soup-cli 0.71.0__tar.gz → 0.71.2__tar.gz

soup_cli-0.71.2/CHANGELOG.md

@@ -0,0 +1,120 @@
+# Changelog
+
+All notable changes to **Soup CLI** are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+Detailed, per-release notes for every published version live on the
+[GitHub Releases page](https://github.com/MakazhanAlpamys/Soup/releases). This
+file tracks unreleased changes and links out for historical detail rather than
+reproducing 70+ versions of notes.
+
+## [Unreleased]
+
+## [0.71.2] - 2026-06-01
+
+### Added
+- **ed25519 signing for `soup adapters sign` / `soup attest`** — real detached
+  signatures (over the adapter Merkle root / the in-toto statement) via a new
+  `[sign]` extra (`pip install soup-cli[sign]`, pulling `cryptography`).
+  `soup adapters sign --backend ed25519 --key <priv.pem>` (or `--generate-key
+  <out.pem>`, or `SOUP_SIGNING_KEY`); `soup adapters verify [--public-key
+  <trusted.pem>]` does a cryptographic verify and, with a trusted key, genuine
+  authentication. `soup attest emit --sign ed25519 --key <priv.pem>` writes a
+  `<output>.sig` sidecar; new `soup attest verify <statement> --signature <sig>`
+  verifies it (canonical-JSON, so it's platform/newline-independent). Sigstore
+  keyless signing stays infra-blocked (needs an OIDC provider + Fulcio/Rekor
+  network — can't be honestly validated offline).
+- **Anti-AI-Jacking namespace pin on Hub downloads** — HF model fetches now
+  consult a trust-on-first-use pin store: a repo whose author changes (or whose
+  `created_at` jumps backward) is refused unless the namespace shift is explicitly
+  allowed. Fails open when repo metadata is unavailable.
+- **License auto-detection at `soup adapters merge`** — when `--license` isn't
+  given, the license is read from each adapter's `adapter_config.json` /
+  `config.json` / model-card frontmatter (HF `llama3.1`-style ids mapped to
+  canonical) and the conflict gate runs automatically.
+- **Backdoor-scan gate at `soup adapters merge`** — refuses to merge any input
+  whose `soup adapters scan` returns FAIL (or can't be scanned) unless
+  `--allow-unscanned` is passed; WARN is advisory.
+
+### Changed
+- License-conflict overrides (`--license-override <reason>`) are now recorded to
+  the audit log for legal review.
+- The namespace-pin store now uses SQLite WAL + busy-timeout and a cross-process
+  file lock around its get+insert, so concurrent writers don't lose the trust
+  anchor.
+
+### Security
+- ed25519 verification fails closed (any tamper / wrong key / missing key ⇒
+  invalid). Signing keys + trusted public keys are symlink-rejected and
+  size-capped via a shared reader (no cwd-containment — keys live outside the
+  project). `--generate-key` refuses to overwrite any existing path.
+
+## [0.71.1] - 2026-06-01
+
+### Added
+- `soup env fix` — render a reproducible install plan from `soup-env.lock`.
+  Emits copy/paste `uv pip install` commands (`--format uv-pip`, default) or a
+  `requirements.txt` body (`--format requirements`); `--output` optionally writes
+  a `requirements.txt` under cwd. Print-only by design — never shells out to a
+  package manager.
+- `soup lock write --env-lock <path>` — auto-derive `--env-hash` from a
+  `soup-env.lock` so operators who ran `soup env lock` don't copy the hash by
+  hand. `--env-hash` still wins when passed explicitly.
+- `soup serve --record-thumbs <db>` — capture thumbs-up/down feedback into a
+  local-RL SQLite at startup, plus a new `POST /v1/thumbs` endpoint (transformers
+  backend). Returns 404 when the flag isn't set.
+- Judge-calibration persistence: `JudgeCalibrationReport.to_dict`,
+  `write_judge_calibration`, and `load_judge_calibration`, backed by a new
+  `judge_calibration` registry artifact kind. Loading re-validates the report so
+  a corrupt on-disk field is rejected.
+- Bundled MUSE and WMDP unlearning eval fixtures so
+  `soup eval unlearning --benchmark muse|wmdp` runs out of the box. WMDP
+  forget-set probes ship **redacted** (placeholder prompts + `REFUSED` responses)
+  — Soup never ships verbatim hazardous content.
+
+### Changed
+- `soup completions` now introspects a cached base model's actual LoRA target
+  modules (config-only `AutoConfig` load, `local_files_only=True`, never networks
+  or raises) and falls back to the canonical default shape when the base isn't
+  cached locally.
