[Sandbox] AIPACK

[MChorfa]

Basic project information

Project summary

A digest-closed, OCI-native specification for declaring, distributing, verifying, and composing composite AI agents with cryptographic supply chain provenance.

Project description

AIPACK is an open specification that models composite AI agents — foundation models, fine-tuned adapters, MCP servers, guardrails, skills, tools, retrieval indices, datasets, evaluation harnesses, and policies — as typed, schema-validated OCI artifacts linked via OCI 1.1 Referrers. Every artifact carries a SHA-256 digest identity, every composition is digest-closed (any component change produces a new composite digest), and every promotion gate is enforceable via declarative policy bundles.

The specification addresses a gap in the cloud native AI landscape: while CNCF ModelPack packages individual model weights, no standard exists for composing those weights with adapters, tools, and guardrails into a single, attestable, verifiable agent assembly. AIPACK fills this gap by reusing graduated CNCF primitives — OCI Distribution 1.1, Sigstore, in-toto, OpenTelemetry, and OPA — rather than inventing new infrastructure.

AIPACK ships with 27 JSON Schemas (Draft 2020-12), 90 conformance vectors, dual Go/Rust reference implementations, and three compliance policy bundles mapping to FedRAMP Moderate, CMMC L3, and EU AI Act requirements. The specification includes air-gap handoff (§17) with ed25519 signatures and RFC 3161 timestamping for regulated environments, back-propagation lineage for forensic attribution, and a 75-predicate attestation registry.

Project details

Org repo URL

N/A

Project repo URL in scope of application

https://github.com/ckodex-labs/aipack-spec

Additional repos in scope of the application

N/A (single repository contains spec, schemas, conformance vectors, and both reference implementations)

Website URL

https://ckodex-labs.github.io/aipack-spec/

Roadmap

https://github.com/ckodex-labs/aipack-spec/blob/main/ROADMAP.md

Roadmap context

AIPACK is at v0.1.1 with a clear path to v1.0:

• v0.2 (Q3 2026): Transparency log anchoring (Rekor), dependency inversion index, back-propagation lineage, 10 new predicate types, CNCF Sandbox submission
• v0.3 (Q4 2026): Multi-registry federation, runtime attestation (OTel), post-quantum signatures (Dilithium3), Python SDK, IANA registrations finalized
• v1.0 (2027): TLA+ formal verification, stability commitment, CNCF Incubation application, Kubernetes admission controller

The roadmap is designed to align with CNCF maturity levels: Sandbox at v0.2, Incubation at v1.0, Graduation after demonstrated adoption.

Contributing guide

https://github.com/ckodex-labs/aipack-spec/blob/main/CONTRIBUTING.md

Code of Conduct (CoC)

https://github.com/ckodex-labs/aipack-spec/blob/main/CODE_OF_CONDUCT.md

(Adopted from the CNCF Code of Conduct)

Adopters

https://github.com/ckodex-labs/aipack-spec/blob/main/ADOPTERS.md

Maintainers file

https://github.com/ckodex-labs/aipack-spec/blob/main/MAINTAINERS.md

Security policy file

https://github.com/ckodex-labs/aipack-spec/blob/main/SECURITY.md

Standard or specification?

Yes. AIPACK is primarily a specification. It defines:

• 15 artifact manifest types (JSON Schemas, Draft 2020-12) for AI agent components
• 12 predicate schemas for in-toto attestation envelopes (safety reviews, coverage tests, composition proofs, etc.)
• 75 predicate URNs in a registry (3 with schemas, 51 pending, 21 external/informative)
• Digest computation rules per RFC 8785 (JSON Canonicalization Scheme)
• OCI 1.1 Referrers usage for attestation linking
• Policy bundle format (YAML) for compliance gate enforcement
• Air-gap handoff format (§17) with ed25519 signatures and RFC 3161 TSA
• IANA media type registrations (16 types under application/vnd.ai.*)

The specification document is AIPACK-SPEC-0.1.md (2333 lines, 24 sections). Reference implementations in Go and Rust serve as conformance harnesses, not as the primary deliverable.

Business product or service to project separation

This project is unrelated to any product or service. AIPACK is an open specification developed by CKODEX, a working group developing open AI packaging standards. CKODEX has no commercial product or service based on AIPACK. The specification is freely implementable by any party.

