The engine blocker recorded here as of July 19, 2026 is resolved. The wasmi feasibility spike below was adopted the next day: ADR-0014 selected the wasmi Apple runtime profile, ADR-0015 governed a production Swift wasmi C ABI, and Spec 074 (Approved) now defines the resource-control certification conditions. packages/swift/TraverseEmbedder ships a production WasmiHostBridgeClient backed by TraverseSwiftHost — a released XCFramework wrapping the wasmi interpreter behind a narrow C ABI — that enforces host-owned artifact-size, memory, fuel-per-invocation, and I/O limits on every call. The earlier WasmKit path, which never exposed those controls, has been removed from the package entirely (Decision 96, #1469); WasmKit is not supported. The xcframework ships as versioned swift-host-v* GitHub release assets. The v0.15.0 asset is swift-host-v0.15.0. The current asset is its rebuild swift-host-v0.15.0-1 (same v0.15.0 workspace, plus the Spec 138 guest reject codes, #1692), and Package.swift on main pins that zip (#1695). The v0.15.0 tag's Package.swift still pointed at swift-host-v0.14.0-4. That published xcframework includes ExactModelHost for signed exact-ref execute (GitHub Release + SPM binary target). Apple hosts can opt in to a package's signed Core ML variant under the same policy, tolerance, and evidence rules; the default placement stays wasm-cpu. Evidence so far is macOS cargo test plus the Decision 113 iPhone spike. Governed-path iPhone evidence is still open (traverse#1630).
+ The engine blocker recorded here as of July 19, 2026 is resolved. The wasmi feasibility spike below was adopted the next day: ADR-0014 selected the wasmi Apple runtime profile, ADR-0015 governed a production Swift wasmi C ABI, and Spec 074 (Approved) now defines the resource-control certification conditions. packages/swift/TraverseEmbedder ships a production WasmiHostBridgeClient backed by TraverseSwiftHost — a released XCFramework wrapping the wasmi interpreter behind a narrow C ABI — that enforces host-owned artifact-size, memory, fuel-per-invocation, and I/O limits on every call. The earlier WasmKit path, which never exposed those controls, has been removed from the package entirely (Decision 96, #1469); WasmKit is not supported. The xcframework ships as versioned swift-host-v* GitHub release assets. The v0.15.0 asset is swift-host-v0.15.0. The current asset is its rebuild swift-host-v0.15.0-1 (same v0.15.0 workspace, plus the Spec 138 guest reject codes, #1692), and Package.swift on main pins that zip (#1695). The v0.15.0 tag's Package.swift still pointed at swift-host-v0.14.0-4. That published xcframework includes ExactModelHost for signed exact-ref execute (GitHub Release + SPM binary target). Apple hosts can opt in to a package's signed Core ML variant under the same policy, tolerance, and evidence rules; the default placement stays wasm-cpu. Evidence so far is macOS cargo test plus the Decision 113 iPhone spike. Governed-path iPhone evidence landed on main after v0.15.0 (traverse#1630): BirdNET on one iPhone 14 Pro Max at p95 141 ms per 3 s clip under [coreml, wasm-cpu], relying on the unreleased schema 2.3.0 score_transform (details).