+- `build_dag` exposes a `validate_build_source` helper (cwd-containment +
+  symlink rejection) for build-manifest source paths.
+
+## [0.71.0] - 2026-06-01
+
+### Changed
+- **Breaking — install split.** The heavy training stack (`torch`,
+  `transformers`, `peft`, `trl`, `datasets`, `bitsandbytes`, `accelerate`) moved
+  out of the core install into a new `[train]` extra. `pip install soup-cli` is
+  now a light CLI + data-tools install with **no PyTorch**; run
+  `pip install 'soup-cli[train]'` (or `[all]`) to fine-tune. Existing users who
+  train must reinstall with `[train]`. Version pins are unchanged.
+- Trimmed `README.md` to a ~238-line front door; the full feature reference now
+  lives under `docs/` (one topic page per area, indexed from the README).
+- Raised the pytest coverage gate from 50% to 77% (`--cov-fail-under=77`).
+- Migrated to a `src/` layout (`src/soup_cli/`) for cleaner packaging and to
+  stop tests accidentally importing the in-tree package.
+
+### Added
+- `[train]` and `[all]` optional-dependency extras (`[all]` pulls
+  `train`, `serve`, `ui`, `data`). `[dev]` self-references `[train]` so CI and
+  contributors still get the full stack from `pip install -e ".[dev]"`.
+- Friendly error mapping: a missing heavy dependency (`torch`, `transformers`,
+  `peft`, `trl`, `datasets`, `bitsandbytes`, `accelerate`) now surfaces
+  "Training needs the [train] extra. Run: pip install 'soup-cli[train]'".
+- `py.typed` marker (PEP 561) so downstream type checkers pick up Soup's inline
+  type hints.
+- `.pre-commit-config.yaml` with ruff (lint + format) and standard file-hygiene
+  hooks.
+- Lenient `mypy` configuration and a non-blocking `type-check` CI job.
+- This `CHANGELOG.md`.
+
+### Removed
+- The historical, per-version security-fix log that had grown inside
+  `SECURITY.md` (~220 KB). `SECURITY.md` is now a concise security policy; the
+  detailed hardening notes remain in git history and the GitHub Releases notes.
+
+[Unreleased]: https://github.com/MakazhanAlpamys/Soup/compare/v0.71.0...HEAD
+[0.71.0]: https://github.com/MakazhanAlpamys/Soup/compare/v0.70.0...v0.71.0

{soup_cli-0.71.0 → soup_cli-0.71.2}/CONTRIBUTING.md

@@ -31,6 +31,8 @@ This installs:
 - the full training stack — `[dev]` self-references `[train]`, so `torch`,
   `transformers`, `peft`, `trl`, `datasets`, `bitsandbytes`, `accelerate` are
   pulled in too (since v0.71.0 these are an opt-in extra, not core deps)
+- `cryptography` — `[dev]` also pulls it in (it's the `[sign]` extra) so the
+  ed25519 signing tests (`soup adapters sign` / `soup attest`) run in CI
 
 ### 3. Verify Setup
 
@@ -116,7 +118,7 @@ src/soup_cli/
   templates/          - 17 built-in soup.yaml templates (YAML + manifest.json) with load_template loader (v0.39.0, +bco v0.40.0)
   ui/                 - Web UI (FastAPI + HTML/JS SPA)
 
-tests/                - Test suite (268 files, 11824 tests)
+tests/                - Test suite (272 files, 12259 tests)
 examples/             - Real-world config examples and datasets
 ```
 

{soup_cli-0.71.0 → soup_cli-0.71.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: soup-cli
-Version: 0.71.0
+Version: 0.71.2
 Summary: Fine-tune LLMs in one command. No SSH, no config hell.
 Project-URL: Homepage, https://github.com/MakazhanAlpamys/Soup
 Project-URL: Repository, https://github.com/MakazhanAlpamys/Soup
@@ -51,6 +51,7 @@ Requires-Dist: deepspeed>=0.12.0; extra == 'deepspeed'
 Provides-Extra: dev
 Requires-Dist: accelerate>=0.25.0; extra == 'dev'
 Requires-Dist: bitsandbytes>=0.41.0; extra == 'dev'
+Requires-Dist: cryptography>=41.0.0; extra == 'dev'
 Requires-Dist: datasets>=2.14.0; extra == 'dev'
 Requires-Dist: httpx>=0.24.0; extra == 'dev'
 Requires-Dist: mypy>=1.8.0; extra == 'dev'
@@ -99,6 +100,8 @@ Provides-Extra: sglang
 Requires-Dist: fastapi>=0.104.0; extra == 'sglang'
 Requires-Dist: sglang>=0.2.0; extra == 'sglang'
 Requires-Dist: uvicorn>=0.24.0; extra == 'sglang'
+Provides-Extra: sign
+Requires-Dist: cryptography>=41.0.0; extra == 'sign'
 Provides-Extra: tensorrt
 Requires-Dist: tensorrt-llm>=0.9.0; extra == 'tensorrt'
 Provides-Extra: trackers
@@ -175,10 +178,19 @@ infrastructure instead of improving models. Soup fixes that.
