sable-sphynx 0.7.0.dev0__py3-none-any.whl

sphynx/hosted/model_admission.py

@@ -0,0 +1,130 @@
+"""Trusted, generation-pinned admission metadata for the first CPU model.
+
+Only an operator can supply this record. Its digest detects changed bytes; a
+candidate declaration and a readiness message do not establish model use. The
+actual probe is performed separately before the operator publishes admission.
+No ML packages, candidate code or network clients are loaded by this module.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+import hashlib
+import json
+from pathlib import Path
+import re
+
+from ..contracts import ContractError, canonical_json
+from .contracts import HostedError
+from .model_artifacts import MODEL_REF, model_artifact_inventory
+from .model_contracts import MODEL_RUNTIME_PROFILE, MODEL_SUITE, MODEL_BASELINE
+from .model_gcs import ModelObjectReceipt, ModelRegistration
+from .model_session import SESSION_POLICY, TIMING_POLICY
+
+ADMISSION_SCHEMA = "sphynx.hosted.model-runtime-admission.v1"
+TRUSTED_BUCKET = "sphynx-hosted-pilot-510311"
+ALLOWED_REPOSITORIES = (1360688838, 1396941909)
+IMAGE_PREFIX = "us-central1-docker.pkg.dev/sphynx-510311/sphynx-hosted/minilm-cpu@sha256:"
+MAX_ADMISSION_BYTES = 262_144
+_FIELDS = {"schema_version", "model_ref", "manifest_digest", "runtime_profile", "image_digest",
+           "dependency_lock", "model_assets", "resource_policy", "timing_policy", "probe",
+           "allowed_repositories", "team_id", "admission_digest"}
+
+
+def _require(condition, code="invalid_model_admission"):
+    if not condition:
+        raise HostedError(code, "operator model runtime admission is missing, invalid or outside its scope")
+
+
+def admission_digest(record):
+    """Hash the full canonical operator record except the hash field itself."""
+    _require(type(record) is dict)
+    try:
+        raw = canonical_json({k: v for k, v in record.items() if k != "admission_digest"})
+    except (ContractError, RecursionError):
+        raise HostedError("invalid_model_admission", "operator model admission must be finite bounded JSON") from None
+    return "sha256:" + hashlib.sha256(raw.encode("utf-8")).hexdigest()
+
+
+def validate_model_runtime(record, *, trusted_bucket=TRUSTED_BUCKET):
+    """Validate and detach metadata; no receipt bytes or model use are inferred."""
+    _require(type(record) is dict and set(record) == _FIELDS)
+    try:
+        raw = canonical_json(record)
+        _require(len(raw.encode("utf-8")) <= MAX_ADMISSION_BYTES)
+    except (ContractError, RecursionError):
+        raise HostedError("invalid_model_admission", "operator model admission must be finite bounded JSON") from None
+    _require(record["schema_version"] == ADMISSION_SCHEMA and record["model_ref"] == MODEL_REF
+             and record["runtime_profile"] == MODEL_RUNTIME_PROFILE and record["team_id"] == "sable")
+    _require(trusted_bucket == TRUSTED_BUCKET)
+    inventory = model_artifact_inventory()
+    pin = inventory["manifest.json"]["digest"]
+    _require(record["manifest_digest"] == pin, "unapproved_model_manifest")
+    registration = ModelRegistration.from_dict(record["model_assets"], trusted_bucket=trusted_bucket,
+                                               approved_manifest_pins={MODEL_REF: pin})
+    _require(registration.manifest_digest == pin)
+    image = record["image_digest"]
+    _require(type(image) is str and re.fullmatch(re.escape(IMAGE_PREFIX) + "[0-9a-f]{64}", image),
+             "invalid_model_runtime_identity")
+    # Canonical equality preserves JSON types (True is not the CPU count 1).
