Fail unofficial Ollama tags against OFFICIAL_LIBRARY_TAGS instead of warning.

Lengthening or shortening the allowlist now changes classify_model_tag and resolve_model accept/reject, so the checker can redden CI.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: jmjava

README.md

@@ -165,9 +165,10 @@ stores.
 Open-weight models are a privacy win, not an integrity guarantee. **Qwen** is a
 model family (some tags are large LLMs). `qwen3.5:9b` is the starter SLM here.
 Pull only official Ollama library tags. Unofficial GGUFs and one-off fine-tunes
-are the usual way a trojaned SLM shows up. `resolve_model` refuses a tag
-outside `OFFICIAL_LIBRARY_TAGS` unless `OLLAMA_ALLOW_UNOFFICIAL_TAGS=1`.
-Treat every `local_*` result as untrusted and review it before applying.
-The checker cannot see inside weights.
+are the usual way a trojaned SLM shows up. The deployment checker and
+`resolve_model` both refuse a tag outside `OFFICIAL_LIBRARY_TAGS` (exact
+match). `OLLAMA_ALLOW_UNOFFICIAL_TAGS=1` is the runtime escape hatch for
+`resolve_model` only. Treat every `local_*` result as untrusted and review
+it before applying. The checker cannot see inside weights.
 
 Details: [spec.md §12](spec.md#12-security).

spec.md

@@ -607,9 +607,11 @@ an alignment or integrity win.
   weight files can look helpful and still plant backdoors in generated code.
   This repo will not document how to do that. Pull from the official library,
   pin the tags in `.env`, and review every patch.
-- The checker can reject path/URL-shaped tags and public binds. Unofficial
-  library names still warn there. Runtime `resolve_model` refuses them
-  unless `OLLAMA_ALLOW_UNOFFICIAL_TAGS=1`. The checker **cannot**
+- The checker rejects path/URL-shaped tags, public binds, and any tag
+  outside `OFFICIAL_LIBRARY_TAGS` (exact match; a listed family is not
+  enough). Runtime `resolve_model` refuses the same off-list tags
+  unless `OLLAMA_ALLOW_UNOFFICIAL_TAGS=1`. Lengthening or shortening
+  that set changes accept/reject. The checker **cannot**
   detect a backdoor inside an otherwise normal-looking official tag. Review
   remains mandatory.
 - Do not give the SLM shell, credentials, or unattended merge rights.

src/local_coding_slm/ollama_client.py

@@ -10,7 +10,7 @@
 from typing import Any
 from urllib.parse import urljoin, urlparse
 
-from local_coding_slm.safety import OFFICIAL_LIBRARY_TAGS
+from local_coding_slm.safety import is_official_library_tag
 
 DEFAULT_BASE_URL = "http://127.0.0.1:11434"
 DEFAULT_FAST_MODEL = "qwen3.5:9b"
@@ -56,7 +56,7 @@ def resolve_model(self, model: str | None) -> str:
             tag = self.fast_model
         else:
             raise OllamaError(f"model must be 'fast' or 'strong', got {model!r}")
-        if not self.allow_unofficial and tag.strip() not in OFFICIAL_LIBRARY_TAGS:
+        if not self.allow_unofficial and not is_official_library_tag(tag):
             raise OllamaError(
                 f"unofficial_model_tag: {tag!r} is not in OFFICIAL_LIBRARY_TAGS; "
                 f"set {ALLOW_UNOFFICIAL_TAGS_ENV}=1 to override"

src/local_coding_slm/safety.py

@@ -21,7 +21,7 @@
 STARTER_STRONG_MODEL = "devstral-small-2"
 
 # Official Ollama library coding tags this repo is willing to name.
-# Unknown tags warn; URL/path-shaped names fail.
+# Exact members pass; anything else fails. URL/path-shaped names also fail.
 OFFICIAL_LIBRARY_TAGS = frozenset(
     {
         STARTER_FAST_MODEL,
@@ -159,11 +159,17 @@ def classify_base_url(url: str) -> CheckResult:
     )
 
 
+def is_official_library_tag(tag: str) -> bool:
+    """True when tag is exactly in OFFICIAL_LIBRARY_TAGS (live lookup)."""
+    return (tag or "").strip() in OFFICIAL_LIBRARY_TAGS
+
+
 def classify_model_tag(name: str, tag: str) -> CheckResult:
-    """Reject path/URL-shaped tags. Official pins pass; other library names warn.
+    """Reject path/URL-shaped tags and tags outside OFFICIAL_LIBRARY_TAGS.
 