 
 ## What's New
 
-**v0.71.0 — Lighter install.** The heavy training stack (PyTorch, Transformers, PEFT, TRL,
-datasets, bitsandbytes, accelerate) moved into a `[train]` extra. `pip install soup-cli` is now a
-light CLI + data-tools install with no PyTorch; `pip install 'soup-cli[train]'` adds everything you
-need to fine-tune. **Breaking:** existing users who train must reinstall with `[train]`.
+**v0.71.2 — Governance & supply-chain live.** Real signatures and supply-chain gates:
+
+- **ed25519 signing** — `soup adapters sign --backend ed25519 --key priv.pem` (or `--generate-key`)
+  produces a real detached signature over the adapter's Merkle root; `soup adapters verify
+  --public-key trusted.pem` does cryptographic authentication. Same for `soup attest emit
+  --sign ed25519` + the new `soup attest verify`. Install with `pip install soup-cli[sign]`.
+- **Anti-AI-Jacking namespace pin** — Hub model downloads now refuse a repo whose author silently
+  changed (or whose creation date jumped backward), the classic namespace-re-creation attack.
+- **License-conflict gate at merge** — `soup adapters merge` auto-detects each adapter's license
+  (from `adapter_config.json` / model card) and refuses incompatible combinations unless you pass
+  `--license-override <reason>` (logged to the audit trail).
+- **Backdoor-scan gate at merge** — refuses to merge any adapter that `soup adapters scan` flags
+  FAIL unless you pass `--allow-unscanned`.
 
 Full history: [CHANGELOG.md](CHANGELOG.md) &middot; [GitHub Releases](https://github.com/MakazhanAlpamys/Soup/releases).
 

{soup_cli-0.71.0 → soup_cli-0.71.2}/README.md

@@ -49,10 +49,19 @@ infrastructure instead of improving models. Soup fixes that.
 
 ## What's New
 
-**v0.71.0 — Lighter install.** The heavy training stack (PyTorch, Transformers, PEFT, TRL,
-datasets, bitsandbytes, accelerate) moved into a `[train]` extra. `pip install soup-cli` is now a
-light CLI + data-tools install with no PyTorch; `pip install 'soup-cli[train]'` adds everything you
-need to fine-tune. **Breaking:** existing users who train must reinstall with `[train]`.
+**v0.71.2 — Governance & supply-chain live.** Real signatures and supply-chain gates:
+
+- **ed25519 signing** — `soup adapters sign --backend ed25519 --key priv.pem` (or `--generate-key`)
+  produces a real detached signature over the adapter's Merkle root; `soup adapters verify
+  --public-key trusted.pem` does cryptographic authentication. Same for `soup attest emit
+  --sign ed25519` + the new `soup attest verify`. Install with `pip install soup-cli[sign]`.
+- **Anti-AI-Jacking namespace pin** — Hub model downloads now refuse a repo whose author silently
+  changed (or whose creation date jumped backward), the classic namespace-re-creation attack.
+- **License-conflict gate at merge** — `soup adapters merge` auto-detects each adapter's license
+  (from `adapter_config.json` / model card) and refuses incompatible combinations unless you pass
+  `--license-override <reason>` (logged to the audit trail).
+- **Backdoor-scan gate at merge** — refuses to merge any adapter that `soup adapters scan` flags
+  FAIL unless you pass `--allow-unscanned`.
 
 Full history: [CHANGELOG.md](CHANGELOG.md) &middot; [GitHub Releases](https://github.com/MakazhanAlpamys/Soup/releases).
 

{soup_cli-0.71.0 → soup_cli-0.71.2}/docs/adapters-and-governance.md

@@ -336,7 +336,20 @@ soup attest emit \
 
 Stages are a closed allowlist: `extract` / `train` / `eval` / `export` / `publish`.
 Subject SHA must be 64-hex (sha256). The default `--sign unsigned` backend ships now;
-Sigstore (OIDC-via-GitHub) and ed25519 air-gap signing arrive in v0.59.1.
