[media-types] Media Type Registration Request: application/v nd.ai.finetune.v1+json

--===============0301517539689638682==
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_C3203B86-2A55-41A2-A848-92F2F55F83D2"


--Apple-Mail=_C3203B86-2A55-41A2-A848-92F2F55F83D2
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8


> Dear IANA Media Types Review Team,
>=20
> This is a request for permanent vendor-tree registration of the
> following media type per RFC 6838.
>=20
> Registration is requested on behalf of CKODEX,
> the author and change controller of the AIPACK specification.
>=20
> A community review period is requested prior to formal registration.
>=20
> --- Registration Template ---
>=20
> Type name: application
>=20
> Subtype name: vnd.ai.finetune.v1+json
>=20
> Vendor tree prefix: vnd. =E2=80=94 vendor-tree registration under the
> control of CKODEX.
>=20
> Required parameters: N/A
>=20
> Optional parameters: N/A
>=20
> Encoding considerations: 8bit. (Content is UTF-8 encoded JSON per RFC =
8259. While JSON is fundamentally textual, long unbroken base64-encoded =
strings or deeply nested structures may exceed 998 octets per line, so =
transports that impose line length limits MUST use appropriate =
content-transfer encoding (e.g., base64 in email contexts). Over =
HTTP(S), the content is transferred as-is.)
>=20
> Security considerations:
> AIPACK manifests contain references to content layers and other
> artifacts via SHA-256 digests. Manifests do NOT contain executable
> code. However, the JSON documents contain URI references and digests
> that, if followed without validation, could cause implementations to
> fetch and process untrusted content.
>=20
> Implementations MUST:
> 1. Validate manifest content against the corresponding JSON Schema
>    (Draft 2020-12) before processing.
> 2. Verify that referenced artifact digests match the cryptographic
>    hash of the fetched content (SHA-256).
> 3. Reject manifests with unknown or mismatched schemaVersion or
>    kind fields.
> 4. Validate attestation signatures (Ed25519, ECDSA P-384, or
>    Dilithium3) before trusting any signed claims embedded in or
>    attached to the manifest.
> 5. Enforce policy-bundle constraints (allowed/forbidden artifact
>    types, required predicates, risk valence thresholds) before
>    promoting an artifact to a production runtime.
>=20
> For additional security considerations, see AIPACK-SPEC =C2=A725.
>=20
> Interoperability considerations:
> AIPACK manifests are distributed via OCI-compliant registries (Docker
> Distribution v2, zot, etc.) and consumed by AI artifact runtimes,
> composition engines, and supply-chain governance tools. Both JSON
> and OCI transport semantics are well-established; interoperability is
> primarily a function of schema conformance.
>=20
> Implementations MUST accept manifests that validate against the
> published JSON Schema. Implementations MAY reject manifests that
> contain unknown fields, but this is discouraged as it impedes forward
> compatibility.
>=20
> Canonicalization for digest computation uses RFC 8785 (JSON =
Canonicalization
> Scheme) to ensure bit-exact reproducibility across implementations.
>=20
> Published specification:
> AIPACK-SPEC v0.1.0 (and later versions)
> =
https://github.com/ckodex-labs/aipack-spec/blob/main/AIPACK-SPEC-0.1.md
>=20
> Applications that use this media type:
> - AI artifact registries (e.g., Hugging Face, private OCI registries)
> - Model deployment runtimes (e.g., vLLM, Triton, Ollama)
> - Composition engines that assemble agents from base models + skills
> - Supply chain governance and SBOM generation tools
> - CI/CD pipelines that validate AI artifact policies
>=20
> Fragment identifier considerations: N/A
>=20
> Restrictions on usage: None.
>=20
> Provisional or permanent registration: Permanent vendor-tree =
registration.
>=20
> Additional information:
> - Magic number(s): None (UTF-8 JSON text)
> - File extension(s): .json (when stored outside a registry)
> - Macintosh file type code(s): TEXT
> - Object identifier(s): None
> - Intended usage: COMMON
>=20
> Author/Change Controller: CKODEX
> Contact: Mohamed N. Chorfa <[email protected]>
>=20
> --- End Registration Template ---
>=20
> Please confirm receipt and advise on the expected review timeline.
> We are happy to address any questions from the designated expert
> reviewer.
>=20
> Best regards,
> Mohamed N. Chorfa
> CKODEX
> [email protected]

--Apple-Mail=_C3203B86-2A55-41A2-A848-92F2F55F83D2
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=utf-8

<html aria-label=3D"message body"><head><meta http-equiv=3D"content-type" =
content=3D"text/html; charset=3Dutf-8"></head><body =
style=3D"overflow-wrap: break-word; -webkit-nbsp-mode: space; =
line-break: after-white-space;"><div =
class=3D"Apple-Mail-URLShareUserContentTopClass"><br></div><div =
class=3D"Apple-Mail-URLShareWrapperClass" style=3D"position: relative =
!important;"><blockquote type=3D"cite" style=3D"border-left-style: none; =
color: inherit; padding: inherit; margin: inherit;">