+    _require(canonical_json(record["resource_policy"]) == canonical_json(SESSION_POLICY)
+             and canonical_json(record["timing_policy"]) == canonical_json(TIMING_POLICY),
+             "invalid_model_runtime_policy")
+    repos = record["allowed_repositories"]
+    _require(type(repos) is list and all(type(item) is int for item in repos)
+             and repos == list(ALLOWED_REPOSITORIES), "model_runtime_not_authorized")
+    lock = ModelObjectReceipt.from_dict(record["dependency_lock"])
+    probe = ModelObjectReceipt.from_dict(record["probe"])
+    _require(lock.bucket == trusted_bucket and lock.size_bytes <= 2 * 1024 * 1024
+             and re.fullmatch(r"prepared/runtimes/minilm-cpu/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[A-Za-z0-9_./-]+", lock.object_name),
+             "invalid_model_dependency_lock")
+    image_sha = image.rsplit(":", 1)[1]
+    _require(probe.bucket == trusted_bucket and probe.size_bytes <= 2 * 1024 * 1024
+             and re.fullmatch(r"captures/model-probes/" + image_sha + r"/[0-9a-f]{64}/probe\.json", probe.object_name),
+             "invalid_model_probe_receipt")
+    _require(type(record["admission_digest"]) is str and re.fullmatch(r"sha256:[0-9a-f]{64}", record["admission_digest"])
+             and record["admission_digest"] == admission_digest(record), "model_admission_digest_mismatch")
+    return json.loads(raw)
+
+
+def require_model_authorization(record, *, team_id, base_repository_id, head_repository_id,
+                                suite, baseline, trusted_bucket=TRUSTED_BUCKET):
+    admitted = validate_model_runtime(record, trusted_bucket=trusted_bucket)
+    _require(team_id == admitted["team_id"] and type(base_repository_id) is int
+             and type(head_repository_id) is int and base_repository_id in admitted["allowed_repositories"]
+             and head_repository_id in admitted["allowed_repositories"], "model_runtime_not_authorized")
+    _require(suite == MODEL_SUITE, "model_suite_not_supported")
+    _require(baseline == MODEL_BASELINE, "model_baseline_not_supported")
+    return admitted
+
+
+@dataclass(frozen=True)
+class ModelRuntimeAdmission:
+    """Immutable operator record; callers receive detached JSON dictionaries."""
+    record_json: str
+
+    @classmethod
+    def from_dict(cls, record, *, trusted_bucket=TRUSTED_BUCKET):
+        return cls(canonical_json(validate_model_runtime(record, trusted_bucket=trusted_bucket)))
+
+    def to_dict(self):
+        return json.loads(self.record_json)
+
+
+def load_model_runtime(path, *, trusted_bucket=TRUSTED_BUCKET):
+    try:
+        with Path(path).open("rb") as stream:
+            raw = stream.read(MAX_ADMISSION_BYTES + 1)
+        _require(0 < len(raw) <= MAX_ADMISSION_BYTES)
+        def unique(pairs):
+            value = {}
+            for key, item in pairs:
+                _require(key not in value)
+                value[key] = item
+            return value
+        record = json.loads(raw, object_pairs_hook=unique,
+                            parse_constant=lambda _: (_ for _ in ()).throw(ValueError()))
+        return ModelRuntimeAdmission.from_dict(record, trusted_bucket=trusted_bucket)
+    except HostedError:
+        raise
+    except (OSError, ValueError, TypeError, RecursionError):
+        raise HostedError("invalid_model_admission", "operator model admission could not be loaded") from None

sphynx/hosted/model_artifacts.py

@@ -0,0 +1,298 @@
+"""Trusted offline MiniLM artifact intake; never imports an ML backend.
+
+Only one operator-reviewed, safetensors-only closure is admitted. A candidate
+cannot choose a URL, redirect, local path, replacement revision or digest pin.