+the **`ed25519` backend is live** (`pip install soup-cli[sign]`):
+
+```bash
+soup attest emit --stage train --subject adapter-v1 --sha aaaa...64hex \
+  --sign ed25519 --key signing.pem --output att.json   # writes att.json.sig
+soup attest verify att.json --signature att.json.sig                 # exit 0 valid
+soup attest verify att.json --signature att.json.sig --public-key trusted.pub
+```
+
+`verify` re-canonicalises the statement JSON (so it's platform/newline-independent)
+and checks the ed25519 signature — exit 3 on tamper, key mismatch, or a sidecar with
+no public key. A valid signature proves the signer *asserted* the statement; it does
+not re-verify the subject digest against an artifact. Sigstore keyless signing remains
+infra-blocked (needs an OIDC identity provider + Fulcio/Rekor network).
 
 
 ## EU AI Act Annex XI/XII Auto-Doc (`soup train --annex-xi`)
@@ -397,12 +410,29 @@ v0.57.0 `adapter_diff` loader so the on-disk surface stays single-source.
 
 Deterministic Merkle-root manifest over every file in the adapter dir
 (including nested `tokenizer/` / `processor/` subdirs). Tamper any file
-and `verify` fails. The `unsigned` backend ships live for offline tamper
-detection (the Merkle-root hash is the trust anchor); `sigstore` and
-`ed25519` backends raise `NotImplementedError` with v0.60.1 marker so CI
-pipelines can integrate the schema today. Signature persists as
-`.soup-signature.json` written atomically via the shared
-`atomic_write_text` helper. `--strict` mode exits 3 on any verify
+and `verify` fails. The `unsigned` backend gives offline tamper detection
+(the Merkle-root hash is the trust anchor). The **`ed25519` backend is live**
+(`pip install soup-cli[sign]`): it adds a real detached signature over the
+Merkle root for *authentication* — proof the signer holds the private key.
+
+```bash
+# generate a keypair + sign in one shot
+soup adapters sign ./adapter --backend ed25519 --generate-key signing.pem
+# or sign with an existing key (or set SOUP_SIGNING_KEY)
+soup adapters sign ./adapter --backend ed25519 --key signing.pem
+# self-consistency verify (embedded public key)
+soup adapters verify ./adapter
+# genuine authentication: require the signer's key match a trusted one
+soup adapters verify ./adapter --public-key trusted.pub
+```
+
+`verify` fails closed — any tamper, wrong/missing/unreadable key, or a
+signature from an untrusted key marks the adapter invalid. Signing keys and
+trusted public keys are symlink-rejected and size-capped but **not**
+cwd-contained (keys are secrets that live outside the project). Signature
+persists as `.soup-signature.json` (atomic write). `sigstore` keyless signing
+stays infra-blocked (needs an OIDC identity provider + Fulcio/Rekor network —
+it can't be honestly validated offline). `--strict` mode exits 3 on any verify
 failure (CI gate code distinct from generic errors).
 
 
@@ -428,9 +458,12 @@ bool rejected so callers can't smuggle a free-for-all bypass). Threat
 model: an attacker watches a popular repo, waits for the original owner
 to delete or expire it, then re-creates the same `owner/name` with
 malicious weights. Without this control, anyone with Soup pinned to that
-namespace silently pulls poison on the next run. Live wiring into
-`utils/hubs.download_repo` lands in v0.60.1; today the helpers are
-operator-callable via the Python API.
+namespace silently pulls poison on the next run. **The gate is wired into
+Hub model downloads** — it consults the pin before fetching and refuses a
+mismatch (raising before any weights land). It fails **open** when repo
+metadata can't be fetched (offline / rate-limited) so a transient hiccup
+never blocks a legitimate download. The pin store uses SQLite WAL + a
+cross-process file lock so concurrent fetches don't lose the trust anchor.
 
 
 ## License-Conflict Matrix at Merge
@@ -440,10 +473,17 @@ MIT / BSD / LGPL / MPL / GPL / AGPL / CC-BY / CC-BY-NC / Llama-2/3.x /
 Gemma / Qwen-research / Mistral-research / OpenRAIL / OpenAI-ToS /
 Anthropic-AUP. `soup adapters merge --license apache-2.0 --license
 cc-by-nc-4.0 -o merged` refuses (non-commercial cannot combine with
-permissive). To proceed past a flagged conflict, pass
-`--license-override "legal-cleared 2026-05-19 by alice"` (8-char min,
-4096-char max reason). The override reason surfaces in the merge panel;
-audit-log integration lands in v0.60.1.
+permissive). When you don't pass `--license`, the license is
+**auto-detected** from each adapter's `adapter_config.json` / `config.json`
+/ model-card frontmatter (HF `llama3.1`-style ids map to canonical) and the
+gate runs automatically when every adapter resolves to a known license. To
+proceed past a flagged conflict, pass `--license-override "legal-cleared
+2026-05-19 by alice"` (8-char min, 4096-char max reason) — the decision is
+**recorded to the audit log** for later legal review.
