Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

verify-gguf: fail closed by default when no strong layer ran (magic-only verdict) — deferred until the next MAJOR release

Open
  • Is something wrong?
#915 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
15/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
python
Domain
cli

Research direction

Read the deferral row at docs/roadmap/risks-and-decisions.md:259 and the exit-code rule in error-handling.md (rule 3) to see why the default stays at exit 0 for now. Do not start until #891 lands C-3 and C-4 and a MAJOR release is scheduled. Done means verify-gguf exits non-zero when no strong layer ran, the opt-out is documented, and the CHANGELOG names F-W20260729-TRUST-04-default.

Written by the indexing model from the issue text.

Description

area: verify deferred severity: medium source: roadmap wave: 3

Deferred work · F-W20260729-TRUST-04-default · severity Medium · cost ~1 h · recorded in docs/roadmap/risks-and-decisions.md:259

Summary

Decision C-3 adds an opt-in --require-strong-layer (Phase 16 S5) and keeps a magic-only verdict at exit 0 by default, because flipping the default breaks the jq -e '.valid' recipe the manual recommends, which error-handling.md rule 3 makes a MAJOR change. This issue is the flip itself: a run in which neither the GGUF metadata parse nor a SHA-256 sidecar check happened must not exit 0 by default.

Condition or budget

The next MAJOR release, after Phase 16 S5 (#891) lands C-3 and C-4 — the exporter then writes the sidecar, so the strong layer is present by default and the flip is nearly free.

State today (re-checked 2026-10-09)

No --require-strong-layer flag exists yet, the exporter writes no .gguf.sha256, and a magic-only check still returns valid=True; the package is at 0.11.1rc1.

Related

#83 (magic-only acceptance; lists the non-zero exit only as an alternative) and #84 (the exporter writing the sidecar).

Acceptance criteria

  • With no strong layer, verify-gguf exits non-zero by default; the opt-out is documented and the release notes name the MAJOR change.
  • The row is removed from the deferral table and the CHANGELOG names its ID (the table's removal contract).

Recorded in docs/roadmap/risks-and-decisions.md (read at f94595f) and re-checked against the code on 2026-10-09. The row leaves that table only when the fix is on main, the CHANGELOG names its ID and any promised guard exists.

Dominant language
Python
Stars
9
Forks
1
Avg merge
11h 8m
Merged PRs (30d)
10

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from HodeTech/ForgeLM

All issues in HodeTech/ForgeLM

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.