     A clean tag is not proof the weights are clean. Unofficial GGUFs and
     one-off fine-tunes are the usual supply-chain hole for a trojaned SLM.
+    Lengthening or shortening OFFICIAL_LIBRARY_TAGS changes accept/reject.
     """
     value = (tag or "").strip()
     if not value:
@@ -180,24 +186,16 @@ def classify_model_tag(name: str, tag: str) -> CheckResult:
             "fail",
             f"{name}={value!r} is not a library tag",
         )
-    official_families = {t.split(":")[0] for t in OFFICIAL_LIBRARY_TAGS}
-    family = value.split(":")[0]
-    if value in OFFICIAL_LIBRARY_TAGS:
+    if is_official_library_tag(value):
         return CheckResult(
             name,
             "pass",
             f"{name}={value} is an official library tag this repo documents",
         )
-    if family in official_families:
-        return CheckResult(
-            name,
-            "warn",
-            f"{name}={value} is an official family but not a starter pin; confirm it on ollama.com/library",
-        )
     return CheckResult(
         name,
-        "warn",
-        f"{name}={value} is not in the starter allowlist; pull only from ollama.com/library",
+        "fail",
+        f"{name}={value} is not in OFFICIAL_LIBRARY_TAGS; pull only from ollama.com/library",
     )
 
 

tests/test_deployment_safety_ci.py

@@ -93,6 +93,16 @@ def test_hostname_url_fails_deployment_safety(self) -> None:
         self.assertIn("FAIL deployment safety", stdout)
         self.assertNotIn("PASS deployment safety (warnings)", stdout)
 
+    def test_unofficial_library_tag_fails_deployment_safety(self) -> None:
+        module = _load_script()
+        with patch.dict(os.environ, {"OLLAMA_FAST_MODEL": "some-random-coder:7b"}):
+            code, stdout, stderr = _run_main(
+                module, [str(SCRIPT), "--skip-listen"]
+            )
+        self.assertEqual(code, 1, stderr)
+        self.assertIn("FAIL deployment safety", stdout)
+        self.assertNotIn("PASS deployment safety (warnings)", stdout)
+
     def test_userinfo_and_decimal_ip_fail_deployment_safety(self) -> None:
         module = _load_script()
         for url in ("http://127.0.0.1@evil.com", "http://2130706433:11434"):

tests/test_ollama_client.py

@@ -14,6 +14,7 @@
     list_model_names,
     status_report,
 )
+from local_coding_slm.safety import OFFICIAL_LIBRARY_TAGS
 
 
 class _FakeResp:
@@ -92,6 +93,33 @@ def test_resolve_model_from_env_rejects_off_allowlist(self) -> None:
             settings.resolve_model("fast")
         self.assertIn("unofficial_model_tag", str(raised.exception))
 
+    def test_allowlist_length_changes_resolve_model_accept_reject(self) -> None:
+        extra = "brand-new-coder:7b"
+        extra_settings = OllamaSettings(
+            base_url="http://127.0.0.1:11434",
+            fast_model=extra,
+            strong_model="devstral-small-2",
+            num_ctx=16384,
+        )
+        with self.assertRaises(OllamaError) as raised:
+            extra_settings.resolve_model("fast")
+        self.assertIn("unofficial_model_tag", str(raised.exception))
+        lengthened = OFFICIAL_LIBRARY_TAGS | {extra}
+        with patch("local_coding_slm.safety.OFFICIAL_LIBRARY_TAGS", lengthened):
+            self.assertEqual(extra_settings.resolve_model("fast"), extra)
+        starter = OllamaSettings(
+            base_url="http://127.0.0.1:11434",
+            fast_model="qwen3.5:9b",
+            strong_model="devstral-small-2",
+            num_ctx=16384,
+        )
+        shortened = OFFICIAL_LIBRARY_TAGS - {"qwen3.5:9b"}
+        with patch("local_coding_slm.safety.OFFICIAL_LIBRARY_TAGS", shortened):
+            with self.assertRaises(OllamaError) as shortened_raised:
+                starter.resolve_model("fast")
+            self.assertIn("unofficial_model_tag", str(shortened_raised.exception))
+        self.assertEqual(starter.resolve_model("fast"), "qwen3.5:9b")
+
     def test_host_label_is_hostname_only(self) -> None:
         settings = OllamaSettings(
             base_url="http://127.0.0.1:11435",