+
+Merge is additionally gated by the backdoor scanner: any input that
+`soup adapters scan` flags FAIL (or that can't be scanned) refuses the
+merge with exit 3 unless you pass `--allow-unscanned`.
 
 
 ## Airgap Bundle (`soup airgap-bundle`)

{soup_cli-0.71.0 → soup_cli-0.71.2}/docs/commands.md

@@ -56,6 +56,7 @@ soup serve --model <m> --structured-output regex --regex-pattern '...'  Regex-co
 soup serve --model <m> --dashboard            Live dashboard + /metrics endpoint
 soup serve --model <m> --trace --trace-endpoint http://localhost:4317  OpenTelemetry tracing
 soup serve --model <m> --trace-log ./serve.jsonl  Per-request JSONL log + rotation + secret redaction
+soup serve --model <m> --record-thumbs ./rl.db  Capture 👍/👎 feedback into local-RL SQLite + POST /v1/thumbs (transformers)
 POST /v1/adapters/activate/<name>             Hot-swap active LoRA adapter
 soup sweep --config soup.yaml --param lr=...  Hyperparameter search
 soup diff --model-a ./a --model-b ./b         Compare two models
@@ -150,10 +151,12 @@ soup serve --reasoning-parser deepseek-r1     Strip <think> blocks from response
 soup doctor [--nccl]                          Check environment (optionally check NCCL bandwidth)
 soup quickstart [--dry-run]                   Full demo
 soup adapters scan <adapter>                  Spectral backdoor scan (rank-1 dominance + outlier detection)
-soup adapters sign <adapter> [--backend X]    Compute Merkle-root manifest (.soup-signature.json)
-soup adapters verify <adapter> [--strict]     Verify manifest against current files
+soup adapters sign <adapter> [--backend unsigned|ed25519] [--key <pem>|--generate-key <pem>]  Merkle manifest + ed25519 sign
+soup adapters verify <adapter> [--strict] [--public-key <pem>]  Verify manifest + ed25519 signature
 soup adapters check-safetensors <adapter> [--strict]  Refuse pickle / PyTorch-classic weights
-soup adapters merge ... --license <id> --license-override <reason>  License-conflict gate
+soup adapters merge ... [--license <id>] [--license-override <reason>] [--allow-unscanned]  License + backdoor-scan gates (auto-detect license; scan FAIL refused)
+soup attest emit ... [--sign ed25519 --key <pem>] [-o att.json]  in-toto/SLSA-3 attestation (+ .sig sidecar)
+soup attest verify <statement> --signature <sig> [--public-key <pem>]  Verify ed25519 attestation signature
 soup airgap-bundle --model <m> --output <out.tar>  Signed tarball for data-diode transfer
 soup eval unlearning <run-id> --benchmark tofu|muse|wmdp  Forget Quality + Model Utility + PrivLeak verdict
 soup edit set --base <m> --method rome|memit|alphaedit --subject "..." --target "..."  Surgical knowledge edit (--plan-only available)
@@ -169,6 +172,7 @@ soup tunability --dataset <jsonl> [--candidates a,b,c]   Probe 8 candidate bases
 soup plan --config soup.yaml                             Pre-flight summary + write soup.tfstate
 soup apply --config soup.yaml [--dry-run]                Lock-and-execute; refuses on drift (exit 3)
 soup env lock | status | check                           Hermetic env lockfile + ABI drift detection (exit 3)
+soup env fix [--format uv-pip|requirements] [--output req.txt]  Render a reproducible install plan from soup-env.lock (print-only)
 soup completions bash | zsh | fish                       Shell completion script (sourceable via eval)
 soup license-advisor --target b2c|defense|embedded       Recommend license-clean base for deploy target
 soup license-advisor ... --license <id> --mau N          Per-license downstream-risk check (exit 3 on block)
@@ -182,6 +186,7 @@ soup adapters merge ... --strategy cmaes --eval <s> --budget 1h  CMA-ES evolutio
 soup adapters pr <title> --base-sha <hex> --adapter <path>  GitHub-shaped adapter PR Markdown / JSON (v0.67.0)
 soup adapters bisect <ckpt>... --eval-command "..."  Binary search over training history (v0.67.0)
 soup lock write --base-sha <h> --dataset-sha <h> --env-hash <h>  Write soup.lock (v0.67.0)
+soup lock write --base-sha <h> --dataset-sha <h> --env-lock soup-env.lock  Auto-derive --env-hash from soup-env.lock (v0.71.1)
 soup lock show / soup lock check              Show + drift-check (exit 3 on drift)
 soup compile <program.py> --eval <suite> [--optimizer mipro|gepa|textgrad|copro|bootstrap_fewshot]  DSPy / GEPA prompt-program compiler (v0.68.0)
 soup distill-prompt --traces <jsonl> --teacher <m> --student <m> --strategy sft|preference|kl  Distill prompt-heavy traces to small FT (v0.68.0)

{soup_cli-0.71.0 → soup_cli-0.71.2}/docs/evaluation.md

@@ -447,6 +447,8 @@ ensure_judge_calibrated(report)  # raises RuntimeError if not calibrated
 
 The report carries `position_bias` ∈ [-1, 1] (0 = no slot preference), a conformal abstention threshold from the score quantile, agreement-rate vs the oracle, and a `calibrated` bool. `ensure_judge_calibrated` refuses on missing report, low agreement, or extreme bias — so production scoring code can fail loud, not silent.
