Merge pull request #23 from interscript/feat/tiny-tier-reconstruction

feat(distill): tiny client tier — byte-vocab students + microkimi bridge KD

Author: ronaldtse

.github/workflows/release.yml

@@ -133,7 +133,7 @@ jobs:
         uses: actions/attest-build-provenance@v1
         continue-on-error: true
         with:
-          subject-name: github.com/interscript/ml-models
+          subject-name: github.com/interscript/interscript-ml
           subject-digest: sha256:${{ github.sha }}
 
   publish-hf:

TODO.distribution/00-overview.md

@@ -18,23 +18,23 @@ zero manual steps after a `git tag`.
 ## Channel architecture (hybrid, MECE)
 
 ```
-Source code           → github.com/interscript/ml-models
+Source code           → github.com/interscript/interscript-ml
                          (this repo: framework, configs, tests, CI/CD,
                           release changelog, issue tracking)
 
 Trained weights       → huggingface.co/interscript/<task_name>
    (PyTorch, full)      (model card, datasets, transformers.js hook,
                           free Cloudflare-backed CDN, researcher entry)
 
-Browser-ready ONNX    → github.com/interscript/ml-models/releases/tag/<task>-v<X.Y.Z>
+Browser-ready ONNX    → github.com/interscript/interscript-ml/releases/tag/<task>-v<X.Y.Z>
                          (one .onnx asset per release; checksums attached;
                           stable immutable URLs; programmatic via `gh`)
 
-CDN mirror            → jsdelivr.net/gh/interscript/ml-models@<tag>/...
+CDN mirror            → jsdelivr.net/gh/interscript/interscript-ml@<tag>/...
                          (global edge cache of the GH release assets;
                           CORS-friendly; no rate limits for end users)
 
-JS glue package       → npm: @interscript/models
+JS glue package       → npm: npm `secryst` (manifest now the models.yaml index)
                          (tiny manifest of current versions per task;
                           consumed by interscript-ts to resolve URLs)
 
@@ -59,7 +59,7 @@ Each channel serves a real audience. None is redundant.
 - `01-github-releases.md` — release asset layout, tag conventions, asset naming
 - `02-huggingface-hub.md` — HF org, model cards, datasets, auto-conversion
 - `03-cdn-strategy.md` — jsdelivr + GH releases URL convention, fallback chain
-- `04-npm-packages.md` — `@interscript/models` manifest package
+- `04-npm-packages.md` — `npm `secryst` (manifest now the models.yaml index)` manifest package
 - `05-ruby-model-cache.md` — gem-side download + verify + atomic write
 - `06-versioning-scheme.md` — per-task semver, breaking-change rules
 - `07-ci-cd.md` — `.github/workflows/release.yml` full design

TODO.distribution/01-github-releases.md

@@ -57,7 +57,7 @@ Asset filenames follow `<task>-<variant>.<ext>`:
 The CDN URL is computable from `<task>` + `<version>` + `<variant>`:
 
 ```
-https://github.com/interscript/ml-models/releases/download/<task>-v<ver>/<task>-<variant>.onnx
+https://github.com/interscript/interscript-ml/releases/download/<task>-v<ver>/<task>-<variant>.onnx
 ```
 
 No central manifest needed to compute URLs. The convention IS the API.

TODO.distribution/03-cdn-strategy.md

@@ -13,12 +13,12 @@ Zero cost to us.
 
 Primary (CDN-cached):
 ```
-https://cdn.jsdelivr.net/gh/interscript/ml-models@<task>-v<x.y.z>/<task>.onnx
+https://cdn.jsdelivr.net/gh/interscript/interscript-ml@<task>-v<x.y.z>/<task>.onnx
 ```
 
 Fallback (direct GH):
 ```
-https://github.com/interscript/ml-models/releases/download/<task>-v<x.y.z>/<task>.onnx
+https://github.com/interscript/interscript-ml/releases/download/<task>-v<x.y.z>/<task>.onnx
 ```
 
 jsdelivr mirrors GitHub Releases content via the `@<tag>` syntax. The
@@ -89,19 +89,19 @@ Result: second visit loads instantly. Models cached indefinitely
 becomes:
 
