Independent Sovereign Library

For the everyday install/find/preserve/share/recover journey, start with Getting started. Library 0.22 adds guided entry choices, a reusable journey guide, separate kit/public-mirror sharing choices, copyable recipient verification instructions and download working-space review. These new controls require core 0.26 / Library 0.22; installed native build 7 does not update merely because this document or the source changed.

Sovereign can browse the public model catalog, privately preserve a supported exact model selection, save a portable recovery kit and restore its files without Skulk Core, a managed capability SDK, a GPU or a hosted account. The native macOS shell uses the same Library interface as the public local launcher. The public Python installation archive provides this interface; signed native Mac and APT releases have separate publication and qualification gates.

The Linux desktop recipe builds offline Debian candidates with a native GTK/WebKit window and bundled public runtime. Signed APT publication and its broader installed qualification remain separate from those candidates.

Model information

Core 0.24 / Library 0.20 describe model uses from captured tasks, capabilities, pipeline tags, structured source claims and declared input/output types. Library 0.20 adds the Sovereign Horizon interface. The native build 6 recipe pins that same authenticated public cohort. Native signing, notarization, installation and public final-container publication remain separate checks; Python releases do not silently replace an installed app.

Find accepts everyday terms such as writing, images, voice or a model name. What would you like to do? filters declared uses. Matching descriptions share a card on each results page; file format, precision and file label still identify each independently reviewable version. Counts refer to model versions, not unique model families. No variant is recommended or downloaded automatically.

Library searches the descriptions already saved on the device. About this model shows available source, base model, stated text context, listed languages, license and runtime notes. Common PMF metadata works without a Skulk profile; recognized retained cards add their existing metadata. Missing descriptions or unreadable optional details remain explicit. These excerpts never rewrite the original cards, unknown properties, signed wrappers or recovery data.

Works with and Produces distinguish understanding pictures from creating them, video understanding from video generation, and speech input from speech output. Reasoning and document-search uses remain visible alongside other model capabilities. Names, file sizes and a coarse text-compatibility flag do not invent uses. A source listing can declare image-text-to-text without requiring Skulk.

Main capability labels use the captured model card and structured source/file evidence. About this model names those information sources. Additional automated interpretations remain attributed, with bounded unverified notes when available; they do not supply capability labels or input/output types. They can describe an internal component rather than a usable model feature, and may be mistaken. Sovereign does not rewrite the original claims or their confidence.

A reported image companion that is not listed with a selected download is explained separately, with help describing image projectors. A repository listing or a claim marked complete does not prove that the selected download contains that companion. Missing-file-map and unsupported-companion guards stay in force. The review remains authoritative about the exact selection being preserved. For saved copies, presence caveats use the archive's root-member file list, including additional captured files, rather than the earlier download's map. File presence is still distinct from registry coverage or usable runtime support. An exact card-selected projector already in the file map is not treated as missing merely because a repository inventory lists alternative projector precisions. Other incomplete or missing-file claims remain visible. Explicit input/output direction survives preservation; only independently added PMF workloads contribute additional default modalities.

Saved-copy descriptions can read original retained-card documents up to the existing 8 MiB metadata limit, accommodating ordinary registry publication proofs larger than the former 512 KiB preview cap. These reads remain optional, local and independent of restoring/verifying the copy; no weight file is read to describe it. The display summary stays bounded to 1,536 serialized JSON bytes. Original card, catalog and proof bytes, unknown properties, archive identities and trust checks remain unchanged. Core-backed pages use the same presentation when their host supplies the optional details; older hosts retain task-based descriptions.

Verification details explains why an exact digital fingerprint is retained. Info buttons work on hover, keyboard focus and touch. Accepting a sender's key still requires an independent trusted comparison; descriptions and signed listings do not establish quality, safety, current registry approval or runtime compatibility. Data size means storage, not the memory needed to run a model.

Everyday use

Select requirements-desktop.lock from a verified v2 Library installation archive (instructions), then launch foxlight-sovereign with both public packages installed, or open the self-contained Mac app built below. First launch opens Find. Once you have saved copies, reopening starts in Library. Choose Browse public models to request metadata from the optional built-in Foxlight registry preset. No bootstrap file or account is needed. Search uses the accepted signed catalog on this device and continues to work offline. Updating listings is an explicit action, separate from model downloads.