 
+Persist a calibration once and reuse it across runs (v0.71.1): `write_judge_calibration(report, "calib.json")` writes a cwd-contained JSON, and `load_judge_calibration("calib.json")` re-validates it on load (a corrupt or out-of-range field on disk is rejected, since it's the production-gate safety net). The artifact attaches to the registry under the new `judge_calibration` kind.
+
 **Behaviour battery** — pre/post diff on bundled safety / refusal / sycophancy probe sets:
 
 ```bash

{soup_cli-0.71.0 → soup_cli-0.71.2}/docs/training.md

@@ -117,7 +117,7 @@ training:
 soup eval unlearning <run-id> --benchmark tofu --evidence evidence.json --output report.json
 ```
 
-Three orthogonal axes: **Forget Quality** (pre/post forget-loss delta), **Model Utility** (retain-accuracy preserved), **PrivLeak** (membership-inference AUC distance from 0.5). Bundled TOFU mini-fixture; MUSE + WMDP loaders land in the next release.
+Three orthogonal axes: **Forget Quality** (pre/post forget-loss delta), **Model Utility** (retain-accuracy preserved), **PrivLeak** (membership-inference AUC distance from 0.5). Bundled mini-fixtures for all three benchmarks ship in the box (v0.71.1 added MUSE + WMDP alongside the existing TOFU set), so `--benchmark muse|wmdp` runs without supplying evidence. The WMDP forget-set probes ship **redacted** (placeholder prompts + `REFUSED` responses) — Soup never bundles verbatim hazardous-knowledge content.
 
 
 ## Continued Pre-training

{soup_cli-0.71.0 → soup_cli-0.71.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "soup-cli"
-version = "0.71.0"
+version = "0.71.2"
 description = "Fine-tune LLMs in one command. No SSH, no config hell."
 readme = "README.md"
 license = "Apache-2.0"
@@ -54,7 +54,7 @@ wandb = ["wandb>=0.15.0,<0.18.0"]
 # Self-references `[train]` so CI / contributors get the full training stack
 # (CI runs `pip install -e ".[dev]"`; without this every test would fail at
 # `import torch`).
-dev = ["soup-cli[train]", "pytest>=7.0", "ruff>=0.1.0", "pytest-cov>=4.0", "httpx>=0.24.0", "mypy>=1.8.0", "pre-commit>=3.5.0"]
+dev = ["soup-cli[train]", "cryptography>=41.0.0", "pytest>=7.0", "ruff>=0.1.0", "pytest-cov>=4.0", "httpx>=0.24.0", "mypy>=1.8.0", "pre-commit>=3.5.0"]
 ui = ["fastapi>=0.104.0", "uvicorn>=0.24.0"]
 serve = ["fastapi>=0.104.0", "uvicorn>=0.24.0"]
 serve-fast = ["vllm>=0.4.0", "fastapi>=0.104.0", "uvicorn>=0.24.0"]
@@ -85,6 +85,10 @@ mix = ["scikit-optimize>=0.9.0"]
 # presidio-analyzer (PII). Llama-Guard-3-1B is documented as a manual recipe
 # (license + ~600 MB weight blob too large to bundle by default).
 data-pro = ["langdetect>=1.0.9", "presidio-analyzer>=2.2.0"]
+# v0.71.2 #179/#185 — ed25519 detached signing for `soup attest` / `soup
+# adapters sign`. Pure-offline; Sigstore keyless (OIDC + Fulcio/Rekor network)
+# stays infra-blocked and is NOT bundled here.
+sign = ["cryptography>=41.0.0"]
 
 [project.scripts]
 soup = "soup_cli.cli:run"

{soup_cli-0.71.0 → soup_cli-0.71.2}/src/soup_cli/__init__.py

@@ -1,3 +1,3 @@
 """Soup CLI — Fine-tune LLMs in one command."""