Read the wasmi feasibility write-up →
diff --git a/src/pages/questions/can-traverse-run-models-on-a-gpu-or-neural-engine.astro b/src/pages/questions/can-traverse-run-models-on-a-gpu-or-neural-engine.astro
index 9b6f08f..b5f3359 100644
--- a/src/pages/questions/can-traverse-run-models-on-a-gpu-or-neural-engine.astro
+++ b/src/pages/questions/can-traverse-run-models-on-a-gpu-or-neural-engine.astro
@@ -9,12 +9,13 @@ const jsonLd = JSON.stringify({
name: 'Can Traverse run models on a GPU or the Apple Neural Engine?',
acceptedAnswer: {
'@type': 'Answer',
- text: 'Core ML is an opt-in placement on Apple hosts in Traverse v0.15.0. The default placement is still wasm-cpu inside the one shared runtime. A signed Core ML variant runs only when the host asks for it and the variant passes an on-device self-check against its conformance vector. Published evidence so far is macOS cargo test plus the Decision 113 iPhone spike. Governed-path iPhone evidence is still open (traverse#1630). There is no web, Android, or desktop GPU adapter. No host is Certified.',
+ text: 'Core ML is an opt-in placement on Apple hosts in Traverse v0.15.0. The default placement is still wasm-cpu inside the one shared runtime. A signed Core ML variant runs only when the host asks for it and the variant passes an on-device self-check against its conformance vector. Published-release evidence is macOS cargo test plus the Decision 113 iPhone spike. After v0.15.0, governed-path iPhone evidence landed on main (traverse#1630): BirdNET on one iPhone 14 Pro Max ran at p95 141 ms per 3 s clip under the policy [coreml, wasm-cpu], within tolerance of wasm-cpu. It relies on the unreleased schema 2.3.0 score_transform. The cpu_and_neural_engine setting failed its self-check and fell back to wasm-cpu. There is no web, Android, or desktop GPU adapter. No host is Certified.',
},
}],
});
const relatedLinks = [
+ { href: '/questions/how-fast-does-a-model-run-on-iphone-with-traverse.html', label: 'How fast does a model run on iPhone with Traverse?' },
{ href: '/questions/what-is-exact-model-host.html', label: 'What is ExactModelHost?' },
{ href: '/questions/what-is-exact-ref-model-execution.html', label: 'What is exact-ref model execution?' },
{ href: '/questions/which-hosts-run-signed-exact-ref-models.html', label: 'Which hosts run signed exact-ref models?' },
@@ -24,7 +25,7 @@ const relatedLinks = [
---
What the evidence is, and what it is not
- Published evidence so far is macOS cargo test plus the Decision 113 iPhone spike. Governed-path iPhone evidence is still open (traverse#1630). This page does not quote spike timings as product performance. No host is Certified under Spec 529.
+ For the published v0.15.0 release, the evidence is macOS cargo test plus the Decision 113 iPhone spike.
+ After the release, governed-path iPhone evidence landed on main (traverse#1630, evidence write-up). On one iPhone 14 Pro Max, BirdNET v2.4 ran under the policy [coreml, wasm-cpu] at p95 141 ms per 3 s clip with Core ML's default compute units, against about 10 s on wasm-cpu. Top-5 matched wasm-cpu on 21 of 21 clips. Two things to know:
+
+ - The Neural Engine-only setting did not qualify. With
cpu_and_neural_engine, the variant failed its on-device self-check, so the policy fell back to wasm-cpu, as designed (#1708).
+ - It is not reproducible on v0.15.0 alone. BirdNET outputs logits, so its variant needs the new
score_transform tolerance in manifest schema 2.3.0, which is on main and not released.
+
+ The full scope and the open follow-ups are on how fast does a model run on iPhone with Traverse? No host is Certified under Spec 529.
Why it is built this way
An accelerator is an implementation detail of the host, not a second runtime. The contract, the signed package, and discover → execute → trace stay the same. The adapter only runs a variant the package already signed, and the trace records which path produced the answer.
diff --git a/src/pages/questions/how-do-i-package-an-onnx-model-for-traverse.astro b/src/pages/questions/how-do-i-package-an-onnx-model-for-traverse.astro
index a4cf11c..6583f9e 100644
--- a/src/pages/questions/how-do-i-package-an-onnx-model-for-traverse.astro
+++ b/src/pages/questions/how-do-i-package-an-onnx-model-for-traverse.astro
@@ -9,7 +9,7 @@ const jsonLd = JSON.stringify({
name: 'How do I package my own ONNX model for Traverse?',
acceptedAnswer: {
'@type': 'Answer',
- text: 'Install the CLI with cargo install traverse-cli-rs --version =0.15.0 --locked (Rust 1.94 or newer; crates.io traverse-cli is an unrelated tool). Download the audited runner.wasm from the onnx-runner-v0.15.0 GitHub release and check its sha256, then run traverse-cli model package-onnx runner.wasm model.onnx model.package.json out/dir. Sign the manifest with a key kept outside the repo, verify, generate and check a conformance vector, and pin. The app then declares the pin and model_usage, and the host runs it under discover → execute → trace. Today the packager supports one input and one output tensor (traverse#1661).',
+ text: 'Install the CLI with cargo install traverse-cli-rs --version =0.15.0 --locked (Rust 1.94 or newer; crates.io traverse-cli is an unrelated tool). Download the audited runner.wasm from the onnx-runner-v0.15.0 GitHub release and check its sha256, then run traverse-cli model package-onnx runner.wasm model.onnx model.package.json out/dir. Sign the manifest with a key kept outside the repo, verify, generate and check a conformance vector, and pin. The app then declares the pin and model_usage, and the host runs it under discover → execute → trace. In 0.15.0 the packager supports one input and one output tensor. Multi-input, multi-output packaging for Hugging Face-style text encoders merged on main after the release (traverse#1661, PR #1704) and is not in a published release yet.',
},
}],
});
@@ -54,10 +54,10 @@ traverse-cli model pin out/my-model --json
Limits today
- - One input tensor and one output tensor. Most Hugging Face text encoders take several inputs, so they do not fit yet (traverse#1661).