Find starts with Ready to review: matching listings with a complete supported signed file selection, including required companions. All signed listings keeps incomplete or unsupported selections inspectable with their explanation. The count distinguishes all matching versions from those ready for review. This is a preservation-format check, not a host reachability test or a claim that the model runs on this device. Download review still checks freshness, storage and connection permissions. Searching and changing filters start no connections.

Choose Review download & preserve for a supported selection. The review includes the exact card, full selected companion repositories, total object bytes, verified file count, publication freshness and connection disclosure. When the exact selection contains its card-selected image projector, the review explicitly says that image companion is included. Confirming starts a finite, private background job. Each file must match its original signed size and SHA-256. The original model card, all properties and signed publication proof are retained in the PMF capture. No model code or runtime is executed.

Library contains complete saved PMF copies. Save recovery kit prepares a kit and opens a download/save dialog. Restore files verifies the copy and writes a fresh private folder, including all captured members and source documents. Activity retains outcomes and provides the completed kit download or Open restored folder action after the original view closes.

Open recovery kit works without the original Core or registry. Its review shows the exact archive and capture-key fingerprints. A kit's self-signature does not establish authorship: independently check those fingerprints before accepting them. Acceptance permits verification of this exact capture; it grants neither registry authority nor permission to run code. Legacy preservation kits are losslessly converted to PMF; existing PMF kits keep their original identity. Unknown card data and source documents remain opaque and are preserved.

Other listed copies from followed sources

Independent-source results show how many followed sources list the exact same manifest and how many direct addresses they suggest. Matching a friendly name alone does not combine copies. These are saved supplier hints, not observations that bytes are online or independently operated.

In Review signed details, Other listed copies offers an unchecked choice to also try routes from other sources you already follow. Changing that choice requires a new review showing the actual selected addresses. The app permits at most sixteen direct routes and retains each supplier statement separately. It rechecks those exact saved statements before the metadata request; changing or stopping a selected source invalidates the review before connecting.

Only the original selected source's candidate model-key policy is used. Another source's keys do not become model or registry authority. The original signed envelope is inspected before a separate exact-copy key choice and private model transfer. A different-name or same-name listing with another manifest cannot substitute for the selected copy. Metadata requests download no model weights; receiving still verifies every selected object and retains the original card, unknown fields and provenance documents.

Connection choices remain explicit. HTTP is unencrypted; permission for private network addresses permits a nearby computer or NAS, not anonymity. HTTP-only addresses cannot start their request while HTTP is blocked. Peer/protected hints are retained in their supplier statements but are not translated to gateways or contacted by this screen. If the primary listing has only peer routes, an explicitly reviewed direct route from another followed source can still supply the same exact model. Standalone peer tools remain available separately.

Once independently accepted metadata is retained, stopping a source does not revoke a saved model, delete its files or change its signing policy. Neither this flow nor following/searching a source starts sharing, seeding or model execution.

Backup folders and public sharing in current source

These controls are implemented in the current source checkout. Previously published native apps and Python archives do not acquire them automatically; use the matching next release after its independent publication checks.

Keep a complete backup on another drive

In Backups → Add backup folder, choose a connected drive or mounted NAS. The Mac shell offers a native folder picker; the Linux desktop package includes Zenity for folder selection. Its interactive request permits up to ten minutes; cancelling the request or quitting stops its owned picker process. Ordinary controls keep their short timeout. The local browser launcher also accepts a path. Review the name, exact folder, that destination’s observed free space and encryption disclosure, then confirm. Setup creates at most one private folder directly inside an existing parent; it never mounts a drive, creates missing parent paths, changes shared-folder permissions or copies a model automatically.

In Library → Back up, choose a remembered folder and review the exact kit and destination. Long Unicode destination lists are paged without probing drives. Closing the app waits for accepted folder review/setup calls before releasing its exclusive Library ownership; an unavailable NAS can delay that shutdown. The durable job writes a new .foxkit, reads back every object and verifies its hash before publishing the file. Original folder identities and the destination marker must still match. A missing or replaced drive stops the job; the original Library copy stays intact. Activity records success only after readback. Each backup is a new file; earlier kits are not overwritten.

