Browser Runtime and Local App Surface

TinyRustLM.com is the simple public app route. The app loads at the domain root, not under /app/, and keeps the first-run path focused on choosing a local .slm file through the browser file picker.

• https://TinyRustLM.com/
• No /app/ subpath for the root site
• User-selected .slm files
• No served project model bytes

TinyRustLM runs as a browser-local static app. The browser fetches the app shell and Rust/WASM runtime, then immediately uses MiniModel demo autoload for a tiny public runtime-smoke artifact. The public-default-demo smoke loads catalog/default-demo.v0.json, fetches artifacts/demo/tiny-test-model-q8.slm, validates byte count and SHA-256 before Rust/WASM load_model, reaches Ready, and generates. Private/user models still use local .slm files, manifests, receipts, or P2P reverify paths rather than broad project-hosted weights. The root-package public-host local import smoke maps http://tinyrustlm.com:<port>/ to loopback for tests, treats that mapped origin as secure for browser SHA-256 APIs, imports a real fixture .slm, verifies SHA-256/provenance, and runs Rust/WASM generation from the user-selected file. The root-package public-host peer contact-card/book smokes load metadata-only MiniModel peer handoff JSON, select a reviewed contact-book peer, set Known peer URL, promote the proof-ready row to P2P Import, and save the P2P import request/script from root assets. The paired rejection smokes feed unsafe project-server or book-embedded model-byte metadata, report the unsafe flag, leave the row at Set Peer URL, and save no peer import kit. The root-package public-host P2P smoke runs hf-p2p-import-kit-exec against the same mapped root and proves catalog/manifest/feed metadata, a consenting MiniModel peer, peer-status/status-check-inspection/preflight/preflight-inspection/import verification, receipt-chain inspection, and receipt-matched .slm output without project-hosted private/user model bytes.

• MiniModel demo autoload
• public-default-demo
• catalog/default-demo.v0.json
• artifacts/demo/tiny-test-model-q8.slm
• Local WASM runtime
• Local model import
• No remote inference

The simple P2P panel and Advanced source details can preview MiniModel metadata files without making them authoritative in the browser. Receipt ledgers, peer-status check reports, peer companion inventories, contact cards, and contact books are all treated as metadata-only handoffs that must carry no model bytes or peer-piece payloads. Peer-status check JSON from minimodel check-peer-status is validated for peer routes, manifest/artifact/piece SHA-256 fields, no byte-transfer claims, and strict UTC status before the UI shows peer URL, piece count, artifact size, companion route, report SHA-256, and Rust reverify required. The Check Peer action can also fetch only live minimodel.peer_status.v0.json metadata from a consenting Known peer URL and show Live peer status loaded without requesting piece-set or chunk routes; peer-status-live-ui proves that browser boundary. Generated receiver scripts revalidate the saved report with minimodel inspect-peer-status-check before preflight.

• Import receipt ledger JSON
• Peer status check JSON
• Check Peer live status
• peer-status-live-ui
• Peer companion inventory JSON
• Peer contact card/book JSON
• Metadata-only previews
• Rust reverify required

MiniModel signed manifests now accept only external-signature-v0 envelopes. The Rust verifier rejects signed manifests with comments, missing or unsafe key routes, or a signature.payload_sha256 that does not equal the canonical sorted non-signature manifest body digest printed by minimodel verify-manifest. minimodel verify-signed-manifest then performs local Ed25519 verification against metadata-only minimodel.public_key.v0 public-key JSON; transparency-log inclusion and remote key-discovery policy remain later work.

• external-signature-v0 only
• Canonical payload SHA-256
• Local Ed25519 verification
• Unknown signature kinds fail closed

MiniModel catalog and peer-source announcement feed inspectors now report exact metadata byte counts plus SHA-256 values, and reject catalog or feed JSON above 4 MiB before parsing. Generated TinyRustLM conversion and share kits already run inspect-peer-source-announcement-feed and inspect-catalog-snapshot before feed-bound catalog publication or metadata sharing. TinyRustLM also rejects oversized local peer-source announcement/feed files and oversized catalog-declared feed route bodies at the browser metadata budget before JSON parse, checksum, or peer-source application.