+ - In 0.15.0, one input tensor and one output tensor. Most Hugging Face text encoders take several inputs (
input_ids, attention_mask), so they do not fit the published packager. Named multi-input, multi-output packaging merged on main after the release (traverse#1661, PR #1704). It is not in a release yet, and the rebuilt audited runner and a signed reference encoder package are still pending.
model verify in 0.15.0 always checks as non_commercial; --model-usage landed on main after the release (traverse#1686).- Traverse's own production signing-key custody is traverse#1567, still open. Your key is yours to manage.
- - This is the host connector path, not a catalog
model.execute capability, and not a Hugging Face integration. No host is Certified.
+ - This page is the host connector path, and it is not a Hugging Face integration. The registry now also lists a catalog
model.execute@1.0.0 shim over that same connector (its registry spec is still a draft). No host is Certified.
The full guide is docs/model-packaging-guide.md. It also covers adding an opt-in Core ML variant for Apple hosts.
diff --git a/src/pages/questions/how-fast-does-a-model-run-on-iphone-with-traverse.astro b/src/pages/questions/how-fast-does-a-model-run-on-iphone-with-traverse.astro
new file mode 100644
index 0000000..27bb505
--- /dev/null
+++ b/src/pages/questions/how-fast-does-a-model-run-on-iphone-with-traverse.astro
@@ -0,0 +1,70 @@
+---
+import QuestionLayout from '@layouts/QuestionLayout.astro';
+
+const jsonLd = JSON.stringify({
+ '@context': 'https://schema.org',
+ '@type': 'FAQPage',
+ mainEntity: [{
+ '@type': 'Question',
+ name: 'How fast does a model run on iPhone with Traverse?',
+ acceptedAnswer: {
+ '@type': 'Answer',
+ text: 'One measured case, on unreleased main: on an iPhone 14 Pro Max (iOS 26.6, Release build), BirdNET v2.4 running through the governed Swift ExactModelHost under the policy [coreml, wasm-cpu] took p95 141.3 ms per 3 s audio clip with Core ML default compute units, against p95 10.0 s on wasm-cpu. Top-5 labels matched wasm-cpu on 21 of 21 clips. The timing covers the whole governed call: policy, rights, placement, and evidence. The evidence is traverse#1630 (PR #1709, Oct 15, 2026). It relies on manifest schema 2.3.0 score_transform, which is not in v0.15.0. One device, one model, test-only signing key. No host is Certified.',
+ },
+ }],
+});
+
+const relatedLinks = [
+ { href: '/questions/can-traverse-run-models-on-a-gpu-or-neural-engine.html', label: 'Can Traverse run models on a GPU or the Apple Neural Engine?' },
+ { href: '/questions/what-is-exact-model-host.html', label: 'What is ExactModelHost?' },
+ { href: '/questions/how-do-i-package-an-onnx-model-for-traverse.html', label: 'How do I package my own ONNX model?' },
+ { href: '/questions/what-is-model-usage-in-traverse.html', label: 'What is model_usage?' },
+ { href: '/questions/is-production-model-signing-ready.html', label: 'Is production model signing ready?' },
+];
+---
+
+ Short answer: we have one measured case. On an iPhone 14 Pro Max, the BirdNET v2.4 bird-sound model ran through Traverse's governed path at p95 141 ms per 3 s audio clip on Core ML, against about 10 s on wasm-cpu. That evidence is on main, not in a published release yet (traverse#1630).