 ```typescript
-const DEFAULT_MODEL_BASE = "https://cdn.jsdelivr.net/gh/interscript/ml-models@"
+const DEFAULT_MODEL_BASE = "https://cdn.jsdelivr.net/gh/interscript/interscript-ml@"
 ```
 
 `loadModel({ kind: "rababa", id: "default" })` resolves to:
 1. Look up `<task>` from id (e.g. `"default"` → `"rababa_arabic"`)
-2. Look up `<version>` from `@interscript/models` npm package
+2. Look up `<version>` from `npm `secryst` (manifest now the models.yaml index)` npm package
 3. Build URL: `${DEFAULT_MODEL_BASE}<task>-v<version>/<task>.onnx`
 4. Fetch with fallback chain
 5. Cache in IndexedDB
 
 ## Version manifest (npm)
 
-The `@interscript/models` npm package exposes a tiny JSON manifest:
+The `npm `secryst` (manifest now the models.yaml index)` npm package exposes a tiny JSON manifest:
 
 ```json
 {
@@ -114,7 +114,7 @@ The `@interscript/models` npm package exposes a tiny JSON manifest:
 `interscript-ts` reads this at startup. Users can pin a version via:
 
 ```typescript
-setModelBase("https://cdn.jsdelivr.net/gh/interscript/ml-models@rababa_arabic-v1.0.0/")
+setModelBase("https://cdn.jsdelivr.net/gh/interscript/interscript-ml@rababa_arabic-v1.0.0/")
 ```
 
 ## Acceptance

TODO.distribution/04-npm-packages.md

@@ -22,7 +22,7 @@ go live. Adds:
 - `transliterateAsync()` for ML funcalls
 - Model provisioning layer
 
-### 2. `@interscript/models` (new, tiny)
+### 2. `npm `secryst` (manifest now the models.yaml index)` (new, tiny)
 
 A pure-JSON manifest package. No JS code. Just a version index:
 
@@ -34,8 +34,8 @@ A pure-JSON manifest package. No JS code. Just a version index:
       "version": "1.0.0",
       "size_bytes": 6197600,
       "sha256": "3a7f2b...",
-      "url": "https://cdn.jsdelivr.net/gh/interscript/ml-models@rababa_arabic-v1.0.0/rababa_arabic.onnx",
-      "vocab_url": "https://cdn.jsdelivr.net/gh/interscript/ml-models@rababa_arabic-v1.0.0/rababa_arabic-vocab.json"
+      "url": "https://cdn.jsdelivr.net/gh/interscript/interscript-ml@rababa_arabic-v1.0.0/rababa_arabic.onnx",
+      "vocab_url": "https://cdn.jsdelivr.net/gh/interscript/interscript-ml@rababa_arabic-v1.0.0/rababa_arabic-vocab.json"
     },
     "rababa_hebrew": { ... },
     "secryst_thai_ipa": { ... }
@@ -72,8 +72,8 @@ Same pattern for `@interscript/model-rababa-hebrew`,
 
 ```
 1. CI builds ONNX, attaches to GH release
-2. CI updates @interscript/models manifest
-3. CI runs: npm version patch && npm publish for @interscript/models
+2. CI updates npm `secryst` (manifest now the models.yaml index) manifest
+3. CI runs: npm version patch && npm publish for npm `secryst` (manifest now the models.yaml index)
 4. Users running `interscript-ts@0.2.x` see the new version on next
    app restart (model cache invalidates by URL change)
 5. Users running `@interscript/model-rababa-arabic` opt-in via
@@ -82,16 +82,16 @@ Same pattern for `@interscript/model-rababa-hebrew`,
 
 ## Why three packages (not one)
 
-- **MECE.** Runtime code (interscript-ts) vs version manifest (@interscript/models) vs bundled binary (@interscript/model-*). Three concerns, three packages.
-- **Bundle size.** Browser apps want interscript-ts + @interscript/models (small). They fetch ONNX at runtime from CDN. Bundle stays small.
+- **MECE.** Runtime code (interscript-ts) vs version manifest (npm `secryst` (manifest now the models.yaml index)) vs bundled binary (@interscript/model-*). Three concerns, three packages.
+- **Bundle size.** Browser apps want interscript-ts + npm `secryst` (manifest now the models.yaml index) (small). They fetch ONNX at runtime from CDN. Bundle stays small.
 - **Air-gap friendliness.** Enterprises install @interscript/model-* via private npm mirror. No CDN calls.
 - **Versioning independence.** Runtime API breaks != model version bumps != model retrain.
 
-## Why `@interscript/models` not embedded in `interscript-ts`
+## Why `npm `secryst` (manifest now the models.yaml index)` not embedded in `interscript-ts`
 
 If manifest lives in `interscript-ts`, every model release forces a
 runtime bump. Decouples release cadence:
-- Model retrain: bump `@interscript/models` only.
+- Model retrain: bump `npm `secryst` (manifest now the models.yaml index)` only.
 - Runtime API change: bump `interscript-ts` only.
 
 ## Install ergonomics
@@ -104,12 +104,12 @@ npm install interscript-ts
 npm install interscript-ts @interscript/model-rababa-arabic
 
 # Pin to specific model version:
-npm install @interscript/models@1.2.0
+npm install npm `secryst` (manifest now the models.yaml index)@1.2.0
 ```
 
