From 9afe2b0958e92dc172ff8ccaa5668ca74ec6ddbb Mon Sep 17 00:00:00 2001 From: Advait Jayant Date: Wed, 24 Jun 2026 15:46:48 +0100 Subject: [PATCH 1/2] Add open agentic models (DeepSeek V4 Pro, GLM 5.2) to the catalog + gateway-verified reference DD against the gateway: og-veil's model list is incomplete -- the gateway also serves deepseek-v4-pro and glm-5.2 (both open-weight), neither shown by `og-veil models`. Add both to ghost's catalog (they pass the open-weight-only allow-list automatically). DeepSeek V4 Pro is the strongest open reasoning/coding model here -- the agentic pick that Hermes 405B isn't. Documented the supported set as a gateway-verified reference in the catalog, with the warning that `og-veil models` is NOT authoritative (probe the endpoint). Bumped the og-veil pin to >=0.2.7 (pulls opengradient SDK 1.1.1, which adds deepseek-v4-pro to its enum). glm-5.2 is still missing from the SDK enum -- handled by a separate SDK PR. Verified live through the ghost bridge: both return TEE-verified completions; picker lists all four open models. --- privacy/scrubbing_proxy.py | 21 ++++++++++++++------- requirements.txt | 3 ++- tests/test_scrub.py | 8 ++++---- 3 files changed, 20 insertions(+), 12 deletions(-) diff --git a/privacy/scrubbing_proxy.py b/privacy/scrubbing_proxy.py index b44874c..39884ca 100755 --- a/privacy/scrubbing_proxy.py +++ b/privacy/scrubbing_proxy.py @@ -59,14 +59,21 @@ presidio_scrub = None _PRESIDIO_OK = False -# Curated picker whitelist served at /model-catalog.json. ghost is an UNRESTRICTED harness, so -# it only offers genuinely unrestricted (open-weight, steerable) models -- the Hermes family. -# Closed, safety-tuned models (Claude, GPT, Gemini, Grok, Seed) defeat the point: they refuse, -# moralize, and can't be steered, so they are deliberately NOT offered even though the gateway -# can serve them. This list is the single source of truth for both the picker and the bridge's -# allow-list (see _ALLOWED_GATEWAY_MODELS) -- to add a model, it must be actually unrestricted. +# Curated picker whitelist served at /model-catalog.json. ghost is an UNRESTRICTED harness, so it +# only offers OPEN-WEIGHT, steerable models. Closed, safety-tuned refusers (Claude, GPT, Gemini, +# Grok, Seed) are served by the gateway but deliberately excluded -- they refuse/moralize and +# can't be steered. This list is the single source of truth for both the picker and the bridge's +# allow-list (_ALLOWED_GATEWAY_MODELS). +# +# SUPPORTED-MODEL REFERENCE (gateway-verified by probing /v1/chat/completions, 2026-06-24): +# the gateway's open-weight models are hermes-4-405b, hermes-4-70b, deepseek-v4-pro, glm-5.2. +# NOTE: `og-veil models` is INCOMPLETE -- it omits deepseek-v4-pro and glm-5.2 even though the +# gateway serves them. Do NOT trust that list to add a model; probe the endpoint. The gateway +# rejects anything it doesn't serve with `Model '' is not supported`. _CATALOG_MODELS = [ - ("nous/hermes-4-405b", "Hermes 4 405B — flagship open model, steerable & unrestricted (default)"), + ("nous/hermes-4-405b", "Hermes 4 405B — flagship uncensored open model, most steerable (default)"), + ("deepseek/deepseek-v4-pro", "DeepSeek V4 Pro — strongest open reasoning + coding; best for agentic work"), + ("z-ai/glm-5.2", "GLM 5.2 — strong open agentic MoE (Z.ai)"), ("nous/hermes-4-70b", "Hermes 4 70B — fast, low-cost open-weight model"), ] diff --git a/requirements.txt b/requirements.txt index 2467ff8..6ecda10 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +1,5 @@ # ghost privacy stack -- pinned so the load-bearing OHTTP/HPKE/TEE-verify boundary # (opengradient-veil) cannot change under us on a re-install. Bump deliberately. -opengradient-veil>=0.2.6,<0.3 +# 0.2.7 pulls opengradient SDK 1.1.1, whose model enum includes deepseek-v4-pro. +opengradient-veil>=0.2.7,<0.3 httpx>=0.27 diff --git a/tests/test_scrub.py b/tests/test_scrub.py index c39580d..48753c3 100644 --- a/tests/test_scrub.py +++ b/tests/test_scrub.py @@ -254,12 +254,12 @@ def test_stream_multiline_data_frame_deanonymized(): assert SECRET in out.decode(), "multi-line/parse path must still de-anon local tool args" -def test_catalog_is_unrestricted_only(): - # ghost must only offer/allow genuinely unrestricted models (Hermes); no closed/refusing ones. +def test_catalog_is_open_weight_only(): + # ghost must only offer/allow OPEN-WEIGHT models; no closed/refusing ones. allowed = sp._ALLOWED_GATEWAY_MODELS - assert allowed == {"hermes-4-405b", "hermes-4-70b"} + assert allowed == {"hermes-4-405b", "hermes-4-70b", "deepseek-v4-pro", "glm-5.2"} blob = json.dumps(sp._CATALOG_MODELS).lower() - for closed in ("claude", "gpt", "gemini", "grok", "openai", "anthropic", "seed"): + for closed in ("claude", "gpt-", "gemini", "grok", "anthropic", "seed-"): assert closed not in blob, f"closed model '{closed}' must not be in the catalog" From 2b3ac39e71502b19af253624d07e453128a3ae0f Mon Sep 17 00:00:00 2001 From: Advait Jayant Date: Wed, 24 Jun 2026 15:48:29 +0100 Subject: [PATCH 2/2] Pin opengradient SDK >=1.1.1 explicitly (pip won't upgrade the transitive dep) Verified live: upgrading og-veil to 0.2.7 alone left opengradient at 1.1.0, so og-veil models still omitted deepseek-v4-pro until the SDK was bumped to 1.1.1. --- requirements.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/requirements.txt b/requirements.txt index 6ecda10..5271f56 100644 --- a/requirements.txt +++ b/requirements.txt @@ -2,4 +2,7 @@ # (opengradient-veil) cannot change under us on a re-install. Bump deliberately. # 0.2.7 pulls opengradient SDK 1.1.1, whose model enum includes deepseek-v4-pro. opengradient-veil>=0.2.7,<0.3 +# Pin the SDK explicitly too -- pip won't upgrade the transitive dep on its own, and the SDK's +# TEE_LLM enum is what `og-veil models` reports (1.1.1 adds deepseek-v4-pro). +opengradient>=1.1.1 httpx>=0.27