The backup is complete: weights, companions, cards, unknown card properties and signed evidence travel together. Open it on a fresh device through Open recovery kit, independently confirm its capture keys, and Restore files even when the original app, Core and registry are gone. No private signing key, model execution or Skulk installation is required. Kits are not encrypted by this feature; use the drive's own encryption and access controls.

Forget folder removes only this device's settings, without contacting the drive or deleting a file. Old kits and archive retention remain under the operator's control. Folder connectivity is checked during the explicit operation, not while browsing the locally saved list. A folder on the same filesystem is identified as such; it does not protect against losing that drive. Different filesystems alone do not establish independent operators or failure domains. This adds secondary backups; the primary Library and private keys remain in its local home. NAS use still depends on the filesystem semantics described in the protocol.

Prepare a public copy, then choose when to serve it

In Library → Share, inspect the redistribution terms for each data member. An already-public original archive keeps its existing identity and signatures, including original signed payloads that omit optional default-valued fields. A supported private capture uses the existing lossless preservation projection and a separate publishing identity. Its private installed-record history and owner-only capture notices are excluded. Public original card fields, unknown card properties and retained signed registry evidence remain unchanged. Common PMF archives without this supported projection remain restorable and are refused for this transport rather than silently flattened.

Review the complete public descriptor, file list, decoded original card fields (including unknown properties) and terms, then choose Create public copy. Readable cards and the unchanged descriptor use a separate hash-bound metadata response within the existing 8 MiB limit, so ordinary signed registry proofs do not overflow compact controls. A missing or changed review cannot reach consent. A publisher declaration does not establish upstream authorship, a redistribution license, registry approval or runtime compatibility. The original private archive stays intact. Complete verified public bytes are retained by the public mirror core; no listener or public listing starts as a side effect of creating that copy.

After the retained mirror and its receipt are durable, Sovereign removes only its disposable publication staging copies. Failed or interrupted staging remains private until you choose Remove temporary sharing files in Activity. Active publication work cannot be removed. That control keeps Library copies, retained public mirrors and every recovery kit.

In Sharing → Review sharing, separately approve a one-hour HTTP session. Additional model selections, followed sources or native peer policies configured through standalone tools refuse in this single-model HTTP review. The broader operator configuration is kept for review with those tools. A mirror configured for native peers or with HTTP disabled is refused rather than inheriting permission or changing the operator’s transport choices. Its daily and monthly UTC upload allowances are shown and retained across sessions. Starting again does not reset those counters. A second simultaneous session is refused; private download, kit and restore jobs can continue while the mirror runs. Stop drains its owned connections and retains all copies. Quit stops sharing safely; reopening never silently resumes it. Advanced operator-controlled retention uses the existing persistent mirror commands, with no remote deletion path.

After the exact public closure has verified for serving, Activity → Save sharing file for recipient downloads one .foxhandoff. Send it through a channel you choose; Sovereign sends no messages. The file contains public metadata, candidate keys and a direct HTTP route, not private keys or weights. Its suggested address is this computer's locally selected network address; it is not a reachability test, public listing, NAT traversal or router setup. The computer must remain awake and reachable while the recipient downloads. A new session needs a fresh sharing file because its listener port can change. The app offers the file only while that original session is active and its exact selection remains admitted and verified for serving. Blocking a model or excluding it after integrity failure revokes the action.

Usually leave the optional recipient address empty. On an isolated LAN without a default route, enter this computer’s reachable IPv4 address from Network settings, choose Review address change, then give fresh session consent. An explicitly reviewed address needs no external route lookup. Failure of automatic address selection stops the session and asks for that review; it does not switch transport or configure a router.

Open a sharing file without Skulk

In Find → Independent sources → Open sharing file, select a .foxhandoff or legacy HTTP invitation. The first review is offline: it authenticates the included candidate signatures without accepting their keys, following a source, resolving a host, downloading weights or starting sharing. Confirm capture-key fingerprints separately with the sender, then choose which keys to accept for this exact copy. Thresholds and revocations still apply. Review mirrors, companions, byte allowance and the separate HTTP/private-address permissions before explicitly starting the download. All selected bytes verify before its private PMF copy appears in Library. Kit export and file restore then work without the sender or registry.

