Add Ollama model artifact attestation

[s33thr33p10]

Summary

• add opt-in exact Ollama artifact binding for AI Studio's model gateway
• restrict PAIR's existing ordered candidate set by the expected installed-model digest before reservation or forwarding
• verify the selected Ollama scheduler's loaded-model digest at response commit before emitting trusted evidence
• preserve scheduler order, manual-selection eligibility and existing failover behavior
• reject or strip reserved request and response headers and trailers
• bound request-local and process-wide inventory concurrency and refuse inventory redirects

This is the PAIR-side counterpart to merged MrNiceAI/ai-studio PR NVIDIA#81. It is intentionally limited to the Ollama proxy. It does not install or activate PAIR, alter models or routes, or open an upstream NVIDIA pull request.

Exact scope

Five repository paths changed from NVIDIA base 13b68115fa2c9c1d94f1ead1358f8d5a527cfecf:

• docs/architecture.mdx
• services/ollama-proxy/README.md
• services/ollama-proxy/artifact_attestation_test.go
• services/ollama-proxy/proxy.go
• services/versions.json

Signed C3PO head: ee17499ed95eb5cff142a1c799701ba2477c6a1c

Final exact-diff SHA-256: e9a0f9c47c5285e502daab9346c0cfd652246d436369d0372e1a01f0be172293

Independent review and resolutions

One ephemeral read-only review used gpt-5.6-terra with high reasoning against the authorized initial five-path diff, SHA-256 fdef3d7a480330c3db80a344d5970e221c9c3e312501320becadec977da309ba.

All five findings were resolved within the same five paths:

1. Request-trailer bypass (P1): an expected-artifact trailer is now rejected, and all reserved request fields and trailer declarations are removed before forwarding.
2. Response-trailer injection (P1): reserved response headers, declarations and late-populated trailer values are removed, including at body EOF before ReverseProxy copies trailers.
3. Installed-tag TOCTOU (P1): /api/tags still gates candidates before dispatch, while a second /api/ps read verifies the exact digest from Ollama's scheduler-owned loaded Model before any response byte commits. A stale, absent, ambiguous or unavailable live record fails over or fails closed.
4. Unbounded fan-out (P2): a fixed worker pool and a process-wide eight-slot gate bound artifact inventory calls across both candidates and concurrent client requests.
5. Redirected inventory lookup (P2): artifact inventory clients do not follow redirects; a redirect is treated as an unavailable candidate.

Regression tests cover selection, manual pinning, failover, mismatch and inventory failure, malformed/duplicate/trailer inputs, redirect refusal, loaded-digest changes, bounded concurrency, engine header/trailer replacement, and unbound-request compatibility.

Validation

Windows isolated Go container (golang:1.26.5-bookworm):

• go test ./...
• go test -race ./...
• go vet ./...
• focused artifact/failover tests repeated 20 times
• repository SPDX scan: 872 checked, 0 missing, 0 to review, 0 unclassified
• git diff --check

Pinned Apple Silicon Mac under the C3PO account with checksum-verified official Go 1.25.14:

• exact five-file candidate digest matched Windows before commit
• all ollama-proxy tests passed with only the pre-existing, unrelated TestAliasSelfTargetMatchesBoundLoopbackAddressNotPortAlone excluded because macOS rejects that test's 127.0.0.2 bind
• new handler tests passed under the race detector for 10 repetitions
• go vet ./...
• go build ./...

The signed commit contains an SSH signature and the required DCO Signed-off-by trailer. Hosted validation is supplied separately from the fork's trusted main branch and must pass before this Draft is marked Ready.