+Artifact availability is separate from runtime admission and inference proof.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+import hashlib
+import json
+import math
+from pathlib import Path
+import re
+import shutil
+import stat
+import struct
+from types import MappingProxyType
+
+from ..contracts import canonical_json
+from ..integration_contracts import value_digest
+from .contracts import HostedError
+
+SCHEMA = "sphynx.hosted.model-artifact.v1"
+MODEL_ID = "minilm-l6-v2"
+CHECKPOINT = "cross-encoder/ms-marco-MiniLM-L-6-v2"
+PUBLISHER_CHECKPOINT = "cross-encoder/ms-marco-MiniLM-L6-v2"
+REVISION = "233902d25c440f23af6f7d6e94d2946bac0bee0a"
+MODEL_REF = MODEL_ID + "@" + REVISION
+SNAPSHOT_LOCATOR = "snapshot/" + REVISION
+REGISTERED_MODEL_LOCATORS = MappingProxyType({MODEL_REF: SNAPSHOT_LOCATOR})
+REVIEWED_FILES = MappingProxyType({
+    "config.json": (794, "380e02c93f431831be65d99a4e7e5f67c133985bf2e77d9d4eba46847190bacc"),
+    "model.safetensors": (90870598, "821d1aa69520101d6e0737f78a042ae25b19e5cb9160701909d10434f4aeb0ae"),
+    "README.md": (3673, "7c0ec39941d0d1d766ccde671f592971d82fe45b7eea550a80d1ea864ebc3baa"),
+    "special_tokens_map.json": (132, "3c3507f36dff57bce437223db3b3081d1e2b52ec3e56ee55438193ecb2c94dd6"),
+    "tokenizer.json": (711396, "d241a60d5e8f04cc1b2b3e9ef7a4921b27bf526d9f6050ab90f9267a1f9e5c66"),
+    "tokenizer_config.json": (1330, "a5c2e5a7b1a29a0702cd28c08a399b5ecc110c263009d17f7e3b415f25905fd8"),
+    "vocab.txt": (231508, "07eced375cec144d27c900241f3e339478dec958f92fddbc551f295c992038a3"),
+})
+MAX_FILE_BYTES = 128 * 1024 * 1024
+MAX_JSON_BYTES = 2 * 1024 * 1024
+MAX_HEADER_BYTES = 64 * 1024
+MODEL_CARD_URL = "https://huggingface.co/" + PUBLISHER_CHECKPOINT + "/blob/" + REVISION + "/README.md"
+NOTICE = ("# MiniLM model artifact notice\n\n"
+    "Model: cross-encoder/ms-marco-MiniLM-L6-v2.\n"
+    "Pinned revision: " + REVISION + ".\n"
+    "The historical SDK alias is cross-encoder/ms-marco-MiniLM-L-6-v2.\n"
+    "The publisher model card declares Apache-2.0; the unmodified card is retained in README.md.\n"
+    "Publisher card: " + MODEL_CARD_URL + "\n"
+    "License text: https://www.apache.org/licenses/LICENSE-2.0\n\n"
+    "This is the seven-file CPU safetensors inference closure, not a complete repository mirror.\n"
+    "The snapshot contains no standalone LICENSE file. No redistribution approval or human review\n"
+    "receipt is asserted here. Model weights and code licensing are separate from dataset rights.\n"
+    "All scores are raw ranking utilities, not calibrated probabilities.\n").encode("utf-8")
+
+
+def _require(condition, code="invalid_model_artifact"):
+    if not condition:
+        raise HostedError(code, "model artifact identity or local closure is invalid")
+
+
+def _encoded(value):
+    return (canonical_json(value) + "\n").encode("utf-8")
+
+
+def _digest(raw):
+    return "sha256:" + hashlib.sha256(raw).hexdigest()
+
+
+def _json(raw):
+    _require(type(raw) is bytes and 0 < len(raw) <= MAX_JSON_BYTES)
+    def unique(pairs):
+        result = {}
+        for key, value in pairs:
+            _require(key not in result, "duplicate_model_field")
+            result[key] = value
+        return result
+    try:
+        return json.loads(raw, object_pairs_hook=unique,
+                          parse_constant=lambda _: (_ for _ in ()).throw(ValueError()))
+    except (ValueError, UnicodeError, RecursionError):