This independent app screen currently accepts direct HTTP(S) model handoffs. Peer/source handoffs remain available through the standalone handoff commands; the screen refuses them explicitly and never substitutes a gateway or silently joins a swarm. Followed sources remain searchable offline through the independent-source controls below. Direct HTTP sharing and receiving are neither encrypted nor anonymous: participants and network observers can learn network addresses and requested models. These local tests establish no public-network privacy qualification or independently operated replica count.

The private owner journal advances to sovereign.local-owner.v2 to represent backup/publication/sharing jobs. A v1 journal is validated and its original metadata saved as journal-before-v2.json before the new journal is committed. No weights, card, archive, signature, kit or signed format is migrated. Older owners refuse the new journal; standalone readers can still verify the unchanged archives and kits. Copying the old journal over a live newer owner is not a supported downgrade procedure.

Trust, privacy and limits

Follow independent sources

Independent source following requires matching core 0.22.0 and Library 0.17.0 packages. Earlier published 0.21/0.16 installations retain their registry catalog and recovery features; they do not include these new controls. A Python package release does not publish a new signed native application.

In Find → Independent sources, choose Add source file. The desktop accepts a direct HTTP(S) source bootstrap or exported offline source cache up to 32 MiB. Opening the file inspects it locally. Check its bootstrap fingerprint, root keys and threshold with its publisher before choosing Follow source. Source trust authorizes listings only; it does not accept model keys or confer registry authority. Following a bootstrap offers an update review without starting a connection. An imported cache is searchable as historical evidence.

Sources & updates → Review update starts a finite authenticated TUF metadata job only after confirmation. Failed updates preserve the last accepted listings and rollback floors. Search stays on the device, including after restart and when source hosts are unavailable. Results retain their individual source attribution and exact manifest IDs. Stop following hides that source's listings and prevents updates; it keeps rollback protection, already inspected model references, saved copies and recovery kits. No automatic eviction or deletion is added.

Review signed details contacts the selected mirrors for the original signed manifest, using source-supplied candidate keys only to inspect its signatures. It fetches no weights and enrolls no model signer. Open the successful metadata job in Activity → Review signed model, independently check the capture-key fingerprints, and select which keys to accept for that exact copy. The original threshold and revocations still apply. Review the complete selected byte count, companions, mirrors and received-byte allowance before Download & preserve. The original signed envelope is pinned byte for byte across this review and download. Every file verifies before a PMF copy appears in Library; the complete original archive and signed evidence remain inside it. Existing kit export and offline restore then work without the source, registry or original host. The original public capture-key candidates, threshold and revocations travel in an optional PMF document too. They can be checked after recovery, but remain candidates requiring independent fingerprint authentication, not inherited trust.

HTTP and private-address permissions are separate for source updates, model details and weight downloads. Changing metadata connection settings requires a new review before starting. Direct mirrors see the recipient's address and requested paths. None of these operations starts serving, a swarm, a router, runtime execution or global model-key enrollment. The desktop source adapter currently accepts direct HTTP(S) sources and v1 signed preservation manifests. Peer/I2P source following and direct PMF network transport remain separate command/Core adapters; unsupported routes are never silently enabled. Skulk's existing source interface and admission checks remain separate.

Built-in registry source

The bundled registry root is a preset supplied by the application, not a key obtained from the endpoint. Stock TUF verifies current updates and rollback protection. Original accepted snapshots retain their exact catalog and proof bytes. A historical snapshot can be browsed, but an expired publication or one older than already observed TUF metadata requires explicit historical acceptance before downloading. A failed update does not erase the accepted catalog.

