Access to intelligence shouldn’t be revocable.

model-preserve keygen --key owner.pem --trust-out owner-trust.json

model-preserve pack --recipe recipe.json --member weights=/path/to/model \
  --member notices=/path/to/notices --store /path/to/preserved --key owner.pem

model-preserve verify MANIFEST_SHA256 --trust bundle-trust.json --store ./preserved

model-preserve kit-export MANIFEST_SHA256 --store archive --trust owner-trust.json --output model.foxkit
model-preserve kit-inspect --kit model.foxkit

model-preserve kit-import --kit model.foxkit \
  --expected-manifest-id MANIFEST_SHA256 \
  --trust owner-trust.json --output recovered-archive
model-preserve verify MANIFEST_SHA256 --store recovered-archive \
  --trust recovered-archive/kit-trust.json

model-preserve restore MANIFEST_SHA256 --trust bundle-trust.json \
  --store ./preserved --output ./restored-model

Commands are copied from the project README. Replace MANIFEST_SHA256, the paths and the trust files with your own.

The people who carry copies and the people who need them face different risks. We won’t blur the two.

• Receive-only or offline
• Serving is opt-in

Whoever you connect to, mirror or peer, can see your network address. Before serving anything publicly, check that each model’s license allows it and keep its notices.

• Does this replace Hugging Face, ModelScope, Civitai or Kaggle?

  No. Hubs are where models are published, discussed and discovered. Sovereign starts after you download: it keeps a complete, signed copy of the exact revision you got, with its original repository and revision recorded, so your access doesn’t depend on that page staying the same.

• How is it different from git clone, Git LFS, Xet or huggingface-cli download?

  Those fetch files from one origin. Sovereign records exactly which files a working copy needs, signs that list, checks every byte, and lets any mirror, disk or peer serve it without changing what it is.

• Does it work with Ollama, llama.cpp, LM Studio, vLLM or MLX?

  Yes, at the level of files. Sovereign is format-agnostic: GGUF, safetensors, MLX and anything else are preserved byte for byte and restored as ordinary folders for your runtime to load. It doesn’t convert weights, install engines or run model code.

• How does it relate to OCI artifacts, ORAS, ModelPack and KitOps?

  Those package models as OCI artifacts for container registries. A Sovereign copy is two plain folders that any disk or static web server can hold, with no registry. The approaches can coexist; Sovereign doesn’t produce OCI artifacts today.

• What about OpenSSF Model Signing and Sigstore?

  Model signing lets publishers sign the models they release, often through Sigstore’s online services. Sovereign signs copies with Ed25519 keys you choose and verifies them entirely offline. They complement each other: a publisher’s signature says who released a model; a Sovereign copy keeps it available and checkable anywhere.

• Which standards does it build on?

  Bundles use DSSE envelopes (the same envelope in-toto uses) with Ed25519 signatures, RFC 8785 canonical JSON and SHA-256 content addresses. Followed sources use The Update Framework (TUF). Bytes move over plain HTTPS, BitTorrent or IPFS. The v1 format, its JSON schemas and a public conformance vector are published so anyone can build a compatible tool.

  Read the protocol
• Why not just use torrents or IPFS?

  They are good at moving bytes, and Sovereign can use both. But a torrent or IPFS address identifies data, not who vouched for it or whether it is the complete set a model needs. Sovereign adds that layer and checks it every time, whatever carried the bytes.

• What about the Internet Archive or Software Heritage?

  Institutional archives do vital work. Sovereign is complementary: it lets anyone keep authentic, signed working copies and pass them on directly. An archive could hold Sovereign copies as ordinary files.

• Where do I get the keys to check a copy?

  From whoever you are trusting to vouch for it: a publisher who posts their key fingerprint on their own site or repository, a person who hands you a recovery kit and reads you the fingerprint, or a source you chose to follow. Sovereign shows you the fingerprint and asks you to confirm it once. It never trusts a key just because it came with the files.

  Trust and recovery
• Does it help me get around a model’s license or access rules?

  No. Every copy keeps the model’s original license, notices and card. Public sharing only works for copies whose every part is marked as publicly redistributable, and you remain responsible for the licenses and laws that apply to you. Sovereign protects access you already have; it doesn’t remove anyone’s terms.

• Can Foxlight shut it down or see what I download?

  No. There is no Foxlight account, key or server in the loop, and the tools contact only the sources you choose, so there is nothing for us to switch off and nothing reported to us. The code and format are open source under Apache-2.0: if we stopped tomorrow, anyone could carry on.

• Is it stable?

  The format is. v1 bundles are frozen: a copy made today keeps its identity and keeps verifying in future releases, and any incompatible change gets a new, separately versioned format. The tools are a public preview, so commands and screens may still change.