+        raise HostedError("invalid_model_artifact", "model metadata JSON is invalid") from None
+
+
+def _alias(path):
+    info = path.lstat()
+    return path.is_symlink() or bool(getattr(info, "st_file_attributes", 0) & 0x400)
+
+
+def _root(directory):
+    path = Path(directory).absolute()
+    _require(path.is_dir() and not _alias(path), "invalid_model_path")
+    return path.resolve()
+
+
+def _inventory(root, allowed_directories=()):
+    files = {}
+    pending = [root]
+    while pending:
+        for path in pending.pop().iterdir():
+            _require(not _alias(path), "invalid_model_path")
+            mode = path.lstat().st_mode
+            if stat.S_ISDIR(mode):
+                _require(path.relative_to(root).as_posix() in allowed_directories, "model_closure_mismatch")
+                pending.append(path)
+            else:
+                _require(stat.S_ISREG(mode), "invalid_model_path")
+                files[path.relative_to(root).as_posix()] = path
+    return files
+
+
+def _file_hash(path):
+    h = hashlib.sha256()
+    with path.open("rb") as stream:
+        for block in iter(lambda: stream.read(1024 * 1024), b""):
+            h.update(block)
+    return "sha256:" + h.hexdigest()
+
+
+def _validate_header(path):
+    """Read only the safe serialization header; no tensors are allocated."""
+    size = path.stat().st_size
+    with path.open("rb") as stream:
+        prefix = stream.read(8)
+        _require(len(prefix) == 8, "invalid_model_weights")
+        length = struct.unpack("<Q", prefix)[0]
+        _require(0 < length <= MAX_HEADER_BYTES and 8 + length < size, "invalid_model_weights")
+        header = _json(stream.read(length))
+    _require(type(header) is dict and header.get("__metadata__") == {"format": "pt"}, "invalid_model_weights")
+    tensors = {name: value for name, value in header.items() if name != "__metadata__"}
+    _require(len(tensors) == 106, "invalid_model_weights")
+    segments, dtypes = [], set()
+    for name, tensor in tensors.items():
+        _require(type(name) is str and bool(name) and type(tensor) is dict
+                 and set(tensor) == {"dtype", "shape", "data_offsets"}, "invalid_model_weights")
+        dtype, shape, offsets = tensor["dtype"], tensor["shape"], tensor["data_offsets"]
+        _require(dtype in ("F32", "I64") and type(shape) is list and len(shape) <= 4
+                 and all(type(n) is int and 0 < n <= 1000000 for n in shape), "invalid_model_weights")
+        _require(type(offsets) is list and len(offsets) == 2
+                 and all(type(n) is int and 0 <= n <= MAX_FILE_BYTES for n in offsets), "invalid_model_weights")
+        start, end = offsets
+        _require(end > start and end - start == math.prod(shape) * (4 if dtype == "F32" else 8), "invalid_model_weights")
+        segments.append((start, end)); dtypes.add(dtype)
+    _require(dtypes == {"F32", "I64"}, "invalid_model_weights")
+    cursor = 0
+    for start, end in sorted(segments):
+        _require(start == cursor, "invalid_model_weights")
+        cursor = end
+    _require(cursor == size - 8 - length, "invalid_model_weights")
+    return {"serialization": "safetensors", "tensor_count": 106, "dtypes": ["F32", "I64"],
+            "tensor_execution": False}
+
+
+def verify_minilm_snapshot(snapshot_dir):
+    """Check the operator-reviewed seven files and metadata without loading ML."""