The first standalone registry adapter requires complete SHA-256 file maps. It supports primary selections and explicitly mapped image companions. Vision, audio and video metadata do not by themselves require an extra repository. Named projectors, video companions and same-repository draft/active MTP files must already appear in the exact signed file selection, with matching declared sizes where supplied. Review and download resolve the same source/revision/path map. A missing named companion blocks the download rather than producing a silently reduced copy. Whole external vision/processor/speculation repositories without an understood complete map remain unsupported; no Hub listing or automated capability claim fills a hash gap. It refuses unsupported selections or missing hashes before fetching objects. Unsupported cards stay browsable. Existing portable kits and standalone command-line adapters remain usable independently of this registry adapter. Neither listing nor successful capture establishes runtime compatibility or redistribution rights.

Legacy audio-input/reference-audio flags remain visible as input types without inventing transcription or audio understanding. A declared video soundtrack adds audio output to video generation without creating a separate music feature. Explicit portable input/output declarations take precedence over these fallbacks.

Updating contacts registry.foxlight.ai. Search terms are not sent. Direct model downloads contact the pinned Hugging Face repository/revision and its HTTPS CDNs. Each redirect is independently checked for credential-free HTTPS and public destination addresses. Suppliers can see the client's address and requested files. There is no automatic seeding, public listener, peer joining, router installation or telemetry. The local view uses a private loopback ticket, Host/Origin checks and bounded same-origin controls.

A private process lock fences the owner. Jobs and immutable review bindings are journaled before work. Closing the view leaves the application working; quitting requests cooperative cancellation. Reopening records unfinished jobs as interrupted and never replays network work automatically. Complete copies are indexed only after verification. Partial work stays private and is not a model copy. Existing generations, kits and interrupted work are retained; this preview has no automatic retention policy. Older completed job receipts move to private history, remain browsable in Activity, and retain their request identity so a repeated submission cannot restart them. Receipt history does not consume active queue slots. Remove transfer in Activity explicitly removes only this app's input copy of a recovery kit; it keeps the original file, saved model copies and completed kits, and refuses removal while an import needs it. Eight input transfers, four active jobs and 256 saved copies are preview limits. Reaching the saved-copy limit does not block exporting or restoring existing copies. It writes to its dedicated private home, fresh recovery destinations and explicitly enrolled backup folders.

Default data locations are ~/Library/Application Support/Foxlight/Sovereign on macOS and $XDG_DATA_HOME/foxlight/sovereign (normally ~/.local/share/foxlight/sovereign) on Linux. --home selects a dedicated private folder. Concurrent owners or changed storage identities are refused. Original runtime-owned stores are not modified. Capturing can require several times the selected bytes for private working copies; insufficient local space refuses the download before object requests. Storage needs normal POSIX rename/fsync/flock semantics. No Windows support is claimed.

See upgrade and downgrade boundaries before changing the software that owns an existing private home. Archive recovery compatibility does not make an older application a reader for new Activity kinds.

Reproducible local Mac preview

For a release-mode candidate with hash-pinned public inputs and the separate Developer ID/notarization procedure, see macOS distribution. The following flexible builder remains a local preview tool.

Build on macOS with Swift, uv and a portable CPython 3.13 runtime. End users of the assembled application need neither Python nor a developer checkout. Build the frontend, public core wheel and Library wheel from the same revision, then export and install the hash-locked desktop dependencies into a clean directory:

npm ci --prefix capability/web
npm run build --prefix capability/web
uv build --wheel --out-dir dist-core
uv build --project capability --wheel --out-dir dist-library
uv export --project capability --extra desktop --no-dev --no-emit-project \
  --no-emit-package foxlight-model-preservation --format requirements-txt \
  --output-file desktop-requirements.txt
uv pip install --python /absolute/portable-python/bin/python3 \
  --target /absolute/clean-site --require-hashes -r desktop-requirements.txt

Run python scripts/package_desktop.py --help for the explicit runtime, clean site, two wheel, source-revision, build-directory and new output .app arguments. The app bundles the runtime, both public packages and their local assets. The isolated runtime disables bytecode writes inside the sealed application. Its build receipt records input wheel and runtime-file identities. No private SDK, Core checkout or model data belongs in those inputs. Packaging applies an ad hoc local signature; it does not claim Developer ID signing, notarization, Gatekeeper acceptance or clean-machine qualification. --data-directory on the native executable selects isolated storage for acceptance testing.