 7, "prompt_tokens": 3, "response_commit": rc, "sig": sig})
+
+    app = create_app(require_payment=False)
+    app.state.registry.add(_LegacyNode(identity))
+    client = TestClient(app)
+    r = client.post("/v1/chat/completions",
+                    headers={"X-NVDC-Account": "nvdc_consumer"},
+                    json={"model": "m1", "messages": [{"role": "user", "content": "hi"}]})
+    assert r.status_code == 200
+    receipt = app.state.ledger.recent(1)[0]
+    assert receipt["node_sig_valid"] is True          # legacy sigs still verify
+    assert receipt["model_commit_signed"] is False    # but identity not covered
+    assert receipt["model_commit"] == ""

nvdc-0.2.2/tests/test_self_update.py

@@ -0,0 +1,79 @@
+"""Self-update plumbing: PyPI-anchored command, endpoint guard, states."""
+
+import subprocess
+import sys
+
+import pytest
+from starlette.testclient import TestClient
+
+from nvdc import update
+
+
+def test_update_command_is_pinned_to_own_environment():
+    cmd = update.update_command()
+    assert cmd[0] == sys.executable          # the pipx/venv interpreter
+    assert cmd[1:] == ["-m", "pip", "install", "--upgrade", "nvdc"]
+
+
+def test_self_update_success_and_failure(monkeypatch):
+    calls = []
+
+    def fake_run(cmd, **kw):
+        calls.append(cmd)
+        return subprocess.CompletedProcess(cmd, 0, stdout="Successfully installed nvdc-9.9.9", stderr="")
+
+    monkeypatch.setattr(update.subprocess, "run", fake_run)
+    ok, detail = update.self_update()
+    assert ok and "9.9.9" in detail
+    assert calls[0] == update.update_command()
+
+    monkeypatch.setattr(update.subprocess, "run",
+                        lambda cmd, **kw: subprocess.CompletedProcess(cmd, 1, "", "boom"))
+    ok, detail = update.self_update()
+    assert not ok and "boom" in detail
+
+
+@pytest.fixture()
+def client_app(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOME", str(tmp_path))  # keep the wallet out of ~/.nvdc
+    from nvdc.app import create_app
+    from nvdc.runtime import NodeRuntime
+    runtime = NodeRuntime(name="t", mock=True)
+    triggered = []
+
+    async def fake_apply():
+        triggered.append(True)
+        return True, "restarting"
+
+    monkeypatch.setattr(runtime, "apply_update", fake_apply)
+    return TestClient(create_app(runtime)), triggered
+
+
+def test_update_endpoint_rejects_cross_origin(client_app):
+    client, triggered = client_app
+    r = client.post("/api/update", headers={"origin": "https://evil.example",
+                                            "host": "localhost:8765"})
+    assert r.status_code == 403
+    assert triggered == []
+
+
+def test_update_endpoint_allows_own_ui_and_local_tools(client_app):
+    client, triggered = client_app
+    # Same-origin browser POST (Origin matches Host).
+    r = client.post("/api/update", headers={"origin": "http://localhost:8765",
+                                            "host": "localhost:8765"})
+    assert r.status_code == 200 and r.json()["ok"] is True
+    # Local curl (no Origin header at all).
+    r = client.post("/api/update")
+    assert r.status_code == 200
+    assert len(triggered) == 2
+
+
+def test_snapshot_carries_update_state(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    from nvdc.runtime import NodeRuntime, UpdateState
+    rt = NodeRuntime(name="t", mock=True, auto_update=True)
+    rt.update = UpdateState(status="updating", detail="installing")
+    snap = rt.snapshot()
+    assert snap["auto_update"] is True
+    assert snap["update"] == {"status": "updating", "detail": "installing"}