+
+ What was measured
+ The run used a Release build on iOS 26.6. The host was Swift ExactModelHost on TraverseSwiftHost.xcframework, with modelUsage: non_commercial and the execution policy [coreml, wasm-cpu]. The package was built with traverse-cli model package-onnx from the BirdNET v2.4 int8 ONNX model, plus a signed Core ML variant made with model convert-coreml. It ran on 21 three-second clips.
+ The timing wraps ExactModelHost.execute, so it is the whole governed call: policy, rights, placement, and evidence. It is not a raw Core ML prediction.
+
+
+ | Host Core ML setting | Placement the policy picked | Steady p95 per clip |
|---|
+
+ none (wasm-cpu with snapshot reuse) | wasm-cpu | 10.0 s |
+ all (default) | coreml | 141.3 ms |
+ cpu_and_gpu | coreml | 133.8 ms |
+ cpu_and_neural_engine | wasm-cpu (the variant failed its self-check) | 10.5 s |
+ cpu_only | the first call timed out at the 60 s deadline | none |
+
+
+
+ On Core ML, the top-5 labels matched the device's own wasm-cpu output on 21 of 21 clips, and the worst sigmoid score difference was 4.79×10⁻³, inside the 5×10⁻³ bar. The first call on the default setting took 6.9 s, because it compiles the variant on the device and runs the self-check. The raw numbers are in the evidence write-up.
+
+ Why the fallbacks matter
+ The Core ML variant only runs after it passes an on-device check against the package's own signed reference outputs. With the Neural Engine-only setting, it did not pass on this phone, so the call ran on wasm-cpu instead and the trace recorded why. A slower, correct answer beats a fast, wrong one. If nothing qualifies, the call fails closed with placement_unavailable.
+
+ What this does not show
+
+ - Not on v0.15.0. BirdNET outputs logits, so its variant needs the new
score_transform tolerance (manifest schema 2.3.0). That is on main and not released.
+ - One device, one model. This is not a benchmark across iPhones or models.
+ - Test-only signing key. Production key custody is traverse#1567, still open.
+ - Non-commercial weights. BirdNET's weights are CC BY-NC-SA 4.0, which is why the app declared
non_commercial. The weights and clips are not in the repository.
+ - No host is Certified under Spec 529, and there is no web, Android, or desktop GPU adapter.
+
+
+ Open follow-ups
+
+ - #1706: the
cpu_only first call runs out of time because compile and self-check count against the call deadline.
+ - #1707: the governed call adds about 120 ms over a raw prediction.
+ - #1708: record why the Neural Engine setting fails the self-check.
+
+
diff --git a/src/pages/questions/index.astro b/src/pages/questions/index.astro
index 75d599a..bd3a12b 100644
--- a/src/pages/questions/index.astro
+++ b/src/pages/questions/index.astro
@@ -59,6 +59,7 @@ const groups = [
['does-the-rust-embedder-use-the-same-runtime-wasm.html', 'Does the Rust embedder use the same runtime.wasm?'],
['what-is-exact-model-host.html', 'What is ExactModelHost?'],
['can-traverse-run-models-on-a-gpu-or-neural-engine.html', 'Can Traverse run models on a GPU or the Apple Neural Engine?'],
+ ['how-fast-does-a-model-run-on-iphone-with-traverse.html', 'How fast does a model run on iPhone with Traverse?'],
['how-does-traverse-execute-wasm.html', 'How does Traverse execute WASM?'],
['can-traverse-run-without-wasm.html', 'Can Traverse run without WASM?'],
['what-is-the-capability-registry.html', 'What is the capability registry?'],
@@ -69,6 +70,7 @@ const groups = [
['is-production-model-signing-ready.html', 'Is production model signing ready?'],
['what-is-model-usage-in-traverse.html', 'What is model_usage in Traverse, and why does my app fail with usage_undeclared?'],