 
-__version__ = "0.71.0"
+__version__ = "0.71.2"

{soup_cli-0.71.0 → soup_cli-0.71.2}/src/soup_cli/commands/adapters.py

@@ -371,7 +371,15 @@ def merge(
         None, "--license-override",
         help=(
             "Free-text justification (>=8 chars) to merge across a license "
-            "conflict. Logged for legal review."
+            "conflict. Logged to the audit log for legal review (v0.71.2)."
+        ),
+    ),
+    allow_unscanned: bool = typer.Option(
+        False, "--allow-unscanned",
+        help=(
+            "Skip the v0.71.2 backdoor-scan gate. By default `adapters merge` "
+            "refuses to merge an input whose `adapters scan` returns FAIL (or "
+            "that cannot be scanned)."
         ),
     ),
 ):
@@ -379,6 +387,8 @@ def merge(
     from soup_cli.utils.adapter_merge import SUPPORTED_STRATEGIES, merge_adapters
     from soup_cli.utils.license_matrix import (
         check_license_compat,
+        extract_license_from_adapter,
+        record_license_override,
         validate_license_override_reason,
     )
 
@@ -435,8 +445,44 @@ def merge(
         console.print(panel)
         return
 
-    # v0.60.0 Part E: license-conflict gate. Operators MUST declare a
-    # license per adapter (or pass --license-override <reason>).
+    # v0.71.2 #192 — backdoor-scan gate. Refuse to merge any input whose
+    # spectral scan returns FAIL (or that cannot be scanned at all) unless the
+    # operator passes --allow-unscanned. WARN is advisory-only. Runs AFTER the
+    # cmaes plan-only branch (which doesn't merge weights) so it gates only the
+    # strategies that actually write a merged adapter.
+    if not allow_unscanned:
+        from soup_cli.utils.adapter_scan import scan_adapter
+
+        for adapter_path in adapters:
+            try:
+                scan_report = scan_adapter(adapter_path)
+            except (FileNotFoundError, ValueError, TypeError, RuntimeError) as exc:
+                console.print(
+                    f"[red]Could not scan {escape(adapter_path)} "
+                    f"({escape(str(exc))}).[/]\n"
+                    "[dim]Pass --allow-unscanned to merge anyway.[/]"
+                )
+                raise typer.Exit(3) from exc
+            if scan_report.overall == "FAIL":
+                console.print(
+                    f"[red]Backdoor scan FAILED for {escape(adapter_path)}: "
+                    f"{escape(scan_report.summary)}[/]\n"
+                    "[dim]Pass --allow-unscanned to merge anyway "
+                    "(not recommended).[/]"
+                )
+                raise typer.Exit(3)
+            if scan_report.overall == "WARN":
+                console.print(
+                    f"[yellow]Backdoor scan WARN for {escape(adapter_path)}: "
+                    f"{escape(scan_report.summary)} — proceeding.[/]"
+                )
+
+    # v0.60.0 Part E: license-conflict gate. Operators may declare a license
+    # per adapter (--license, repeatable) OR rely on v0.71.2 #187
+    # auto-extraction from adapter_config.json / config.json / model-card
+    # frontmatter. On a conflict, --license-override <reason> proceeds and the
+    # decision is recorded to the audit log (#190).
+    gate_licenses: Optional[list[str]] = None
     if license_ids:
         if len(license_ids) != len(adapters):
             console.print(
@@ -444,8 +490,26 @@ def merge(
                 f"adapter count {len(adapters)}[/]"
             )
             raise typer.Exit(2)
+        gate_licenses = list(license_ids)
+    else:
+        # #187 — auto-detect. Only run the gate if EVERY adapter resolves to a
+        # known license; partial info would make the conflict check misleading.
+        extracted = [extract_license_from_adapter(a) for a in adapters]
+        if all(e is not None for e in extracted):
+            gate_licenses = [str(e) for e in extracted]
+            console.print(
+                "[dim]Auto-detected licenses: "
+                f"{escape(', '.join(gate_licenses))}[/]"
+            )
+        elif license_override is not None:
+            console.print(
+                "[yellow]--license-override given but licenses could not be "
+                "auto-detected for every adapter; no conflict gate triggered.[/]"
+            )
+
+    if gate_licenses is not None:
         try:
-            license_report = check_license_compat(license_ids)
+            license_report = check_license_compat(gate_licenses)
         except (TypeError, ValueError) as exc:
             console.print(f"[red]License check failed: {escape(str(exc))}[/]")
             raise typer.Exit(2) from exc
@@ -467,16 +531,13 @@ def merge(
                     f"[red]Invalid --license-override: {escape(str(exc))}[/]"
                 )
                 raise typer.Exit(2) from exc
+            # #190 — persist the override decision for legal review.