Cloud native context

Why CNCF?

AIPACK is built entirely on CNCF primitives and is a natural extension of the CNCF supply chain security story into the AI/ML domain. Joining the CNCF provides:

1. Ecosystem alignment: AIPACK reuses OCI Distribution 1.1, Sigstore, in-toto, OpenTelemetry, and OPA — all graduated CNCF projects. CNCF is the natural home for a specification that extends these projects to AI workloads.
2. Governance neutrality: As an AI supply chain standard, AIPACK must be vendor-neutral. CNCF governance ensures no single organization can capture the specification.
3. TAG engagement: AIPACK intersects TAG-Security (supply chain), TAG-Runtime (AI/ML workloads), and TAG-Storage (OCI artifact storage). CNCF provides the structured forum for these cross-TAG discussions.
4. Adoption signal: CNCF Sandbox acceptance signals to the AI platform ecosystem that AIPACK is a credible, community-governed standard worth implementing.
5. Conformance program alignment: AIPACK's conformance harness (90 vectors, dual implementations) is designed to align with CNCF conformance program practices as the project matures.

Benefit to the landscape

AIPACK benefits the Cloud Native Landscape by:

1. Filling the composition gap: CNCF ModelPack packages individual model weights. AIPACK addresses what happens after weights are assembled into multi-component agents — the layer where production AI actually runs. No existing CNCF project addresses composite agent packaging.

2. Extending supply chain security to AI: The CNCF supply chain stack (Sigstore + in-toto + SLSA) protects containers. AIPACK extends this to AI agents, adding type-slot enforcement, digest closure for composite artifacts, and policy-gated promotion — capabilities containers don't need but AI agents do.

3. Demonstrating OCI 1.1 Referrers: AIPACK is a high-value, concrete use case for OCI 1.1 Referrers — one of the most underutilized capabilities in the OCI ecosystem. Widespread AIPACK adoption would drive Referrers implementation across registries.

4. Bridging CNCF and regulation: AIPACK ships with compliance profiles mapping to FedRAMP Moderate, CMMC L3, and EU AI Act — bridging the gap between CNCF tooling and regulatory requirements that AI deployments face.

5. Providing a conformance harness: The 90-vector conformance suite and dual implementations provide a vendor-neutral verification surface that any registry (Harbor, Zot, GHCR) or runtime (vLLM, Triton, Ollama) can implement against.

Cloud native 'fit'

AIPACK is cloud native in its core architecture:

• Container-native storage: All artifacts are OCI artifacts stored in OCI-compliant registries. No new storage infrastructure.
• Digest-addressed: Every artifact and composition is identified by SHA-256 digest, following the OCI content-addressable model.
• Declarative policy: Promotion gates are declarative YAML policy bundles evaluated by OPA/Rego — the CNCF policy standard.
• Observable: Runtime attestation emission uses OpenTelemetry semantic conventions under ai.aipack.*.
• Signed: All manifests and attestations use Sigstore (Fulcio + Rekor) for keyless signing, with ed25519 for air-gap environments.
• Attested: Attestation envelopes use in-toto, the CNCF attestation standard.
• Composable: The specification models agents as DAGs (Directed Acyclic Graphs) of typed artifacts — a cloud native composition pattern.

Cloud native 'integration'

AIPACK complements and depends on:

CNCF Project	Integration
OCI Distribution 1.1	Core storage and transport. AIPACK manifests are OCI artifacts; attestations are linked via Referrers API.
Sigstore (Fulcio + Rekor)	Keyless signing of manifests and attestations. Rekor provides transparency log for inclusion proofs.
in-toto	Attestation envelope format. AIPACK defines 75 predicate types in the in-toto framework.
OpenTelemetry	Runtime observability. AIPACK specifies ai.aipack.* semantic conventions for agent runtime telemetry.
OPA / Rego	Policy evaluation engine for promotion gates, quarantine triggers, and compliance enforcement.
Harbor	Registry that implements OCI 1.1 Referrers — a target deployment platform for AIPACK artifacts.
Zot	Registry used in AIPACK's CI for OCI round-trip conformance testing.

AIPACK also consumes SLSA provenance predicates (OpenSSF) and CycloneDX AI/ML SBOM extensions (OWASP).