 ## Versioning
 
-`@interscript/models` uses CalVer-style: `1.<month>.0` so users can
+`npm `secryst` (manifest now the models.yaml index)` uses CalVer-style: `1.<month>.0` so users can
 see at a glance when the manifest was last updated. (e.g. `1.8.0` =
 August 2026 release.)
 
@@ -118,7 +118,7 @@ August 2026 release.)
 
 ## Acceptance
 
-- [ ] `@interscript/models` published (placeholder manifest)
+- [ ] `npm `secryst` (manifest now the models.yaml index)` published (placeholder manifest)
 - [ ] `@interscript/model-rababa-arabic` published (placeholder)
-- [ ] `interscript-ts@0.2.0` released depending on `@interscript/models`
+- [ ] `interscript-ts@0.2.0` released depending on `npm `secryst` (manifest now the models.yaml index)`
 - [ ] README documents install patterns for all three combos

TODO.distribution/05-ruby-model-cache.md

@@ -74,7 +74,7 @@ rababa_arabic:
   version: "1.0.0"
   sha256: "3a7f2b..."
   size_bytes: 6197600
-  url_base: "https://cdn.jsdelivr.net/gh/interscript/ml-models@rababa_arabic-v1.0.0"
+  url_base: "https://cdn.jsdelivr.net/gh/interscript/interscript-ml@rababa_arabic-v1.0.0"
 ```
 
 Override at runtime:

TODO.distribution/06-versioning-scheme.md

@@ -65,8 +65,8 @@ Following SemVer pre-release syntax:
 Pre-releases are:
 - Uploaded to GH Releases as drafts
 - Published to HF Hub with `stage: prerelease` tag
-- **NOT** added to `@interscript/models` manifest until promoted
-- Available via explicit URL: `cdn.jsdelivr.net/gh/interscript/ml-models@rababa_arabic-v1.0.0-rc.1/`
+- **NOT** added to `npm `secryst` (manifest now the models.yaml index)` manifest until promoted
+- Available via explicit URL: `cdn.jsdelivr.net/gh/interscript/interscript-ml@rababa_arabic-v1.0.0-rc.1/`
 
 ## Versioning the framework itself
 
@@ -79,7 +79,7 @@ Framework: `0.1.0` → `0.2.0` → ... → `1.0.0` (after first production task)
 
 When a task version is superseded:
 1. New release tag pushes normally.
-2. `@interscript/models` manifest points `default` → new version.
+2. `npm `secryst` (manifest now the models.yaml index)` manifest points `default` → new version.
 3. Old version stays in GH Releases (immutable).
 4. Old version's HF model card gets a banner: "Superseded by v1.1.0".
 5. `Interscript.clear_cache!(older_than: 90.days)` eventually prunes.

TODO.distribution/07-ci-cd.md

@@ -11,7 +11,7 @@
 3. Benchmarks (DER/PER, latency)
 4. GH Release with auto-generated notes
 5. HF Hub upload (PyTorch + ONNX + card)
-6. `@interscript/models` npm manifest bump
+6. `npm `secryst` (manifest now the models.yaml index)` npm manifest bump
 7. (Optional) `@interscript/model-<task>` npm publish
 
 Zero manual steps after the tag.

TODO.distribution/08-supply-chain.md

@@ -60,12 +60,12 @@ Every release asset has `<asset>.provenance.json`:
     "runner": "ubuntu-latest"
   },
   "source": {
-    "repository": "github.com/interscript/ml-models",
+    "repository": "github.com/interscript/interscript-ml",
     "ref": "refs/tags/rababa_arabic-v1.0.0",
     "commit_sha": "abc123def456..."
   },
   "materials": [
-    { "uri": "git+github.com/interscript/ml-models", "digest": { "sha1": "abc123..." } },
+    { "uri": "git+github.com/interscript/interscript-ml", "digest": { "sha1": "abc123..." } },
     { "uri": "pypi://torch@2.2.0", "digest": { "sha256": "..." } },
     { "uri": "pypi://transformers@4.42.0", "digest": { "sha256": "..." } }
   ],
@@ -84,7 +84,7 @@ Consumers can verify with `gh attestation verify`:
 
