Load signed format-4 model packages

Restore AES-GCM executable decoding with format-4 signatures and publisher
acceptance. Accept prepared contracts 1 through 3 and resolve omitted
speculative row capacity to the checked rectangular layout. Preserve signature,
resource, geometry, and format-6 validation without changing package bytes.

Validation: 123 runtime-package tests and seven contract tests passed; seven
GPU tests were ignored. The published Flash Next GB10 package served 11 native
requests, including eight concurrent requests and a 5,437-token cached prefix,
without --verify-weights. Separate proposal/verification graph families remain
unsupported and are tracked in docs/TODO.txt.

Design-Signed-Off-By: Codex (GPT-6); design-review=a38f

Author: lukealonso

docs/TODO.txt

@@ -1,6 +1,11 @@
 [ ] Expose the selected deployment's rebuild metadata in flare inspect --json.
     Payload packages report rebuild: null even when DeploymentBody.rebuild is present.
 
+[ ] Restore loading and serving for packages with separate proposal and verification
+    graphs, whose operation identifiers 10, 11, and 13 are reserved in
+    helios/proto/runtime_package.proto. Validate their original captured graphs
+    through native serving without re-export or re-signing.
+
 [ ] After merging dev/qwen27b in Flare and FlashInfer, evaluate combined MXFP8
     GDN QKV/Z/B/A projections for Qwen3.8 Flash Next through shared loading and
     execution components. Preserve TP partitioning and compare complete graph

docs/runtime-package-design.md

@@ -148,8 +148,8 @@ pool holds only graph-local intermediates and is also cleared, as are unused
 bytes in the preparation allocator. Weight tensors, MTP weights, rotary
 tables, pointer tables, and required initialized metadata retain their contents.
 
-Serving accepts payload format 2 and signed format-6 logical-resource containers,
-with structural contract validation in both carriers. Execution ABI numbers
+Serving accepts payload format 2 and signed format-4 and format-6 logical-resource
+containers, with structural contract validation in every carrier. Execution ABI numbers
 do not gate loading. Engine upgrades must preserve previously supported models. Unsigned rank staging cannot load.
 The canonical format uses signed content IDs, payload-relative initializers,
 and unsigned physical locations; see [payload packages](package-format-design.md).
@@ -395,14 +395,22 @@ by 4 TiB. The decoder accepts one bounded zstd frame, caps its window at 8 MiB,
 and rejects truncated or extra frames, trailing bytes, and decoded length
 mismatch.
 
-Signatures authenticate the stored frame and its signed decoded length. Helios
-authenticates each compressed chunk against its signed commitment before feeding
+For payload format 2 and signed format 6, signatures authenticate the stored frame
+and its signed decoded length. Helios authenticates each compressed chunk against
+its signed commitment before feeding
 it to the decoder; it does not require hashing the entire combined executable
 payload first. Acceptance is a trust and license decision: the value passed to
 `authorize` equals the signed publisher namespace exactly. It is not key
 material. Weights and tables stay uncompressed and retain direct-I/O compatibility
 and storage deduplication.
 
+Signed format 4 uses the `flare-package-signature-v4` signature domain and
+AES-256-GCM executable encoding. Each encrypted chunk contains up to 4 MiB of plaintext and a 16-byte
+authentication tag. The reader validates the signed ciphertext hashes, derives the key
+from the publisher key, package ID, accepted namespace, and resource offset, and
+authenticates each chunk before exposing its plaintext. Loading these packages
+does not modify their signatures, weights, or captured graphs.
+
 `PackageClaim::read` returns what a package claims before verification: signer
 fingerprint, namespace, official source, and development marker, syntax-checked
 so a caller can resolve the signer's identity from them. `VerifiedPackage::open`
@@ -412,8 +420,9 @@ license. `VerifiedPackage::authorize` requires the acceptance string to equal th
 signed publisher namespace exactly, records it, and optionally checks the
 stored-data contents. Only its `AuthorizedPackage` result can enter
 `NativeModel::load` or `NativeResources::load`. Executable resources are
-hash-checked, decompressed, and length-checked before CUDA receives them. Frontend assets retain
-signed digest checks. Open package descriptors remain alive through native
+hash-checked, decoded according to their signed format, and length-checked before
+CUDA receives them. Frontend assets retain signed digest checks. Open package
+descriptors remain alive through native
 use, including deferred frontend and embedding-table reads; replacing the
 pathname cannot redirect those reads. Package files must remain immutable while
 loaded. Signatures authenticate bytes and do not sandbox executable code.

helios/manifest.md

@@ -113,6 +113,8 @@ verification, and commit work. It declares B/D/W/P explicitly: request capacity,
 captured proposal depth, per-request target capacity, and aggregate target rows.
 W is from 1 through T, the resolved completion token capacity; P is from B
 through B × W, including rectangular P = B × W.
+An omitted or zero packed token capacity resolves to B × W for speculative
+graphs, preserving packages exported before that field was added.
 Width-one speculative graphs have D = 0 and maintain draft context. No standalone
 proposal, verification, or packed-speculative graph kind exists.
 Prefill has batch capacity 1. Token capacities are 1, 16, or a multiple of 64

helios/model-contract.md

@@ -41,8 +41,10 @@ version domains. Execution ABI labels do not gate loading; the runtime validates
 the declared layouts and operations. Engine upgrades must preserve support for
 previously supported models without re-export.
 
