nx_model_get.nx

nx_model_get.nx -- G9 mg_fetch: hash-verified model acquisition into the gen model store (/compare/gen watch G9). usage: nx_model_get <url> <expected-sha256> <dest-name> <dest-name> is relative to the model-store root (e.g. diffusion/z_image_turbo-Q8_0.gguf, loras/x.safetensors). COMPOSES INCUMBENTS, DUPLICATES NONE: transport = nx_https_fetch_range (own TLS-1.3, Range windows -- one bounded window in memory at a time, so a multi-GB body STREAMS and can never be silently truncated by a buffer cap) hashing = the streaming sha256_init/update/final already inside this compilation unit (nx_sha256 via the TLS stack / nx_weights_pull) -- the digest covers the FULL body across all windows verify law = nx_weights_pull (wp_hexenc + fail-closed compare): a mismatched body is DELETED, never stored decisions = nx_model_get_lib (dest admission, hex normalize, Content-Range/Length parse, conf parse), offline-proven by nx_model_get_gate Redirects (HF resolve -> CDN) are followed by a bytes=0-0 probe that reads the Location header, because the range fetcher itself deliberately does not follow. Resumable: an interrupted pull leaves <dest>.part; a re-run re-hashes the part from disk and continues from its byte count. Idempotent: an existing verified dest returns OK-ALREADY-VERIFIED with no network touched. An existing dest that does NOT match is REFUSED and kept (additive-only: this organ never deletes a model already in the store; only its own .part on hash mismatch). exit: 0 VERIFIED / OK-ALREADY-VERIFIED | 1 REFUSED (hash mismatch / existing mismatch) | 2 usage/bad-args | 3 UNPROVEN (transport, trust store, no-length -- partial kept for resume where one exists) license_tier: ORIGINAL