Limonata verified public weights cache — Linux 0.5.6 / Windows 0.4.1

This shared Go module sits between the encrypted coordinator WebSocket and
loopback llama.cpp RPC TCP connection. It requires b10107 / RPC 4.0.3. Native
--cache stays disabled. The native RPC server never opens cache files. On Linux, its sandbox also
blocks access to the parent-owned cache directory. Windows retains its existing
trusted-coordinator/Job Object security model; this is not filesystem isolation.

The embedded catalog authorizes exact public tensor bytes by SHA256 and size.
FNV64 is only a lookup key to match the upstream HASH request, never a security
check. The generator first verifies each complete GGUF against its pinned hash.
Only complete raw GGUF tensors in the catalog are eligible, with a 256 MiB bound
per live verification buffer. Unknown, larger, partial and activation tensors
pass through normally. Incoming candidate bytes stay in RAM until SHA256 matches;
only verified public bytes can reach a temporary or final disk file. Atomic
rename and fsync protect interrupted writes. Each hit is read and SHA256-verified
into bounded RAM before replay, preventing changes between verification and use.

Cache hits translate HASH to local SET_TENSOR, then send a one-byte hit reply.
All other commands preserve order and framing; SET_TENSOR, GRAPH_COMPUTE and
GRAPH_RECOMPUTE have no response in this pinned version. HELLO is restricted to
TCP on both sides. RPC request/response sizes are bounded at 2 GiB. This is not
a substitute for coordinator authentication or GPU process isolation.

Default disk quota 32 GiB; 2 GiB free-space reserve; oldest-used entries evicted.
A process lock prevents two apps managing one cache concurrently. Cache failures
leave normal model transfer available. Temporary files contain public bytes only.
The dedicated directory must live on a local filesystem supporting ordinary
files, atomic rename, permissions and file locking. Disabling caching preserves
files; stop the provider before removing only the dedicated weights directory.
There is no identity or conversation data in that directory.

The Qwen3-32B Q4_K_M catalog contains 322 large tensors. The 256 MiB memory bound
allows 18,257,018,880 bytes (92.38% of the GGUF); actual allocation and cache quota
change savings. Qwen2.5-1.5B is included for real integration tests. Additional
models need a newly generated and shipped catalog. No unverified remote catalog
can change the allowlist at runtime.

Regenerate from the repository ai/weightcache directory, with Go 1.25+:
  go run ./cmd/catalog \
    ../.runtime/collective-model/Qwen3-32B-Q4_K_M.gguf \
    efd971561896866f0e910cce52761ca77b1b138090c7f15fe284676d57d1f689 \
    ../.runtime/qwen2.5-1.5b-q4_k_m.gguf \
    6a1a2eb6d15622bf3c96857206351ba97e1af16c30d7a74ee38970e434e9407e \
    > catalog.next.json
Only replace catalog.json after that command exits successfully. The generator
supports GGUF v3 F32/F16/Q4_K/Q6_K and rejects unsupported shapes/types.

Validation: Go race/vet tests; framed WebSocket tests in each client; real
weight-cache.integration.py with two CPU RPC backends and two complete loads
and completions. Its result is not a GPU or WAN latency benchmark. Native CUDA
and Vulkan binaries are unchanged. Real Runpod/Windows cache hit rates remain
to be measured by the operator after installing these clients.