['how-do-i-package-an-onnx-model-for-traverse.html', 'How do I package my own ONNX model for Traverse?'],
+ ['what-is-the-model-execute-catalog-capability.html', 'What is the model.execute catalog capability?'],
['what-happens-when-a-host-marks-a-model-package-revoked.html', 'What happens when a host marks a model package revoked or deprecated?'],
['can-kotlin-or-dotnet-embedders-run-exact-ref-yet.html', 'Can Kotlin or .NET embedders run exact-ref yet?'],
['what-is-digits-mlp.html', 'What is digits-mlp in Traverse?'],
diff --git a/src/pages/questions/what-does-traverse-not-claim-yet.astro b/src/pages/questions/what-does-traverse-not-claim-yet.astro
index b82b473..5001991 100644
--- a/src/pages/questions/what-does-traverse-not-claim-yet.astro
+++ b/src/pages/questions/what-does-traverse-not-claim-yet.astro
@@ -9,7 +9,7 @@ const jsonLd = JSON.stringify({
name: 'What does Traverse not claim yet?',
acceptedAnswer: {
'@type': 'Answer',
- text: 'Traverse does not claim a Python SDK; that any host is Certified under Spec 529; a web, Android, or desktop GPU adapter; governed-path iPhone Core ML evidence (traverse#1630 is still open); that production model-signing custody is finished (#1567 is still open); that it is a general agent-orchestration framework or web framework; cloud placement as a v0.1 goal; invented customers or production SLAs; or that approved-spec counts are the product pitch. Discover → execute → trace. One shared runtime.wasm. v0.15.0 runs signed exact-ref models on native, web, Swift swift-host-v0.15.0, Kotlin, and .NET, and model_usage is required. Swift, Kotlin, and .NET packages are published and pre-1.0. Shipped consumers today are JS/TS and Rust embedders plus MCP; Python is CLI-only.',
+ text: 'Traverse does not claim a Python SDK; that any host is Certified under Spec 529; a web, Android, or desktop GPU adapter; iPhone Core ML speed on a published release (the #1630 evidence is one device, on unreleased main); that production model-signing custody is finished (#1567 is still open); that it is a general agent-orchestration framework or web framework; cloud placement as a v0.1 goal; invented customers or production SLAs; or that approved-spec counts are the product pitch. Discover → execute → trace. One shared runtime.wasm. v0.15.0 runs signed exact-ref models on native, web, Swift swift-host-v0.15.0, Kotlin, and .NET, and model_usage is required. Swift, Kotlin, and .NET packages are published and pre-1.0. Shipped consumers today are JS/TS and Rust embedders plus MCP; Python is CLI-only.',
},
}],
});
@@ -38,7 +38,7 @@ const relatedLinks = [
- No Python SDK. Python shells out to
traverse-cli capability-package execute. See Does Traverse have a Python SDK?.
- Swift / Kotlin / .NET packages are published and pre-1.0 (Swift xcframework
swift-host-v0.15.0, Kotlin com.traverse-framework:traverse-embedder 0.15.0 on Maven Central, .NET TraverseEmbedder 0.15.0 on nuget.org). They are marked In progress. No host is Certified. All three published packages include ExactModelHost. model_usage is required.
- - Core ML is an opt-in Apple placement. Default stays
wasm-cpu. Governed-path iPhone evidence is still traverse#1630. There is no web, Android, or desktop GPU adapter.
+ - Core ML is an opt-in Apple placement. Default stays
wasm-cpu. Governed-path iPhone evidence landed on main after v0.15.0 (traverse#1630): BirdNET on one iPhone 14 Pro Max ran at p95 141 ms per 3 s clip under the policy [coreml, wasm-cpu] (details). It relies on the unreleased manifest schema 2.3.0 score_transform, so v0.15.0 alone does not reproduce it. There is no web, Android, or desktop GPU adapter.
- Production model-signing custody is still #1567.
digits-mlp-1.0.0 uses a test-only key.
