Advisories and lineage

A dataset can turn out to be poisoned, a base model backdoored, a corpus mislicensed or leaking personal data. By then it has usually been trained on, fine-tuned and shipped inside agents. An **advisory** marks the affected commits, and Zaryn finds everything built from them. ## Filing an advisory The repository's owner or an admin files it, from the repository's **Advisories** tab or the CLI: ```bash zev advisory file --kind poisoned --severity high \ --summary "Backdoor trigger patches in 2% of images" \ --introduced 91a707d --fixed 5899f2f ``` `--introduced` is the first affected commit (or a branch). `--fixed` is the first clean one, if there is one. Every commit in between is covered, on every branch. A model trained on a fixed version isn't flagged. ## Who is affected, and how badly Zaryn follows recorded lineage: `trained_on`, `fine_tuned_from`, `derived_from` and `evaluated_on` links, plus the models an agent's manifest `uses`. Each repository downstream gets a verdict: | Verdict | Meaning | |---|---| | **direct** | It consumes an affected commit itself | | **transitive** | It's downstream through other repositories | | **no clean lineage** | Every recorded provenance path runs through the affected commits: there is nothing clean to rebuild from, so it must be rebuilt from scratch | "No clean lineage" comes from a **dominator tree** over the lineage graph. A node dominates another when every path from any origin passes through it. A model trained on both a poisoned and a clean dataset is affected, but it can be retrained without the poisoned one. A fine-tune of a model trained only on the poisoned data cannot. Owners of affected repositories are notified, and an `advisory` webhook fires. Each owner then records what they did: *acknowledged*, *retrained* or *not affected*. Owners who can't read the source repository learn only that something upstream is wrong, and how severe it is. The verdicts are only as complete as the recorded lineage, which is why Zaryn also [infers it](#lineage-nobody-recorded). ## Blocking builds A repository can refuse to build while an unresolved advisory reaches it. Add this to `.zev-ci.json`: ```json { "advisories": { "fail_on": "high" }, "steps": [ ... ] } ``` Or check anywhere with `zev taint check --fail-on high`, which exits 1 while an advisory at or above that severity is open or only acknowledged. ## Signed, logged, on IPFS Every version of an advisory on a public repository is a dag-cbor document with its own CID. It is signed by the server's Ed25519 key, appended to the [transparency log](/transparency), pinned to IPFS, and listed in a signed feed published under IPNS. Anyone can check it without trusting Zaryn: ```bash zev advisory verify ZEV-2026-0001 # CIDs, signature, envelope, transparency-log inclusion zev advisory feed # the signed feed of every public advisory ipfs dag get <document CID> # the document itself, from any IPFS node ``` The **Verify in your browser** button on an advisory's page runs the same checks with WebCrypto. Advisories on private repositories are signed too, but never leave the server. ## Lineage nobody recorded Most fine-tuned models are uploaded without a `fine_tuned_from` link. Zaryn fingerprints the weights of every model repository (`.safetensors`, `.npy`, `.gguf`) after each push to `main`. Each tensor gets a 64-bit SimHash of its values, so a fine-tune stays within a few bits of its base while an unrelated model lands about half the bits away. Candidates are found with locality-sensitive hashing. A minimum spanning arborescence then picks one most likely parent per model across a whole family, so a fine-tune of a fine-tune points to its real parent, not its grandparent. Each inferred parent becomes a **suggestion** on the model's Evals & lineage page and in `zev suggestions`. Nothing is recorded until the owner confirms it. Advisories list pending suggestions as **possibly affected**. When an owner confirms one, the model moves into the verdict table, and its owner is notified. ## Cost Filing advisories, verdicts, notifications, the CI gate, verification and suggestions are free on every plan. The live blast-radius graph on an advisory's page is part of Premium.