Work from
The same model, different local paths
How nodes agree on model identity without sharing filesystem paths.
Two machines can hold identical model weights under different paths. A distributed loader that treats the path as the model’s identity cannot reliably put those machines in the same inference run.
In mesh-llm, this also raised a policy question: if an operator requires local weights, what happens when a node cannot find its copy? Falling back to a download would violate that requirement, even if inference eventually succeeded.
Agree on bytes
The change derives a model’s identity from its GGUF contents. A single file uses a SHA-256 digest. For a sharded model, the identity includes each shard’s position, size, and digest, so a missing or reordered shard changes the result.
Each node keeps its own mapping from that identity to a local path. Discovery and control messages carry content identity rather than the machine’s filesystem location.
Hashing is only one part of the contract. The coordinator must check that every selected participant supports this loading mode and advertises the expected content. It checks again before sending the load command. The worker then verifies its local source before native loading.
Carry the policy through failure paths
With local-required, a missing, incomplete, changed, or mismatched source fails the load. Catalog lookup and peer transfer cannot silently supply replacement bytes. Existing fallback behavior remains available for models without that policy.
Review exposed places where this contract could break outside the main loading path. A policy registration could survive unloading and affect a later request. A multimodal projector path could still appear in status even when the main model path was hidden. Both needed the same lifecycle and disclosure rules as the model itself.
The tests cover source mutation, missing shards, participant eligibility, status redaction, and policy cleanup. They check the boundaries where discovery, configuration, and loading can disagree.
The cost and the remaining boundary
The first verification reads every source byte. Cached identity is reused only while the tracked file metadata remains unchanged. There is also an interval between verification and the native runtime opening the path; this assumes a trusted local filesystem, not protection from a privileged process replacing the file.
Content identity lets nodes agree on what to load. Keeping that agreement useful requires the admission checks, failure behavior, and resource lifecycle to preserve it.