-Executable resources are one mandatory zstd level-3 frame per resource. The
-signed `ExecutableResource` binds its stored frame, signed decoded length,
+Payload format 2 and signed format 6 encode each executable resource as one
+mandatory zstd level-3 frame. Signed format 4 retains its authenticated AES-GCM
+chunk reader. In payload packages, the signed `ExecutableResource` binds its
+stored frame, signed decoded length,
 resource id and kind. `chunk_nbytes` is 4 MiB and `chunk_sha256` covers
 compressed bytes with count `ceil(stored.nbytes / 4 MiB)`. The decoder window is
 capped at 8 MiB and rejects truncated or extra frames, trailing bytes, and
@@ -70,7 +72,7 @@ serving contract and replay path unchanged.
 
 | Field | Meaning |
 |---|---|
-| `version` | Semantic contract version, 3 |
+| `version` | Semantic contract version, 1, 2, or 3; exporters write 3 |
 | `vocabulary` | Valid sampled token range and histogram/mask geometry |
 | `input_vocabulary` | Valid input range, including declared nonsampled image sentinels |
 | `vision` | Feature-slot and per-window feature capacities, patch-to-feature ratio, and captured patch capacities |

helios/proto/runtime_package.proto

@@ -728,7 +728,8 @@ message ExecutionGraph {
   optional bool speculation_enabled = 10;
   uint64 estimated_duration_ns = 11; // Zero denotes an indeterminate duration.
   uint64 prefill_capacity = 12; // Prompt capacity of a mixed graph; zero otherwise.
-  // Physical target rows of a complete speculative operation, including rectangular layouts.
+  // Physical target rows of a complete speculative operation. Zero retains the rectangular
+  // batch_capacity * token_capacity layout.
   uint64 packed_token_capacity = 13;
   // Number of confidence prefixes produced per request in the selected completion frame.
   uint32 confidence_width = 14;

helios/src/model/contract.rs

@@ -348,7 +348,7 @@ impl PreparedContract {
     }
 
     pub fn validate(&self, manifest: &ExecutionManifest) -> Result<()> {
-        if self.version != 3 {
+        if !(1..=3).contains(&self.version) {
             return Err("unsupported prepared model contract version; re-export the model package".into());
         }
         if self.vocabulary == 0
@@ -682,6 +682,24 @@ impl FrontendContract {
 mod tests {
     use super::*;
 
+    #[test]
+    fn supported_contract_versions_validate_declared_state_storage() {
+        let config = crate::model::tests::config();
+        let manifest = crate::model::testing::manifest(&config);
+        for version in [1, 2, 3] {
+            let mut contract = config.contract.clone();
+            contract.version = version;
+            contract.validate(&manifest).unwrap();
+            contract.graphs[0].state[0].view.buffer = "missing_state".into();
+            assert!(contract.validate(&manifest).is_err());
+        }
+        for version in [0, 4, u32::MAX] {
+            let mut contract = config.contract.clone();
+            contract.version = version;
+            assert!(contract.validate(&manifest).is_err());
+        }
+    }
+
     #[test]
     fn state_view_validation_resolves_buffers_and_preserves_storage_errors() {
         use crate::{Error, ExecutionError, execution::Dtype};

helios/src/runtime_package/archive.rs

@@ -333,8 +333,8 @@ pub fn package_companions(path: &Path) -> Result<Vec<String>> {
     }
     let envelope =
         wire::ProtectedIndex::decode(bytes.as_slice()).map_err(|e| invalid(e.to_string()))?;
-    if envelope.version != 6
-        || envelope.groups.len() != 3
+    super::protection::ExecutableEncoding::from_version(envelope.version)?;
+    if envelope.groups.len() != 3
         || envelope.groups[0].kind != 1
         || envelope.ranks.is_empty()
     {

helios/src/runtime_package/metadata.rs

@@ -57,8 +57,8 @@ pub fn unverified_metadata_selected(
     let (file, _, payload_bytes, bytes) = Archive::envelope(path)?;
     let envelope = wire::ProtectedIndex::decode(bytes.as_slice())
         .map_err(|e| invalid(format!("invalid signed envelope: {e}")))?;
-    if envelope.version != 6
-        || envelope.groups.len() != 3
+    super::protection::ExecutableEncoding::from_version(envelope.version)?;
+    if envelope.groups.len() != 3
         || envelope
             .groups
             .iter()

helios/src/runtime_package/mod.rs

@@ -156,7 +156,7 @@ impl ModelPackage {
 /// On-disk prepared-package formats.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum PackageFormat {
-    /// Signed format-6 logical-resource packages read through the archive.
+    /// Signed format-4 and format-6 logical-resource packages read through the archive.
     Legacy,
     /// Payload-identity packages read through pinned payload containers.
     Payload,