Import static ONNX contracts without executing models

[omar07ibrahim]

What changed

• add an optional, exactly pinned onnx==1.22.0 adapter
• pin the optional NumPy typing/runtime boundary to numpy==2.4.2 across Python 3.11–3.14
• accept only an IR 8 / default-domain opset 13 static float subset
• require one canonical unitsentinel.onnx-contract/v1 metadata document with complete value and node bindings
• lower the reviewed operators into the existing immutable canonical graph without creating an inference session
• expose bounded, atomic, no-overwrite unitsentinel import-onnx text and JSON paths
• bind model, checker, metadata, operator mappings, graph, and execution flags in a content-addressed unitsentinel.onnx-import/v1 receipt
• resolve and smoke-test the public unitsentinel[onnx] extra from a built wheel in a clean virtual environment

Fail-closed boundary

The adapter rejects initializers and external tensor data, sparse initializers, dynamic or unspecified dimensions, attributes, custom domains, functions, training graphs, quantization annotations, control flow, unreviewed element types/operators, partial metadata, invalid topology, and dead subgraphs.

Import success is translation, not dimensional verification. The CLI writes the canonical graph first; callers then run the existing verifier. The receipt is unsigned and does not attest exporter identity, deployment state, scientific correctness, model quality, broadcasting, or matrix-shape correctness.

Reproducible evidence

• committed synthetic 593-byte ModelProto generated with official onnx.helper
• actual production import and verify captures in text and canonical JSON
• actual exit-4 captures for symbolic shape, Pow, and initializer cases
• receipt-derived architecture, lowering, terminal, and rejection SVG/PNG pairs
• three-frame ONNX demo GIF derived from those source records
• provenance v2 copies model_executed and external_data from the production receipt and states only that network access is not required
• closed 101-file evidence manifest with exact byte counts and SHA-256 digests
• dedicated ONNX contract v1 specification

Model SHA-256: 46be48f85a9ce2c45449fc887f38310d005f13af9878642cb209dc9a5c1401fb

Lowered graph SHA-256: 09472bff769c5bef10ff0b525f0c117295e57e16aaa2e1446f6927dd3e54584d

Validation

• 493 unit, integration, adversarial, release, and evidence tests
• observed 96% combined statement/branch coverage (5,485 statements and 1,950 branches)
• CPython 3.11–3.14 branch-coverage matrix with a 95% floor
• strict Ruff formatting/lint and mypy
• independent Python/Node evidence replay and renderer audit
• exact core source-to-offline-installed-wheel contract
• separate installed-wheel ONNX-extra import and verification smoke
• read-only final CI; the temporary evidence writer was removed before review
• exact final head under validation: 098eec0c0ad59bad3f3f3c729d823190fde0f7e4

The repository intentionally remains unlicensed pending Omar's decision.