Dear IANA Media Types Review Team,<br><br>This is a request for =
permanent vendor-tree registration of the<br>following media type per =
RFC 6838.<br><br>Registration is requested on behalf of CKODEX,<br>the =
author and change controller of the AIPACK specification.<br><br>A =
community review period is requested prior to formal =
registration.<br><br>--- Registration Template ---<br><br>Type name: =
application<br><br>Subtype name: vnd.ai.finetune.v1+json<br><br>Vendor =
tree prefix: vnd. =E2=80=94 vendor-tree registration under =
the<br>control of CKODEX.<br><br>Required parameters: =
N/A<br><br>Optional parameters: N/A<br><br>Encoding considerations: =
8bit. (Content is UTF-8 encoded JSON per RFC 8259. While JSON is =
fundamentally textual, long unbroken base64-encoded strings or deeply =
nested structures may exceed 998 octets per line, so transports that =
impose line length limits MUST use appropriate content-transfer encoding =
(e.g., base64 in email contexts). Over HTTP(S), the content is =
transferred as-is.)<br><br>Security considerations:<br>AIPACK manifests =
contain references to content layers and other<br>artifacts via SHA-256 =
digests. Manifests do NOT contain executable<br>code. However, the JSON =
documents contain URI references and digests<br>that, if followed =
without validation, could cause implementations to<br>fetch and process =
untrusted content.<br><br>Implementations MUST:<br>1. Validate manifest =
content against the corresponding JSON Schema<br><span =
class=3D"Apple-converted-space">&nbsp;&nbsp;</span> (Draft 2020-12) =
before processing.<br>2. Verify that referenced artifact digests match =
the cryptographic<br><span =
class=3D"Apple-converted-space">&nbsp;&nbsp;</span> hash of the fetched =
content (SHA-256).<br>3. Reject manifests with unknown or mismatched =
schemaVersion or<br><span =
class=3D"Apple-converted-space">&nbsp;&nbsp;</span> kind fields.<br>4. =
Validate attestation signatures (Ed25519, ECDSA P-384, or<br><span =
class=3D"Apple-converted-space">&nbsp;&nbsp;</span> Dilithium3) before =
trusting any signed claims embedded in or<br><span =
class=3D"Apple-converted-space">&nbsp;&nbsp;</span> attached to the =
manifest.<br>5. Enforce policy-bundle constraints (allowed/forbidden =
artifact<br><span class=3D"Apple-converted-space">&nbsp;&nbsp;</span> =
types, required predicates, risk valence thresholds) before<br><span =
class=3D"Apple-converted-space">&nbsp;&nbsp;</span> promoting an =
artifact to a production runtime.<br><br>For additional security =
considerations, see AIPACK-SPEC =C2=A725.<br><br>Interoperability =
considerations:<br>AIPACK manifests are distributed via OCI-compliant =
registries (Docker<br>Distribution v2, zot, etc.) and consumed by AI =
artifact runtimes,<br>composition engines, and supply-chain governance =
tools. Both JSON<br>and OCI transport semantics are well-established; =
interoperability is<br>primarily a function of schema =
conformance.<br><br>Implementations MUST accept manifests that validate =
against the<br>published JSON Schema. Implementations MAY reject =
manifests that<br>contain unknown fields, but this is discouraged as it =
impedes forward<br>compatibility.<br><br>Canonicalization for digest =
computation uses RFC 8785 (JSON Canonicalization<br>Scheme) to ensure =
bit-exact reproducibility across implementations.<br><br>Published =
specification:<br>AIPACK-SPEC v0.1.0 (and later =
versions)<br>https://github.com/ckodex-labs/aipack-spec/blob/main/AIPACK-S=
PEC-0.1.md<br><br>Applications that use this media type:<br>- AI =
artifact registries (e.g., Hugging Face, private OCI registries)<br>- =
Model deployment runtimes (e.g., vLLM, Triton, Ollama)<br>- Composition =
engines that assemble agents from base models + skills<br>- Supply chain =
governance and SBOM generation tools<br>- CI/CD pipelines that validate =
AI artifact policies<br><br>Fragment identifier considerations: =
N/A<br><br>Restrictions on usage: None.<br><br>Provisional or permanent =
registration: Permanent vendor-tree registration.<br><br>Additional =
information:<br>- Magic number(s): None (UTF-8 JSON text)<br>- File =
extension(s): .json (when stored outside a registry)<br>- Macintosh file =
type code(s): TEXT<br>- Object identifier(s): None<br>- Intended usage: =
COMMON<br><br>Author/Change Controller: CKODEX<br>Contact: Mohamed N. =
Chorfa &lt;[email protected]&gt;<br><br>--- End Registration Template =
---<br><br>Please confirm receipt and advise on the expected review =
timeline.<br>We are happy to address any questions from the designated =
expert<br>reviewer.<br><br>Best regards,<br>Mohamed N. =
Chorfa<br>CKODEX<br>[email protected]<br>

</blockquote></div></body></html>=

--Apple-Mail=_C3203B86-2A55-41A2-A848-92F2F55F83D2--


--===============0301517539689638682==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KbWVkaWEtdHlw
ZXMgbWFpbGluZyBsaXN0IC0tIG1lZGlhLXR5cGVzQGlldGYub3JnClRvIHVuc3Vic2NyaWJlIHNl
bmQgYW4gZW1haWwgdG8gbWVkaWEtdHlwZXMtbGVhdmVAaWV0Zi5vcmcK

--===============0301517539689638682==--