candle-annotator/openspec/changes/code-review-fix
Marko Djordjevic ff15adc847 feat: add SHA256 model integrity check before joblib.load()
Add verify_model_checksum() that validates model files against a
models/checksums.sha256 manifest before loading. Fails open when
manifest is missing or file not listed (backward compat), raises
HTTP 500 on hash mismatch. Created empty manifest placeholder.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-02-18 11:25:14 +01:00
..
specs bind: MLflow port to 127.0.0.1:5000:5000 in docker-compose.yml 2026-02-18 10:58:11 +01:00
.openspec.yaml bind: MLflow port to 127.0.0.1:5000:5000 in docker-compose.yml 2026-02-18 10:58:11 +01:00
design.md bind: MLflow port to 127.0.0.1:5000:5000 in docker-compose.yml 2026-02-18 10:58:11 +01:00
proposal.md bind: MLflow port to 127.0.0.1:5000:5000 in docker-compose.yml 2026-02-18 10:58:11 +01:00
tasks.md feat: add SHA256 model integrity check before joblib.load() 2026-02-18 11:25:14 +01:00