 ```bash
 gh attestation verify rababa_arabic.onnx \
-  --repo interscript/ml-models \
+  --repo interscript/interscript-ml \
   --predicate-type https://slsa.dev/provenance/v1
 ```
 
@@ -114,16 +114,16 @@ private key to manage (keyless signing via short-lived cert).
 
 ## Manifest package ties it together
 
-`@interscript/models` manifest carries all three:
+`npm `secryst` (manifest now the models.yaml index)` manifest carries all three:
 
 ```json
 {
   "rababa_arabic": {
     "version": "1.0.0",
-    "url": "https://cdn.jsdelivr.net/gh/interscript/ml-models@rababa_arabic-v1.0.0/rababa_arabic.onnx",
+    "url": "https://cdn.jsdelivr.net/gh/interscript/interscript-ml@rababa_arabic-v1.0.0/rababa_arabic.onnx",
     "sha256": "3a7f2b...",
-    "provenance_url": "https://github.com/interscript/ml-models/attestations/...",
-    "sigstore_bundle_url": "https://cdn.jsdelivr.net/gh/interscript/ml-models@rababa_arabic-v1.0.0/rababa_arabic.onnx.bundle"
+    "provenance_url": "https://github.com/interscript/interscript-ml/attestations/...",
+    "sigstore_bundle_url": "https://cdn.jsdelivr.net/gh/interscript/interscript-ml@rababa_arabic-v1.0.0/rababa_arabic.onnx.bundle"
   }
 }
 ```
@@ -148,7 +148,7 @@ Three threats, three mitigations. MECE.
 
 If our signing identity is compromised:
 1. Revoke the cert via Sigstore Rekor entry (public log).
-2. Yank the manifest entry (publish new `@interscript/models`).
+2. Yank the manifest entry (publish new `npm `secryst` (manifest now the models.yaml index)`).
 3. Cut new release with new signing identity.
 4. Announce via RSS / mailing list / model card banner.
 

TODO.distribution/09-model-cards.md

@@ -110,7 +110,7 @@ Interscript.transliterate("<map_code>", "<input>")
 ### Direct ONNX (any language)
 
 \`\`\`bash
-curl -LO https://github.com/interscript/ml-models/releases/download/<task>-v<VERSION>/<task>.onnx
+curl -LO https://github.com/interscript/interscript-ml/releases/download/<task>-v<VERSION>/<task>.onnx
 # Use onnxruntime to load + run
 \`\`\`
 
@@ -119,7 +119,7 @@ curl -LO https://github.com/interscript/ml-models/releases/download/<task>-v<VER
 \`\`\`bibtex
 @software{interscript_<task>,
   title = {Interscript <task_full_name>},
-  url = {https://github.com/interscript/ml-models},
+  url = {https://github.com/interscript/interscript-ml},
   version = {<VERSION>}
 }
 \`\`\`