tests/test_safety.py

@@ -3,9 +3,11 @@
 from __future__ import annotations
 
 import unittest
+from unittest.mock import patch
 
 from local_coding_slm.safety import (
     CheckResult,
+    OFFICIAL_LIBRARY_TAGS,
     classify_base_url,
     classify_env_example,
     classify_env_ignored,
@@ -70,8 +72,26 @@ def test_path_or_url_fails(self) -> None:
         self.assertEqual(classify_model_tag("fast", "/tmp/mystery.gguf").status, "fail")
         self.assertEqual(classify_model_tag("fast", "user/trojan-finetune").status, "fail")
 
-    def test_unknown_library_name_warns(self) -> None:
-        self.assertEqual(classify_model_tag("fast", "some-random-coder:7b").status, "warn")
+    def test_unknown_library_name_fails(self) -> None:
+        result = classify_model_tag("fast", "some-random-coder:7b")
+        self.assertEqual(result.status, "fail")
+        self.assertIn("OFFICIAL_LIBRARY_TAGS", result.message)
+
+    def test_official_family_unlisted_variant_fails(self) -> None:
+        result = classify_model_tag("fast", "qwen2.5-coder:32b")
+        self.assertEqual(result.status, "fail")
+        self.assertNotEqual(classify_model_tag("fast", "qwen2.5-coder:7b").status, "fail")
+
+    def test_allowlist_length_changes_classify_accept_reject(self) -> None:
+        extra = "brand-new-coder:7b"
+        self.assertEqual(classify_model_tag("fast", extra).status, "fail")
+        lengthened = OFFICIAL_LIBRARY_TAGS | {extra}
+        with patch("local_coding_slm.safety.OFFICIAL_LIBRARY_TAGS", lengthened):
+            self.assertEqual(classify_model_tag("fast", extra).status, "pass")
+        shortened = OFFICIAL_LIBRARY_TAGS - {"qwen3.5:9b"}
+        with patch("local_coding_slm.safety.OFFICIAL_LIBRARY_TAGS", shortened):
+            self.assertEqual(classify_model_tag("fast", "qwen3.5:9b").status, "fail")
+        self.assertEqual(classify_model_tag("fast", "qwen3.5:9b").status, "pass")
 
     def test_empty_fails(self) -> None:
         self.assertEqual(classify_model_tag("fast", "  ").status, "fail")
@@ -134,6 +154,22 @@ def test_safe_deployment_no_fail(self) -> None:
         )
         self.assertEqual(worst_status(results), "pass")
 
+    def test_unofficial_library_tag_fails_run_checks(self) -> None:
+        results = run_checks(
+            environ={
+                "OLLAMA_BASE_URL": "http://127.0.0.1:11434",
+                "OLLAMA_FAST_MODEL": "some-random-coder:7b",
+                "OLLAMA_STRONG_MODEL": "devstral-small-2",
+            },
+            skip_listen=True,
+            tracked=[],
+            env_ignored=True,
+            env_example_text="OLLAMA_BASE_URL=http://127.0.0.1:11434\n",
+        )
+        self.assertEqual(worst_status(results), "fail")
+        names = {item.name: item for item in results}
+        self.assertEqual(names["OLLAMA_FAST_MODEL"].status, "fail")
+
     def test_trojan_shaped_tag_fails(self) -> None:
         results = run_checks(
             environ={