known-good-hashes.json

{
  "$comment": "Curated digests for Gemma 4 model tags we attest against. Each entry binds a model tag to its content-addressed manifest digest — the value reported by Ollama's `/api/tags` (`curl -s http://127.0.0.1:11434/api/tags`). The claim-check pipeline requires this digest to match the local model at runtime.",
  "models": {
    "gemma4:latest": {
      "digest": "sha256:c6eb396dbd5992bbe3f5cdb947e8bbc0ee413d7c17e2beaae69f5d569cf982eb",
      "description": "Gemma 4 default tag from ollama.com/library/gemma4",
      "addedAt": "2026-05-16"
    }
  }
}