prove-local streams the full weight file into a BLAKE3 to bind the proof
to the exact bytes. Correct, but on a 13 GiB model that is a ~13 GiB read
on every single run — pure waste when the file has not changed.
Add an opt-in cache keyed on the file's (size, mtime) fingerprint. A hit
returns the stored hash and skips the stream; any miss (absent entry,
changed size, changed mtime) re-hashes and updates the cache.
The honesty cost is stated plainly, because this is a proof input. The
cell binds to the BLAKE3 of the bytes; a cache that skips the re-hash
decides the bytes are unchanged *without reading them*, exactly as build
systems do — an unchanged (size, mtime) is taken as evidence the contents
are unchanged. That is a freshness heuristic, not a proof. So:
- The library default is `hash_cache: None` — full stream every run,
preserving the strong bytes-bound guarantee. Caching is something the
operator opts into knowingly.
- The cache is never a correctness dependency: an unreadable or corrupt
cache file degrades to a full hash, it never fails the proof.
- The prover is loud about which applied: it prints `[hashed]` or
`[cache hit: trusts size+mtime]` on every run, so a reader always
knows which guarantee held.
The CLI turns the cache on by default at a temp path (the ergonomics
live here, not in the library) so the every-run pain is solved out of the
box; `SANDBOX_WEIGHTS_HASH_CACHE=off` forces the full stream.
Verified on the real Devstral-Small-2-24B Q4_K_M (13.35 GiB): run 1 cold
= 15.72s wall, printed `[hashed]`; run 2 warm = 6.58s wall, printed
`[cache hit]` — the eliminated ~9s is exactly the 13 GiB BLAKE3 stream,
and both runs bind to the identical hash b3:60fc77b9fcc1…, so the proof
is unchanged. 4 tests: hit-matches-full-hash, miss-on-change,
no-cache-always-streams, corrupt-cache-degrades. Test temp dirs are
process+counter unique so they never collide under parallelism.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
8299e38a95