+    root = _root(snapshot_dir)
+    actual = _inventory(root)
+    _require(set(actual) == set(REVIEWED_FILES), "model_closure_mismatch")
+    hashes = {}
+    for name, (expected_size, expected_sha) in REVIEWED_FILES.items():
+        path = actual[name]
+        _require(type(expected_size) is int and 0 < expected_size <= MAX_FILE_BYTES)
+        _require(path.stat().st_size == expected_size, "model_file_size_mismatch")
+        digest = _file_hash(path)
+        _require(digest == "sha256:" + expected_sha, "model_file_digest_mismatch")
+        hashes[name] = digest
+    config = _json(actual["config.json"].read_bytes())
+    tokenizer = _json(actual["tokenizer_config.json"].read_bytes())
+    _require(type(config) is dict and type(tokenizer) is dict
+             and "auto_map" not in config and "auto_map" not in tokenizer, "unsupported_model_code")
+    expected = {"architectures": ["BertForSequenceClassification"], "model_type": "bert", "hidden_size": 384,
+                "num_hidden_layers": 6, "num_attention_heads": 12, "max_position_embeddings": 512,
+                "vocab_size": 30522, "sbert_ce_default_activation_function": "torch.nn.modules.linear.Identity"}
+    _require(all(config.get(k) == v for k, v in expected.items()), "unsupported_model_architecture")
+    _require(tokenizer.get("model_max_length") == 512 and tokenizer.get("tokenizer_class") == "BertTokenizer",
+             "unsupported_model_tokenizer")
+    serialization = _validate_header(actual["model.safetensors"])
+    return {"snapshot_files": hashes, "snapshot_digest": value_digest(hashes), "serialization": serialization}
+
+
+def _manifest():
+    hashes = {name: "sha256:" + pair[1] for name, pair in REVIEWED_FILES.items()}
+    return {"schema_version": SCHEMA, "model_ref": MODEL_REF, "model_id": MODEL_ID,
+        "checkpoint": CHECKPOINT, "publisher_checkpoint": PUBLISHER_CHECKPOINT, "revision": REVISION,
+        "tokenizer_revision": REVISION, "snapshot_digest": value_digest(hashes), "snapshot_locator": SNAPSHOT_LOCATOR,
+        "files": {name: {"size_bytes": size, "digest": "sha256:" + digest} for name, (size, digest) in REVIEWED_FILES.items()},
+        "notice": {"locator": "MODEL_NOTICE.md", "size_bytes": len(NOTICE), "digest": _digest(NOTICE)},
+        "serialization": {"format": "safetensors", "tensor_count": 106, "dtypes": ["F32", "I64"], "trust_remote_code": False},
+        "scoring_parameters": {"maximum_tokens": 512, "batch_size": 16, "activation": "identity",
+            "query_prefix": "", "truncation": "longest_first", "seed": 0, "device": "cpu", "torch_threads": 1},
+        "license_provenance": {"declared_license": "Apache-2.0", "declaration_file": "README.md",
+            "model_card_url": MODEL_CARD_URL, "standalone_license_in_snapshot": False,
+            "redistribution_approval_receipt": None},
+        "runtime_requirements": {"python": "3.12", "backend": "sentence_transformers.CrossEncoder",
+            "suggested_profile": "python-minilm-cpu.v1", "torch_wheel": "cpu-only",
+            "suggested_memory_bytes": 2147483648, "network": "none", "weights_mount": "read-only",
+            "immutable_runtime_digest": None, "dependency_lock_digest": None,
+            "required_gates": ["hashed_linux_cpu_dependency_lock", "immutable_runtime_image",
+                "sandbox_backend_compatibility", "bounded_cold_start_and_peak_rss", "case_and_watchdog_timeout_budget"]},
+        "verification_scope": {"source_file_hashes": True, "safetensors_header": True,
+            "backend_imported": False, "model_executed": False, "hosted_execution_admitted": False}}
+
+
+def model_artifact_inventory():
+    """Return the exact reviewed nine-file inventory for an operator registry."""
