Why this environment matters
A model registry is a release authority: downstream systems may trust an artifact because the registry says it was evaluated and approved. The vulnerable handoff is between uploading model files and signing an identity that production will accept. This concept prevents an upload or evaluation worker from automatically becoming that authority.
The security challenge
A release may depend on weights, tokenizer files, configuration and preprocessing code. Approving only a convenient filename leaves room for one component to change while the release still appears to have the same name. A proposed manifest would identify the complete bundle and the evaluation record that applies to it.
How the capsule model could help
NØNOS could run ingestion and evaluation in separate capsules, with neither holding the release signing key. A signing broker would accept an independently authorised manifest and return a signature over that specific identity. Deployment clients would need to check the same identity when fetching and loading the bundle. A model that passes a laboratory evaluation may still be unsuitable for a production workload. The promotion process would therefore record the intended use, approved environment and applicable evaluation, rather than treating a signature as a universal safety label. Superseded or withdrawn releases would remain distinguishable from current ones. Recovery should preserve the approval history and key lifecycle, not just restore a directory of files. A clean runtime cannot recover a lost signing key or determine whether a previously trusted key has been misused. Those responsibilities belong to the surrounding key-management and release process.
Deployment requirements
Model accuracy, bias and suitability require separate evaluation. Cryptographic release integrity can help identify what was approved, but it cannot establish that the approved model will behave acceptably in every application. Evaluation requirements: Change a tokenizer after evaluation and verify that the complete bundle identity no longer matches the approved release. Attempt production promotion using an ingestion-worker credential and confirm that it lacks signing authority. Withdraw a release and check that consumers following the documented policy can distinguish withdrawal from temporary download failure.
Current public-beta limitations, hardware support and application availability must be assessed before any pilot. Neither this use case nor an industry source establishes NONOS certification or a current customer deployment.
Bind approval to all the artifacts that define a model
A release may depend on weights, tokenizer files, configuration and preprocessing code. Approving only a convenient filename leaves room for one component to change while the release still appears to have the same name. A proposed manifest would identify the complete bundle and the evaluation record that applies to it.
NØNOS could run ingestion and evaluation in separate capsules, with neither holding the release signing key. A signing broker would accept an independently authorised manifest and return a signature over that specific identity. Deployment clients would need to check the same identity when fetching and loading the bundle.
Promotion is a controlled state change
A model that passes a laboratory evaluation may still be unsuitable for a production workload. The promotion process would therefore record the intended use, approved environment and applicable evaluation, rather than treating a signature as a universal safety label. Superseded or withdrawn releases would remain distinguishable from current ones.
Recovery should preserve the approval history and key lifecycle, not just restore a directory of files. A clean runtime cannot recover a lost signing key or determine whether a previously trusted key has been misused. Those responsibilities belong to the surrounding key-management and release process.
Who could buy or integrate it?
- Enterprise ML platform teams procuring controlled model-release infrastructure
- Model registry vendors integrating signing and approval services
- Regulated AI operators buying managed artifact governance and deployment controls
Industry examples: Databricks, Amazon Web Services. These are research prospects, not represented as NONOS customers, partners or endorsers.