Model packaging
A model is just another artifact to the platform — signed into the update metadata, verified on the device, and rolled out with a health check and automatic rollback. What makes a model artifact different is the manifest it carries: the description that lets the platform refuse to send a model to hardware it does not fit.
This is the zero-integration promise applied to ML: your model and the application that runs it ride on top of a signed, A/B, rollback-safe base. You do not change your inference code to use the platform; you package the artifact and hand it over.
What a model artifact is
A model artifact has a kind of model and a manifest describing it. The
manifest typically records:
| Field | Example | Why it matters |
|---|---|---|
| framework | onnx, tensorrt, tflite | The runtime the device needs |
| input specification | shape / dtype / preprocessing | What the model expects |
| evaluation metrics | accuracy, mAP, latency | What you observed before shipping |
| target hardware profile | nvidia-jetson-xavier-nx | The hardware the model is built for |
| license | identifier or reference | Provenance and compliance |
The manifest is metadata you supply. The platform never inspects the weights or the data your application processes — it deals in metadata only.
Getting a model in
There are two paths, and both sign the artifact as it is published:
- Upload the model file directly. Push the file together with the manifest. The platform stores it, computes its digest, and signs it into the update metadata. There is no separate "sign later" step — an unsigned artifact cannot become a rollout.
- Connect a registry you already use for model artifacts packaged as OCI content. The platform resolves the tag to an immutable digest at publish time and pins it; devices pull through a facade and never receive your registry credentials.
Alongside the artifact you can attach a software bill of materials. It is validated, stored, and counted toward your compliance coverage.
Channels
A model can be assigned a release channel — for example stable, beta, or
canary — so you can keep candidate versions and production versions side by
side and target rollouts at the channel that fits.
Why the manifest matters at rollout time
Because the manifest names the framework and target hardware, a rollout can be checked against the fleet before it ships. The platform can decline to send a TensorRT model built for one accelerator to a device that does not have it, rather than letting the mismatch surface as a failed swap on the device.