• 4 MiB pre-parse JSON budget
• Browser local-feed budget smoke
• Browser route-feed budget smoke
• Exact byte counts
• Exact SHA-256 evidence
• Generated-kit inspector coverage

The app starts in Chat mode with simple starter profiles and a real Model Setup sidebar: Local .slm, Hugging Face, P2P import, and Advanced tools. Those left-side actions open implemented source panels or the actual verifier/details rail; placeholder Library, Tune, Theme, and settings-style controls were removed. Hugging Face rows are source metadata only. Blank Hugging Face browse scans a bounded top 500 text-generation model-card page by Popular or New releases and shows up to the top 100 TinyRustLM-ready candidates it finds before showing rows. The simple Hugging Face list defaults P2P on, shows P2P Import only when MiniModel metadata includes complete peer-offer proof plus a catalog-listed peer source or saved Known peer URL, shows Set Peer URL for proof-ready rows without a known source, shows Start Conversion otherwise, and shows one warning when P2P is disabled. The simple and advanced Hugging Face rows share action/source-note helpers, and the browser smoke checks that source hints and primary actions stay aligned, including preserving .safetensors source metadata and Start Conversion or Review Conversion fallbacks after peer URL/card/P2P toggle refreshes. The list status also reports P2P-ready, proof-ready-needs-peer, local-.slm-needed, external-.slm-review, and Rust-conversion-needed buckets so rows are not presented as runnable until evidence exists. Start Conversion saves a minimodel.huggingface_conversion_request.v0 JSON file for audit/reuse plus a self-contained local Rust conversion script that embeds the request JSON, can recreate that sidecar if it is missing, and reports Rust conversion script saved; when metadata lists safe .safetensors siblings, the row and generated handoff name the candidate source file, but the browser still does not download model bytes. The script resolves TINYRUSTLM_WORKSPACE, MINIMODEL_WORKSPACE, and TINYRUSTLM_SOURCE_SAFETENSORS when set, falls back to nearby workspace paths, accepts a reviewed source file beside the script or under source/, runs one TinyRustLM packer command, convert-huggingface-request, against the user-owned local .safetensors, writes tinyrustlm-conversion.receipt, and that receipt records MiniModel share-directory, prepare-peer-share, catalog snapshot, peer-source announcement/feed, local peer-serving, and metadata-only publication hints. The script then discovers the actual Rust-produced .slm and receipt paths, calls MiniModel prepare-peer-share, discovers the generated manifest, catalog entry, and peer-piece directory in one share directory, and writes a .minimodel-serve-peer-pieces.ps1 helper that re-inspects peer-companion state before companion serving from that output directory. If a consenting peer URL is available, MiniModel add-peer-source can write a with-peer entry, write-peer-source-announcement can produce portable availability metadata, write-peer-source-announcement-feed can write peer-source-announcements.v0.json, write-catalog-snapshot-with-announcement-feed can write models.with-announcement-feed.v0.json, write-peer-companion-state can write metadata-only local companion handoff state, write-peer-contact-card can write a metadata-only reviewed known-peer URL card, and converted-once-p2p-publish.README.txt names safe metadata files while warning that .slm files and peer-piece directories stay off project servers. apply-peer-source-announcements is the maintainer drift-check step before shared metadata snapshots, and write-catalog-snapshot-with-announcements can batch-publish many checked entries and announcements into metadata-only models.v0.json. MiniModel write-catalog-snapshot then produces metadata-only models.v0.json. Users can load that local models.v0.json with the Local models.v0.json / Load Local Catalog control, load a peer contact card or peer contact book to choose a reviewed Known peer URL after no-project-server and Rust-reverify validation, optionally apply a local peer-source announcement JSON to a proof-ready loaded snapshot, or let a shared catalog declare a same-origin SHA-256-bound peer-source announcement feed whose envelope, duplicate model/peer rows, and peer-offer route/checksum/chunk-count/Merkle identity must validate. Empty feeds are valid availability checks and leave rows at Set Peer URL; matching Hugging Face rows become P2P Import only after verified metadata names a real consenting peer. P2P Import saves a self-locating .minimodel-peer-import.ps1 receiver kit that resolves MINIMODEL_WORKSPACE, keeps the request JSON, metadata manifest, peer-status check report, preflight report, and verified output directory beside the script, runs MiniModel check-peer-status against minimodel.peer_status.v0.json, revalidates the saved report with inspect-peer-status-check, then runs preflight-peer-import-request and import-peer-request against the consenting direct peer. Browser import then accepts the peer-assembled .slm plus .minimodel-receipt only after receipt timestamp, model/gate fields, peer path hints, companion URL/status, chunk mode, transfer evidence, companion metadata flag, and no-project-server flags validate, and the Provenance panel renders the receipt hash/route/peer/companion/artifact details after Rust/WASM acceptance. After a verified local .slm import, TinyRustLM can save a local minimodel.local_slm_share_metadata.v0 bundle plus .minimodel-share-kit.ps1 and .minimodel-serve-peer-pieces.ps1 scripts that verify artifact bytes, prepare MiniModel peer pieces, optionally write announcement/feed, peer-companion-state metadata, peer-contact-card metadata, and inspected peer-contact-book metadata, write a metadata-only catalog snapshot, and run a user-owned serve helper that re-inspects companion state before serve-peer-companion when companion state exists, including path-prefixed peer URLs such as /peer-pieces/, or uses serve-peer-pieces otherwise from the user machine when the user consents. The later optional MiniModel Peer Companion is user-run local software for peer identity, local piece stores, cache quotas, consent prompts, serve/fetch controls, receipts, and TinyRustLM handoff; it is not a project-hosted model-byte service.