- Edge is planned; cloud placement is an explicit non-goal for v0.1.
diff --git a/src/pages/questions/what-is-exact-ref-model-execution.astro b/src/pages/questions/what-is-exact-ref-model-execution.astro
index a5cd559..712935a 100644
--- a/src/pages/questions/what-is-exact-ref-model-execution.astro
+++ b/src/pages/questions/what-is-exact-ref-model-execution.astro
@@ -9,7 +9,7 @@ const jsonLd = JSON.stringify({
name: 'What is exact-ref model execution in Traverse?',
acceptedAnswer: {
'@type': 'Answer',
- text: 'Exact-ref model execution is how Traverse runs a WASM model package that an app has pinned by digest and signature — never by a naked URL. Discover → execute → trace. One shared runtime.wasm; embedders are clients. As of Traverse v0.15.0, signed exact-ref packages run on native Rust, the browser, Swift (swift-host-v0.15.0), Kotlin/Android (Maven Central 0.15.0), and .NET (nuget.org TraverseEmbedder 0.15.0). Every host enforces model rights: model_usage must be declared or the call fails closed. Third-party ONNX models can be packaged, signed, and verified with traverse-cli model. Apple hosts can opt in to a signed Core ML variant; the default placement stays wasm-cpu. Evidence so far is macOS cargo test plus the Decision 113 iPhone spike. Governed-path iPhone evidence is still open (traverse#1630). No host is Certified. digits-mlp-1.0.0 uses a test-only key (production custody is #1567). First landed in v0.12.0.',
+ text: 'Exact-ref model execution is how Traverse runs a WASM model package that an app has pinned by digest and signature — never by a naked URL. Discover → execute → trace. One shared runtime.wasm; embedders are clients. As of Traverse v0.15.0, signed exact-ref packages run on native Rust, the browser, Swift (swift-host-v0.15.0), Kotlin/Android (Maven Central 0.15.0), and .NET (nuget.org TraverseEmbedder 0.15.0). Every host enforces model rights: model_usage must be declared or the call fails closed. Third-party ONNX models can be packaged, signed, and verified with traverse-cli model. Apple hosts can opt in to a signed Core ML variant; the default placement stays wasm-cpu. Evidence so far is macOS cargo test plus the Decision 113 iPhone spike. Governed-path iPhone evidence landed on main after v0.15.0 (traverse#1630): BirdNET on one iPhone 14 Pro Max ran at p95 141 ms per 3 s clip under the policy [coreml, wasm-cpu]. It relies on the unreleased manifest schema 2.3.0 score_transform, so v0.15.0 alone does not reproduce it. No host is Certified. digits-mlp-1.0.0 uses a test-only key (production custody is #1567). First landed in v0.12.0.',
},
}],
});
@@ -59,9 +59,9 @@ const relatedLinks = [
.NET ExactModelHost in nuget.org TraverseEmbedder 0.15.0 (#1602, #1651 closed).
Third-party ONNX models can be packaged, signed, and verified with traverse-cli model. Guest ABI v3 snapshot reuse makes repeat inference faster: the host prepares once and restores that snapshot on later calls. This release pins traverse-registry at =0.28.0.
-
Core ML is opt-in. An Apple host can run a package's signed Core ML variant under the same policy, tolerance, and evidence rules. Without placements, every call stays on wasm-cpu. Published evidence so far is macOS cargo test plus the Decision 113 iPhone spike. Governed-path iPhone evidence is still open (traverse#1630). There is no web, Android, or desktop GPU adapter. No host is Certified under Spec 529.
+
Core ML is opt-in. An Apple host can run a package's signed Core ML variant under the same policy, tolerance, and evidence rules. Without placements, every call stays on wasm-cpu. Published evidence so far is macOS cargo test plus the Decision 113 iPhone spike. Governed-path iPhone evidence landed on main after v0.15.0 (traverse#1630): BirdNET on one iPhone 14 Pro Max ran at p95 141 ms per 3 s clip under the policy [coreml, wasm-cpu] (details). It relies on the unreleased manifest schema 2.3.0 score_transform, so v0.15.0 alone does not reproduce it. There is no web, Android, or desktop GPU adapter. No host is Certified under Spec 529.
digits-mlp-1.0.0 is still signed with the test-only key. v0.15.0 ships key-generation tooling and an opt-in signing workflow. Custody, rotation, and revocation remain #1567, which is still open.
What it is not
-
It is not “the model is in charge.” It is not Spec 045. It is not a guest model_invoke import. It is not a Python SDK. It is not permission to treat a URL as a model identity, to call any host Certified, or to quote iPhone Core ML timing beyond the Decision 113 spike.
