docs(blog): catalog model.execute weekly demo (2026-10-16)

public/llms.txt

@@ -24,10 +24,11 @@ Current packages: crates.io Traverse at 0.15.0; npm `traverse-embedder-web@0.15.
 - [What is one shared runtime.wasm?](https://traverse-framework.com/questions/what-is-one-shared-runtime-wasm.html): embedders are clients; honest consumer list.
 - [Does the Rust embedder use the same runtime.wasm?](https://traverse-framework.com/questions/does-the-rust-embedder-use-the-same-runtime-wasm.html): discover → execute → trace on one shared runtime contract/ABI; web `traverse-embedder-web@0.15.0` loads the bundle's digest-checked `runtime/runtime.wasm`; Rust `traverse-embedder@0.15.0` links `traverse-runtime` natively and ships no separate runtime-WASM artifact; capability WASM still targets that host ABI; hosts are clients (UI + I/O); JS/TS + Rust + MCP published; Python via CLI only (no Python SDK); Swift/Kotlin/.NET published pre-1.0, not Certified under Spec 529; published 0.15.0 Maven/NuGet include ExactModelHost. Narrative: [One shared runtime. Not one shared .wasm file on every host.](https://traverse-framework.com/blog/one-shared-runtime-two-loading-paths.html) (that post is a v0.14.0 snapshot).
 - [The agent freestyled a $2.4M wire. The runtime said no.](https://traverse-framework.com/blog/agent-freestyle-blocked.html): project direction in one scene — agent proposes, runtime decides (deny + trace).
+- [An agent picks a model off the shelf. The contract still decides.](https://traverse-framework.com/blog/catalog-model-execute.html): v0.15.0 weekly demo — catalog `model/model.execute@1.0.0` (registry#639) runs a signed ONNX package of `onnxmodelzoo/mnist-12` (pin `d820ea39…`) on Browser, Node and Native; 14 scenarios byte-identical (fingerprint `12fea82f…c9d9`), predictions 7, 2, 1, 0; agent freestyle fails closed identically (`usage_undeclared`, `key_untrusted`, `pin_mismatch`, `digest_mismatch`, `package_revoked`, `connector_unavailable`). Native (`traverse-runtime` `run_bytes_with_mediated_connectors` + `ExactModelHostConnector`) is the product path; Browser/Node use ~55 lines of labelled demo glue; browser `BundleEmbedder` + `runtime.wasm` fails on missing `connector_invoke` import (traverse#1719). Test-only key (prod signing #1567). Extra input fields not yet rejected (#1671, main only). Model came from the ONNX model zoo on Hugging Face; no HF integration.
 - [Agent speaks MCP. Exact pin kills the freestyle.](https://traverse-framework.com/blog/agent-mcp-exact-ref.html): v0.14.0 weekly demo — an agent calls MCP-shaped tools (façade over `ExactModelBrowserHost` under Node, not the Mode A `traverse-mcp` binary) against the signed `digits-mlp-1.0.0` package; Browser + Node bit-identical; tamper → `digest_mismatch`, empty trust → `key_untrusted`, rights lie → `rights_mismatch`; test-only key (prod signing #1567). Not catalog `model.execute`. Not Hugging Face.
 - [Signed model. Exact pin. Bit-identical hosts.](https://traverse-framework.com/blog/signed-exact-ref-digits.html): v0.14.0 weekly demo — signed `digits-mlp-1.0.0` exact-ref package, same bytes on Browser + Node (`ExactModelBrowserHost`); tamper → `digest_mismatch`; test-only key (prod signing #1567). Not catalog `model.execute`. Not Hugging Face.
 - [Same WASM. Browser and Node match. Agent still can’t freestyle.](https://traverse-framework.com/blog/same-wasm-multi-host.html): v0.13.0 multi-host — identical `core.authorize@1.2.0` bytes on Browser + Node; agent treasury cheat still denied.
-- Weekly demos (public write-ups; repo still private): [agent MCP exact-ref](https://traverse-framework.com/blog/agent-mcp-exact-ref.html) · [signed exact-ref digits](https://traverse-framework.com/blog/signed-exact-ref-digits.html) · [same-wasm multi-host](https://traverse-framework.com/blog/same-wasm-multi-host.html) · [agent freestyle → blocked](https://traverse-framework.com/blog/agent-freestyle-blocked.html) · [How do I run the deny demo?](https://traverse-framework.com/questions/how-do-i-run-the-agent-blocked-weekly-demo.html). Note: `traverse-framework/weekly-demos` is **not publicly cloneable yet** (tracked in [.github#30](https://github.com/traverse-framework/.github/issues/30)) — prefer the blogs until that lands. Access-only tree for this week: `weekly-demos/2026-10-09-agent-mcp-exact-ref`.
+- Weekly demos (public write-ups; repo still private): [catalog model.execute](https://traverse-framework.com/blog/catalog-model-execute.html) · [agent MCP exact-ref](https://traverse-framework.com/blog/agent-mcp-exact-ref.html) · [signed exact-ref digits](https://traverse-framework.com/blog/signed-exact-ref-digits.html) · [same-wasm multi-host](https://traverse-framework.com/blog/same-wasm-multi-host.html) · [agent freestyle → blocked](https://traverse-framework.com/blog/agent-freestyle-blocked.html) · [How do I run the deny demo?](https://traverse-framework.com/questions/how-do-i-run-the-agent-blocked-weekly-demo.html). Note: `traverse-framework/weekly-demos` is **not publicly cloneable yet** (tracked in [.github#30](https://github.com/traverse-framework/.github/issues/30)) — prefer the blogs until that lands. Access-only tree for this week: `weekly-demos/2026-10-16-catalog-model-execute`.
 - [Platforms](https://traverse-framework.com/platforms.html): native + browser shipped; Swift/Kotlin/.NET published, pre-1.0, In progress (not Certified); edge planned; cloud non-goal.
 