• Starter profiles for novice entry
• Model Setup sidebar routes to implemented source flows
• Local file picker remains the runnable path
• Hugging Face search stays metadata until .slm admission
• Availability summary separates P2P-ready from conversion-needed rows
• Safe .safetensors source-file hints stay local-only
• Self-contained conversion script embeds/recreates request JSON and resolves workspaces/source files
• Rust conversion receipt preserves MiniModel follow-up command hints
• Shared source-row helpers keep simple and advanced actions aligned
• P2P Import requires MiniModel peer proof and a peer source
• Peer contact card import validates known-peer metadata only
• Announcement feeds validate envelope and proof identity
• Empty announcement feeds do not create P2P availability
• Self-locating P2P import kit resolves MiniModel and local output paths
• Set Peer URL is the proof-ready fallback
• Start Conversion saves a local conversion script
• Generated serve helper keeps sender P2P serving local, companion-aware, and explicit
• convert-huggingface-request owns local conversion
• prepare-peer-share creates the local P2P share package
• add-peer-source attaches later consenting peer availability
• write-peer-source-announcement creates portable peer availability metadata
• write-peer-source-announcement-feed creates availability feed metadata
• write-catalog-snapshot-with-announcement-feed creates feed-bound catalog snapshots
• write-peer-companion-state creates metadata-only local companion handoff state
• write-peer-contact-card creates metadata-only known-peer URL handoff cards
• converted-once-p2p-publish.README.txt names safe metadata files only
• apply-peer-source-announcements is the maintainer merge gate
• write-catalog-snapshot-with-announcements batch-publishes checked metadata
• write-catalog-snapshot creates metadata-only catalog JSON
• Local models.v0.json can be loaded before Hugging Face search
• Peer-source announcement JSON can be applied locally
• Catalog announcement feeds are same-origin and checksum-bound
• Share metadata export stays local
• Save P2P Share Kit prepares local peer metadata and pieces
• Optional peer companion remains user-run local software
• MiniModel P2P stays manifest and receipt gated
• Advanced telemetry is still available

When a consenting KnownPeerBaseUrl is set, both the Hugging Face converted-once script and the verified local .slm share kit can run MiniModel write-peer-companion-state after prepare-peer-share. The result is metadata-only local handoff JSON for a future user-run MiniModel Peer Companion: checksums, piece count, Merkle root, peer URL, command hints, consent status, path-prefixed peer serving support, and no-project-server-byte flags without embedding .slm bytes or peer-piece payloads. The hf-conversion-kit-exec browser smoke now executes the exact generated conversion kit and verifies that produced companion JSON alongside the .slm, receipt, peer pieces, catalog snapshots, announcement feed, serve helper, and publish README.

• Same state shape for converted models and local imports
• Metadata-only JSON
• No project-hosted model bytes
• Executed conversion-kit smoke validates companion JSON
• Future user-run companion UI input

A selector registry declares which admitted model routes are eligible in the browser. The registry must carry model byte counts, selector budgets, manifests, adapter-family fields, module-plan receipt routes, and default strategy metadata before entries become selectable.

• selector_model_byte_budget=33554432
• Text sidecar budgets
• q4 default in combined roots
• Route drift rejection

The visible transcript is browser UI state. First-run chat shows an empty state until a real Rust/WASM generation call appends output, and the composer exposes only implemented controls. Runtime Reset clears model generation context. Clear removes transcript display. Keeping those separate prevents UI cleanup from pretending to be a runtime reset, and vice versa.

• Empty transcript until real output
• Enter-to-send uses the real submit path
• Clear transcript
• Reset runtime context
• Free loaded model
• Step-token continuation