+            record_license_override(gate_licenses, cleared)
             console.print(
                 f"[yellow]License conflict overridden:[/] "
                 f"{escape(license_report.reason)}\n"
-                f"[dim]Reason: {escape(cleared)}[/]"
+                f"[dim]Reason: {escape(cleared)} (recorded to audit log)[/]"
             )
-    elif license_override is not None:
-        console.print(
-            "[yellow]--license-override given without --license declarations; "
-            "no conflict gate triggered.[/]"
-        )
 
     parsed_weights = None
     if weights:
@@ -762,19 +823,32 @@ def sign(
     adapter: str = typer.Argument(..., help="Path to adapter directory"),
     backend: str = typer.Option(
         "unsigned", "--backend",
-        help="Signing backend: unsigned | ed25519 | sigstore (v0.60.0 ships unsigned only)",
+        help="Signing backend: unsigned | ed25519 (sigstore is infra-blocked)",
+    ),
+    key: Optional[str] = typer.Option(
+        None, "--key",
+        help="ed25519 private-key PEM path (or set SOUP_SIGNING_KEY).",
+    ),
+    generate_key: Optional[str] = typer.Option(
+        None, "--generate-key",
+        help="Generate a fresh ed25519 keypair, persist the private key here "
+             "(PEM, 0600), and sign with it.",
     ),
 ):
-    """Compute manifest + write ``.soup-signature.json`` (v0.60.0).
+    """Compute manifest + write ``.soup-signature.json`` (v0.60.0, ed25519 v0.71.2).
 
-    Default backend is ``unsigned`` — provides offline tamper detection
-    via Merkle-root hash. Sigstore + ed25519 backends raise NotImplementedError
-    until v0.60.1.
+    ``unsigned`` (default) gives offline tamper detection via a Merkle-root
+    hash. ``ed25519`` (v0.71.2 #185) adds a real detached signature over that
+    root — pass ``--key <priv.pem>``, set ``SOUP_SIGNING_KEY``, or use
+    ``--generate-key <out.pem>``. ``sigstore`` keyless signing is infra-blocked
+    (needs an OIDC identity provider + Fulcio/Rekor network).
     """
     from soup_cli.utils.adapter_sign import sign_adapter
 
     try:
-        record = sign_adapter(adapter, backend=backend)
+        record = sign_adapter(
+            adapter, backend=backend, key_path=key, generate_key_path=generate_key
+        )
     except FileNotFoundError as exc:
         console.print(f"[red]{escape(str(exc))}[/]")
         raise typer.Exit(1) from exc
@@ -785,6 +859,12 @@ def sign(
         console.print(f"[red]{escape(str(exc))}[/]")
         raise typer.Exit(2) from exc
 
+    if generate_key and record.backend == "ed25519":
+        console.print(
+            f"[yellow]Generated ed25519 private key -> {escape(generate_key)} "
+            "(keep it secret; verify with the matching public key).[/]"
+        )
+
     console.print(
         Panel(
             f"Adapter:    [bold]{escape(record.manifest.adapter)}[/]\n"
@@ -804,8 +884,18 @@ def verify(
         False, "--strict",
         help="Exit 3 on any verification failure (CI-friendly)",
     ),
+    public_key: Optional[str] = typer.Option(
+        None, "--public-key",
+        help="Trusted ed25519 public-key PEM. When set, the embedded signing "
+             "key must match it (genuine authentication, not just consistency).",
+    ),
 ):
-    """Verify ``.soup-signature.json`` against current files (v0.60.0).
+    """Verify ``.soup-signature.json`` against current files (v0.60.0, ed25519 v0.71.2).
+
+    For ``ed25519``-signed adapters the detached signature is verified against
+    the embedded public key (self-consistency); pass ``--public-key
+    <trusted.pem>`` to additionally require the signer's key match a key you
+    trust out of band.
 
     Exit codes:
       0  signature present and matches
@@ -815,10 +905,9 @@ def verify(
     from soup_cli.utils.adapter_sign import verify_adapter
 
     try:
-        if strict:
-            report = verify_adapter(adapter, strict=True)
-        else:
-            report = verify_adapter(adapter, strict=False)
+        report = verify_adapter(
+            adapter, strict=strict, trusted_public_key=public_key
+        )
     except FileNotFoundError as exc:
         console.print(f"[red]{escape(str(exc))}[/]")
         raise typer.Exit(1) from exc