+
It is not “the model is in charge.” It is not Spec 045. It is not a guest model_invoke import. It is not a Python SDK. It is not permission to treat a URL as a model identity, to call any host Certified, or to quote iPhone Core ML timing beyond the scope of the one-device #1630 evidence.
diff --git a/src/pages/questions/what-is-the-model-execute-catalog-capability.astro b/src/pages/questions/what-is-the-model-execute-catalog-capability.astro
new file mode 100644
index 0000000..214bbf8
--- /dev/null
+++ b/src/pages/questions/what-is-the-model-execute-catalog-capability.astro
@@ -0,0 +1,54 @@
+---
+import QuestionLayout from '@layouts/QuestionLayout.astro';
+
+const jsonLd = JSON.stringify({
+ '@context': 'https://schema.org',
+ '@type': 'FAQPage',
+ mainEntity: [{
+ '@type': 'Question',
+ name: 'What is the model.execute catalog capability?',
+ acceptedAnswer: {
+ '@type': 'Answer',
+ text: 'model.execute@1.0.0 is a capability in the Traverse registry catalog (published Oct 15, 2026, registry#639, index-v407) that lets agents and apps find governed model execution through discover → execute → trace. It is a thin shim over the host connector traverse.model-runtime: the caller supplies an exact-ref model pin (model_id, version, digest), a host-staged input_ref, model_usage (commercial or non_commercial), and a trust_root of allowed signer key ids. The capability checks those inputs, dispatches through the mediated connector, and returns the host model_evidence or a fail-closed Spec 138 reason unchanged. It does not fetch models, hold keys, or pick a model. It pins traverse.model-runtime 2.3.0, which is on Traverse main and not in the published v0.15.0 hosts, and its registry spec (027) is still a draft.',
+ },
+ }],
+});
+
+const relatedLinks = [
+ { href: '/questions/what-is-exact-ref-model-execution.html', label: 'What is exact-ref model execution?' },
+ { href: '/questions/what-is-exact-model-host.html', label: 'What is ExactModelHost?' },
+ { href: '/questions/what-is-model-usage-in-traverse.html', label: 'What is model_usage?' },
+ { href: '/questions/what-is-the-capability-registry.html', label: 'What is the capability registry?' },
+ { href: '/questions/how-do-ai-agents-discover-capabilities.html', label: 'How do AI agents discover capabilities?' },
+];
+---
+
+ Short answer: model.execute@1.0.0 is a capability in the Traverse registry catalog, published on October 15, 2026 (registry#639). It makes governed model execution something an agent or app can discover, then execute and trace like any other capability. It does not run models itself. It forwards a checked request to the host's model connector.
+
+ What goes in and what comes out
+
+ - An exact pin.
model_id, version, and digest. No URL, no "latest".
+ - A staged input. The host stages the input bytes and passes an
input_ref handle.
+ - A usage declaration.
model_usage is commercial or non_commercial. Leave it out and the call fails with usage_undeclared.
+ - A trust root. A non-empty list of allowed signer key ids. An empty list fails with
key_untrusted before anything is dispatched.
+
+ On success, the output carries the host's model_evidence. On failure, the host's own reason comes back unchanged: digest_mismatch, key_untrusted, signature_invalid, rights_mismatch, rights_policy_denied, usage_undeclared, package_revoked, or model_unavailable.
+
+ How it relates to ExactModelHost
+ The work still happens in the host connector, traverse.model-runtime, which is what ExactModelHost implements on each host. The catalog capability is a shim in front of it, called through the runtime's mediated connector path. It does not copy the connector's schemas, it does not fetch from Hugging Face, it holds no signing keys, and it never chooses a model for you. The caller supplies the pin.
+
+ What is not true yet
+
+ - It needs an unreleased connector version. The contract pins
traverse.model-runtime 2.3.0. That version is on Traverse main. The published v0.15.0 hosts carry 2.2.0.
+ - Its spec is a draft. Registry spec
027-catalog-model-execute is in draft_specs, waiting for owner approval.
+ - No published-release demo yet. A Browser, Node, and native demo of the catalog capability on a published Traverse release is still an open item. The reference package for that demo is
traverse.digits-onnx@1.0.0 from the Traverse fixtures, signed with a test-only key (traverse#1567).