+    manifest = _encoded(_manifest())
+    inventory = {SNAPSHOT_LOCATOR + "/" + name: {"digest": "sha256:" + sha, "size_bytes": size}
+                 for name, (size, sha) in REVIEWED_FILES.items()}
+    inventory["manifest.json"] = {"digest": _digest(manifest), "size_bytes": len(manifest)}
+    inventory["MODEL_NOTICE.md"] = {"digest": _digest(NOTICE), "size_bytes": len(NOTICE)}
+    return inventory
+
+
+@dataclass(frozen=True)
+class ModelArtifactExport:
+    directory: Path
+    manifest_sha256: str
+    model_ref: str
+    snapshot_digest: str
+
+
+@dataclass(frozen=True)
+class VerifiedModelArtifact:
+    directory: Path
+    snapshot_path: Path
+    manifest_sha256: str
+    manifest_json: str
+
+    @property
+    def manifest(self):
+        return json.loads(self.manifest_json)
+
+    @property
+    def model_ref(self):
+        return self.manifest["model_ref"]
+
+    @property
+    def snapshot_digest(self):
+        return self.manifest["snapshot_digest"]
+
+    def reverify(self):
+        """Call before execution or use an independently protected read-only mount."""
+        return load_model_artifact(self.directory, expected_manifest_sha256=self.manifest_sha256,
+                                   registered_asset_locators=REGISTERED_MODEL_LOCATORS)
+
+
+def export_minilm_artifact(snapshot_dir, output_dir):
+    """Copy only a verified existing snapshot into a fresh deterministic package.
+
+    No network, model downloads, backend imports, cloud writes or inference occur.
+    A failed export can leave an incomplete fresh directory; it is never admitted.
+    """
+    identity = verify_minilm_snapshot(snapshot_dir)
+    source = _root(snapshot_dir)
+    output = Path(output_dir).absolute()
+    _require(not output.exists(), "model_export_exists")
+    output.mkdir(parents=True, exist_ok=False)
+    target = output / SNAPSHOT_LOCATOR
+    target.mkdir(parents=True)
+    for name in REVIEWED_FILES:
+        shutil.copyfile(source / name, target / name)
+    # Recheck the copies, so edits between source validation and copying fail.
+    _require(verify_minilm_snapshot(target) == identity, "model_copy_identity_mismatch")
+    (output / "MODEL_NOTICE.md").write_bytes(NOTICE)
+    raw = _encoded(_manifest())
+    (output / "manifest.json").write_bytes(raw)
+    loaded = load_model_artifact(output, expected_manifest_sha256=_digest(raw),
+                                 registered_asset_locators=REGISTERED_MODEL_LOCATORS)
+    return ModelArtifactExport(output, loaded.manifest_sha256, loaded.model_ref, loaded.snapshot_digest)
+
+
+def load_model_artifact(bundle_dir, *, expected_manifest_sha256, registered_asset_locators):
+    """Verify a staged, operator-registered package against an independent pin.
+
+    A hosted caller must first verify generation-pinned GCS receipts. This loader
+    performs no URL resolution and cannot derive authority from a candidate's pin.
+    """
+    _require(type(expected_manifest_sha256) is str
+             and re.fullmatch(r"sha256:[0-9a-f]{64}", expected_manifest_sha256), "invalid_model_manifest_pin")
+    _require(isinstance(registered_asset_locators, (dict, MappingProxyType))
+             and dict(registered_asset_locators) == dict(REGISTERED_MODEL_LOCATORS), "unregistered_model_locator")
+    root = _root(bundle_dir)
+    inventory = _inventory(root, {"snapshot", SNAPSHOT_LOCATOR})
+    expected = {"manifest.json", "MODEL_NOTICE.md"} | {SNAPSHOT_LOCATOR + "/" + name for name in REVIEWED_FILES}
+    _require(set(inventory) == expected, "model_closure_mismatch")
+    path = inventory["manifest.json"]
+    _require(0 < path.stat().st_size <= MAX_JSON_BYTES)
+    raw = path.read_bytes()
+    _require(_digest(raw) == expected_manifest_sha256, "model_manifest_digest_mismatch")
+    parsed = _json(raw)
+    _require(_encoded(parsed) == _encoded(_manifest()), "model_manifest_identity_mismatch")
+    _require(inventory["MODEL_NOTICE.md"].stat().st_size == len(NOTICE), "model_notice_mismatch")
+    _require(inventory["MODEL_NOTICE.md"].read_bytes() == NOTICE, "model_notice_mismatch")
+    snapshot_path = root / SNAPSHOT_LOCATOR
+    identity = verify_minilm_snapshot(snapshot_path)
+    _require(identity["snapshot_digest"] == parsed["snapshot_digest"], "model_snapshot_digest_mismatch")
+    return VerifiedModelArtifact(root, snapshot_path, expected_manifest_sha256, canonical_json(parsed))

sphynx/hosted/model_contracts.py

@@ -0,0 +1,63 @@
+"""Additive configuration for one operator-admitted, offline CPU model runtime.