Cloud native overlap

AIPACK overlaps with:

• CNCF ModelPack: ModelPack packages individual model weights as OCI artifacts. AIPACK addresses the composition layer above — assembling weights with adapters, tools, and guardrails into agents. The two are complementary: a ModelPack-packaged base model is a valid AIPACK BaseModel artifact. We are actively coordinating with the ModelPack community to ensure alignment.
• OpenSSF SLSA: AIPACK uses SLSA provenance predicates but adds AI-specific attestation types (safety reviews, red-team evals, guardrail coverage tests) that SLSA does not cover. No conflict — AIPACK extends SLSA for the AI domain.
• OWASP CycloneDX: CycloneDX AI/ML extensions describe AI model components in SBOMs. AIPACK provides the runtime verification and policy enforcement layer that CycloneDX SBOMs describe but don't enforce. Complementary.

Similar projects

• CNCF ModelPack — packages individual model weights (complementary, not competing)
• KitOps (Kitfile format) — packages model + code for deployment. AIPACK focuses on supply chain verification and composition, not deployment packaging. Different layer.
• Hugging Face Hub — model hosting platform. Not a specification. AIPACK could be implemented by the HF Hub as a verification layer.
• ONNX — model interchange format. Addresses model format, not supply chain or composition. Different concern.

No existing project in the CNCF or elsewhere addresses the specific combination of: (1) composite agent composition, (2) digest-closed verification, (3) attestation-linked OCI artifacts, and (4) compliance policy enforcement for AI workloads.

Landscape

No, AIPACK is not yet listed on the Cloud Native Landscape. We intend to submit a landscape entry upon Sandbox acceptance.

Insights

No, AIPACK is not yet listed on LFX Insights. We will complete LFX project setup upon acceptance.

CNCF policies

Trademark and accounts

• If the project is accepted, I agree to donate all project trademarks and accounts to the CNCF

IP policy

• If the project is accepted, I agree the project will follow the CNCF IP Policy

Will the project require a license exception?

N/A. The project uses Apache 2.0, which is on the CNCF approved license list. All dependencies (Go and Rust ecosystems) use CNCF-compatible licenses.

Project "Domain Technical Review"

Not yet completed. We intend to engage CNCF TAG-Security for a Day 0 General Technical Review prior to or during the Sandbox application review. The completed questionnaire will be at docs/CNCF-TECHNICAL-REVIEW.md.

Contact information

Application contact email(s)

mnchorfa@ckodex.org

Contributing or sponsoring entity signatory information

Name	Country	Email address
Mohamed N. Chorfa	Canada	mnchorfa@ckodex.org

Additional information

CNCF contacts

No existing CNCF leadership contacts. We welcome introductions to TAG-Security and TAG-Runtime chairs.

Additional information

• Specification document: AIPACK-SPEC-0.1.md (2333 lines, 24 sections)
• Conformance suite: 90 vectors covering all 27 schemas, validated in CI
• Reference implementations: Go (aipack-go/) and Rust (aipack-rust/), both with full conformance harness
• Compliance profiles: FedRAMP Moderate, CMMC L3, EU AI Act
• IANA registration: 16 media type registration requests submitted to media-types@iana.org for community review per RFC 6838 §5.2 (2026-07-06). Registrations cover 15 manifest types (application/vnd.ai.{artifact}.v1+json) and 1 content layer type (application/vnd.ai.basemodel.weights.v1.safetensors). Formal submission via the IANA web form will follow after the expert review period. See iana-media-type-registration.md and docs/IANA-SUBMISSION-GUIDE.md.
• Documentation site: https://ckodex-labs.github.io/aipack-spec/
• CI/CD: 8 GitHub Actions workflows, all green on main
• Air-gap handoff (§17): ed25519 signatures, simulated RFC 3161 TSA, ZSTD bundle format — for regulated/air-gapped environments
• Related CKODEX specifications: AIBOM-SPEC (AI Bill of Materials), SHIELD-SPEC (weight-level forensic lineage), OIS (Open Inference Signals), CE-SPEC (context governance) — AIPACK is the composition layer in this family

AIPACK is designed from the ground up to be a CNCF-native specification. We are not seeking a home because we have nowhere else to go — we are seeking the CNCF because it is the correct home for a specification built on CNCF primitives, serving the CNCF ecosystem, and governed by CNCF principles.