+ - No host is Certified under Spec 529.
+
+
diff --git a/src/pages/questions/which-hosts-run-signed-exact-ref-models.astro b/src/pages/questions/which-hosts-run-signed-exact-ref-models.astro
index 01bf8ad..e01189c 100644
--- a/src/pages/questions/which-hosts-run-signed-exact-ref-models.astro
+++ b/src/pages/questions/which-hosts-run-signed-exact-ref-models.astro
@@ -9,7 +9,7 @@ const jsonLd = JSON.stringify({
name: 'Which hosts run signed exact-ref models in Traverse?',
acceptedAnswer: {
'@type': 'Answer',
- text: 'Discover → execute → trace. One shared runtime.wasm; embedders are clients. As of Traverse v0.15.0, published exact-ref execute is native Rust, traverse-embedder-web@0.15.0, Swift ExactModelHost on swift-host-v0.15.0, Kotlin ExactModelHost in Maven Central com.traverse-framework:traverse-embedder 0.15.0, and .NET ExactModelHost in nuget.org TraverseEmbedder 0.15.0. Every host enforces model_usage. Apple hosts can opt in to a signed Core ML variant; default placement stays wasm-cpu. Governed-path iPhone evidence is traverse#1630, still open. digits-mlp-1.0.0 uses a test-only key; production custody is #1567. No host is Certified.',
+ text: 'Discover → execute → trace. One shared runtime.wasm; embedders are clients. As of Traverse v0.15.0, published exact-ref execute is native Rust, traverse-embedder-web@0.15.0, Swift ExactModelHost on swift-host-v0.15.0, Kotlin ExactModelHost in Maven Central com.traverse-framework:traverse-embedder 0.15.0, and .NET ExactModelHost in nuget.org TraverseEmbedder 0.15.0. Every host enforces model_usage. Apple hosts can opt in to a signed Core ML variant; default placement stays wasm-cpu. Governed-path iPhone evidence landed on main after v0.15.0 (traverse#1630): BirdNET on one iPhone 14 Pro Max ran at p95 141 ms per 3 s clip under the policy [coreml, wasm-cpu]. It relies on the unreleased manifest schema 2.3.0 score_transform, so v0.15.0 alone does not reproduce it. digits-mlp-1.0.0 uses a test-only key; production custody is #1567. No host is Certified.',
},
}],
});
@@ -46,7 +46,7 @@ const relatedLinks = [
Rights, ONNX, and Core ML
-
Every host enforces model rights. Declaring model_usage is breaking: omit it and the call fails closed with usage_undeclared. Third-party ONNX models can be packaged, signed, and verified with traverse-cli model. Apple hosts can opt in to a signed Core ML variant; the default placement stays wasm-cpu. Evidence so far is macOS cargo test plus the Decision 113 iPhone spike. Governed-path iPhone evidence is traverse#1630, still open.
+
Every host enforces model rights. Declaring model_usage is breaking: omit it and the call fails closed with usage_undeclared. Third-party ONNX models can be packaged, signed, and verified with traverse-cli model. Apple hosts can opt in to a signed Core ML variant; the default placement stays wasm-cpu. Evidence so far is macOS cargo test plus the Decision 113 iPhone spike. Governed-path iPhone evidence landed on main after v0.15.0 (traverse#1630): BirdNET on one iPhone 14 Pro Max ran at p95 141 ms per 3 s clip under the policy [coreml, wasm-cpu] (details). It relies on the unreleased manifest schema 2.3.0 score_transform, so v0.15.0 alone does not reproduce it.
Signing honesty
Packages use schema 2.0.0 and later, plus detached Ed25519 model.sig.json. Host-owned trust roots gate register_package / registerPackage. The first trained package digits-mlp-1.0.0 is signed with a test-only key. Production custody, rotation, and revocation are still #1567 — see Is production model signing ready?.
diff --git a/src/pages/what-is-real-today.astro b/src/pages/what-is-real-today.astro
index c3b0825..e6da8a1 100644
--- a/src/pages/what-is-real-today.astro
+++ b/src/pages/what-is-real-today.astro
@@ -129,7 +129,7 @@ const _body = `