+
+Configuration describes an approach; it does not prove that submitted code used
+the declared model. Parsing never imports ML libraries or retrieves artifacts.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any, Mapping
+
+from .contracts import CandidateConfig, HostedError, _parse_candidate_config, fields
+from .model_artifacts import MODEL_REF
+
+MODEL_CONFIG_SCHEMA = "sphynx.candidate.repository.v2"
+MODEL_SUBMISSION_SCHEMA = "sphynx.hosted.prepared-submission.v3"
+MODEL_RUNTIME_PROFILE = "python-minilm-cpu.v1"
+MODEL_TRANSPORT = "jsonl-session.v1"
+MODEL_SUITE = "rag.rerank.public.v1"
+MODEL_BASELINE = "supplied-score:v1"
+
+
+@dataclass(frozen=True)
+class RegisteredModelCandidateConfig(CandidateConfig):
+    """The legacy source contract with a separately admitted session runtime."""
+
+    def to_dict(self) -> dict[str, Any]:
+        value = super().to_dict()
+        value["schema_version"] = MODEL_CONFIG_SCHEMA
+        value["runtime"] = {"profile": MODEL_RUNTIME_PROFILE, "python": "3.12",
+                            "transport": MODEL_TRANSPORT}
+        value["model"] = {"kind": "registered", "ref": MODEL_REF}
+        return value
+
+
+def parse_model_configuration(raw: Mapping[str, Any]) -> RegisteredModelCandidateConfig:
+    fields(raw, {"schema_version", "candidate", "build", "runtime", "model"} |
+           ({"method"} if "method" in raw else set()), "model configuration")
+    if raw["schema_version"] != MODEL_CONFIG_SCHEMA:
+        raise HostedError("unsupported_configuration_version", "expected model repository v2")
+    runtime = fields(raw["runtime"], {"profile", "python", "transport"}, "model runtime")
+    if dict(runtime) != {"profile": MODEL_RUNTIME_PROFILE, "python": "3.12", "transport": MODEL_TRANSPORT}:
+        raise HostedError("unsupported_runtime", "model candidates require the admitted CPU session profile")
+    model = fields(raw["model"], {"kind", "ref"}, "registered model")
+    if dict(model) != {"kind": "registered", "ref": MODEL_REF}:
+        raise HostedError("unapproved_model_manifest", "model candidates require the registered MiniLM revision")
+    build = fields(raw["build"], {"commands", "dependencies"}, "model build")
+    if type(build["commands"]) is not list or build["commands"]:
+        raise HostedError("model_build_not_supported", "model candidates must use the prebuilt runtime without build commands")
+    if type(build["dependencies"]) is not list or build["dependencies"]:
+        raise HostedError("dependencies_not_supported", "model candidates must use the operator-frozen offline dependencies")
+    # Reuse all existing source/argv/interface/method checks without admitting a
+    # model through the legacy parser or a family.v1 method.
+    legacy = dict(raw)
+    legacy.update(schema_version="sphynx.candidate.repository.v1",
+                  runtime={"profile": "python-cpu.v1", "python": "3.12"}, model={"kind": "none"})
+    parsed = _parse_candidate_config(legacy)
+    values = dict(vars(parsed))
+    values.update(runtime_profile=MODEL_RUNTIME_PROFILE, model_kind="registered")
+    return RegisteredModelCandidateConfig(**values)
+
+
+def is_model_configuration(config) -> bool:
+    return isinstance(config, RegisteredModelCandidateConfig)