 ## Start here
@@ -40,7 +41,7 @@ Current packages: crates.io Traverse at 0.15.0; npm `traverse-embedder-web@0.15.
 
 ## Building with an agent
 
-- **Direction (same as Required reading above):** [agent MCP exact-ref](https://traverse-framework.com/blog/agent-mcp-exact-ref.html) · [signed exact-ref digits](https://traverse-framework.com/blog/signed-exact-ref-digits.html) · [same-wasm multi-host](https://traverse-framework.com/blog/same-wasm-multi-host.html) · [deny demo blog](https://traverse-framework.com/blog/agent-freestyle-blocked.html) · [what-is-real-today](https://traverse-framework.com/what-is-real-today.html) · [run the deny demo (blog-first; weekly-demos not public yet)](https://traverse-framework.com/questions/how-do-i-run-the-agent-blocked-weekly-demo.html).
+- **Direction (same as Required reading above):** [catalog model.execute](https://traverse-framework.com/blog/catalog-model-execute.html) · [agent MCP exact-ref](https://traverse-framework.com/blog/agent-mcp-exact-ref.html) · [signed exact-ref digits](https://traverse-framework.com/blog/signed-exact-ref-digits.html) · [same-wasm multi-host](https://traverse-framework.com/blog/same-wasm-multi-host.html) · [deny demo blog](https://traverse-framework.com/blog/agent-freestyle-blocked.html) · [what-is-real-today](https://traverse-framework.com/what-is-real-today.html) · [run the deny demo (blog-first; weekly-demos not public yet)](https://traverse-framework.com/questions/how-do-i-run-the-agent-blocked-weekly-demo.html).
 - [For AI Agents](https://traverse-framework.com/agents.html): the real MCP tool list (ten commands: describe_server, list_content_groups, describe_content_group, list_entrypoints, search_capabilities, describe_entrypoint, validate_entrypoint, execute_entrypoint, render_execution_report, shutdown), the discover-inspect-execute-trace flow, and the honest limits (stdio is the packaged bootstrap today; in-process library functions exist on traverse-mcp, but there is no separate HTTP MCP listener as a packaged product).
 - [Is the agent MCP exact-ref demo the same as traverse-mcp?](https://traverse-framework.com/questions/is-the-agent-mcp-demo-the-same-as-traverse-mcp.html): no. The Oct 9 weekly demo is an in-process MCP-shaped JSON-RPC façade over `ExactModelBrowserHost` under Node, not the checksum-pinned Mode A `traverse-mcp` binary. Mode A `traverse-mcp` is the published stdio MCP server for discover/inspect/execute of registry capabilities. Checksum-pinned Mode A binaries (#1653): packaging workflow merged on main (#1701); first non-Latest `traverse-mcp-v*` release with `SHA256SUMS` comes with the next product tag, none published yet. Write-up: [Agent speaks MCP](https://traverse-framework.com/blog/agent-mcp-exact-ref.html).
 - [traverse-framework/claude-skills](https://github.com/traverse-framework/claude-skills): Claude Skills for building apps with Traverse — starting with `traverse-capability-author` (plus extractor and workflow-planner), which checks the registry before authoring, produces contract + WASM, and validates against the real traverse-cli — including this platform's current execution limitations.