# Model Blob SHA-256 Hashes — Day 2 Lab
# Day 2 uses the same qwen2.5:1.5b model as Day 1.
# If the Day-1 volume already contains this model, Day-2 pre-stage.sh will
# find it already present (no re-download needed with a shared volume).
#
# These are content-addressed Ollama model blob hashes (ADR-6).
# If the SHA-256 matches after pulling, you have exactly the same model weights.
#
# Verify after pulling:
#   docker compose exec ollama ollama show qwen2.5:1.5b
#   (look for the manifest at ~/.ollama/models/manifests/registry.ollama.ai/library/...)

# ── qwen2.5:1.5b ─────────────────────────────────────────────────────────────
# Architecture: qwen2 | Parameters: 1.5B | Quantization: Q4_K_M
# Context length: 32768 | Embedding length: 1536 | License: Apache 2.0
# Use: generation model for attack targets and guard demonstrations
#
# Main GGUF blob (986 MB, Q4_K_M quantized):
QWEN2_5_1_5B_BLOB_SHA256=183715c435899236895da3869489cc30ac241476b4971a20285b1a462818a5b4
#
# Config/manifest SHA-256:
QWEN2_5_1_5B_CONFIG_SHA256=377ac4d7aeefd5b870c9fccff9a6d4df36901d99fe3277c2f755bc401601ba1c

# ── DeBERTa prompt-injection classifier ─────────────────────────────────────
# Model: protectai/deberta-v3-base-prompt-injection-v2
# Source: HuggingFace Hub (downloaded at BUILD TIME into /workspace/hf_cache/)
# Size: ~184 MB (weights + tokenizer config)
# License: MIT (protectai/deberta-v3-base-prompt-injection-v2)
# Revision pinned by llm-guard: 89b085cd330414d3e7d9dd787870f315957e1e9f
#
# This model is baked into the day2-runner:local Docker image at pre-stage time.
# Verify at runtime that TRANSFORMERS_OFFLINE=1 prevents any HF network access:
#   docker compose run --rm runner python -c "
#   import os; assert os.environ.get('TRANSFORMERS_OFFLINE') == '1', 'offline not set'
#   from llm_guard.input_scanners import PromptInjection
#   scanner = PromptInjection()
#   print('Loaded offline OK')
#   "
