docs: README for the 0.2.0 images

.github/workflows/ci.yml

@@ -28,9 +28,8 @@ jobs:
       - name: pytest
         run: pytest -v --tb=short
 
-  # Build the artefact that ships and test THAT, not the checkout: install the
-  # wheel (src/ layout, so the checkout never shadows it) and run the same
-  # suite against the installed package.
+  # Build the artefact that ships and test that, not the checkout. The src/ layout
+  # means the checkout cannot shadow the installed wheel.
   build-and-install:
     runs-on: ubuntu-latest
     steps:

.pre-commit-config.yaml

@@ -1,5 +1,5 @@
 fail_fast: true
-# SPDX/DCO hooks run at their own stages; everything else at pre-commit only.
+# Hooks run at pre-commit unless they set stages (the DCO check runs at commit-msg).
 default_stages: [pre-commit]
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
@@ -35,7 +35,6 @@ repos:
         language: system
         stages: [commit-msg]
 
-  # Needs gitleaks on PATH (brew install gitleaks / apt install gitleaks).
   - repo: https://github.com/gitleaks/gitleaks
     rev: v8.30.1
     hooks:

CONTRIBUTING.md

@@ -11,9 +11,8 @@
    pip install -e ".[dev]"
    ```
 
-   The unit and spec tests need no GPU. Two of them fetch pinned third-party material
-   on first run (OpenAI's OpenAPI schema; TypeSafe's wire models come from the
-   `typesafe-sdk` dev dependency) and skip with a message when offline. See
+   The unit and spec tests need no GPU. `tests/test_openai_spec.py` downloads OpenAI's
+   OpenAPI schema on first run and skips with a message when offline. See
    [docs/TESTING.md](docs/TESTING.md) for what each test covers and how to run the
    live-server checks.
 
@@ -24,6 +23,7 @@
    ruff format --check src tests scripts ci examples
    ruff check src tests scripts ci examples
    ty check src
+   python3 ci/check_headers.py
    pytest
    ```
 
@@ -57,8 +57,8 @@ git commit --amend -s --no-edit
 
 To sign off several commits, use `git rebase --signoff <base>` and force-push.
 
-The repo's pre-commit config also runs a local DCO check at `commit-msg` time, so
-unsigned commits fail before they are pushed.
+The repo's pre-commit config has a local DCO check that runs at `commit-msg` time. Install it with
+`pre-commit install --hook-type commit-msg`, and unsigned commits then fail before they are pushed.
 
 ## Contribution Guidelines
 
@@ -77,4 +77,4 @@ participating.
 
 ## Questions
 
-Open an issue or start a discussion.
+Open an issue.

Dockerfile

@@ -18,7 +18,7 @@ ARG GRANITE_SWITCH_VERSION=0.1.1
 ARG WITH_ASR=0
 
 # granite-switch is pinned to a PyPI release so the image does not drift with upstream;
-# transformers 5.17 is the version it supports. The [audio] extra (av, scipy, soundfile,
+# transformers is pinned to 5.17.0. The [audio] extra (av, scipy, soundfile,
 # soxr) is in every build: without it audio requests fail with HTTP 500 while /health and
 # decisions look fine. The constraint file keeps the base image's vLLM, torch and
 # torchcodec as they are.
@@ -30,8 +30,8 @@ RUN python3 -m pip list --format=freeze | grep -i -E "^(vllm|torch|torchaudio|to
 
 # The speech model the checkpoint's config names, baked in as a Hub cache at the tested
 # commit (without the repo's unused .py files). The server runs with the Hub offline, so a
-# missing file fails startup instead of fetching something else. A download by commit
-# writes no refs/main, which the offline lookup for "main" reads, so it is written here.
+# missing file fails startup instead of fetching something else. Downloading by commit
+# does not create refs/main, which the offline lookup needs, so the next lines write it.
 ARG ASR_MODEL=ibm-granite/granite-speech-5.0-470m-turboctc
 ARG ASR_REVISION=1dd23f46f6d4e6eae2531982ba2e33220086dd97
 RUN if [ "$WITH_ASR" = "1" ]; then \

SECURITY.md

@@ -19,7 +19,8 @@ server alongside `/v1/chat/completions`. When deploying it:
   `--api-key`, which covers these routes too, whenever the server is reachable by
   anyone you do not fully trust
 - **Model access**: restrict who can read the checkpoint and log in to the serving machine
-- **Caller text is untrusted input**: the plugin escapes it against prompt injection,
-  but a decision adapter's probabilities are a prior, not an authorisation decision
+- **Caller text is untrusted input**: the plugin escapes special tokens and the invocation
+  marker, but the text can still steer the model, and a decision adapter's probabilities are a
+  prior, not an authorization decision
 - **Dependencies**: keep vLLM and the surrounding stack updated to receive security
   patches

THIRD_PARTY_NOTICES.md

@@ -1,6 +1,7 @@
 # Third-party notices
 
-This project is Apache-2.0. It includes the following third-party material, used under the
+This project is Apache-2.0, except `src/granite_switch_decision/plugin.py` and `tests/test_plugin.py`,
+which are Apache-2.0 AND MIT because they adapt the MIT code below. It includes the following third-party material, used under the
 licence shown.
 
 ## typesafe-ai/system-one-adapter-python