Engineering evaluation brief
Static deployment evidence with explicit limits.
DEEPBOM analyzes TFLite, ONNX, Core ML, GGUF, SafeTensors, and ExecuTorch artifacts without executing model code. Web and CLI outputs share the same Artifact Evidence IR.
Adopt it where artifact identity, serialized contracts, reproducible derivations, and evidence gaps matter more than speculative performance prediction.
Architecture
| Execution | Browser-local or CLI-local. Original artifact bytes are not uploaded by the static audit path. |
|---|---|
| TFLite | Rust analyzer compiled to WebAssembly and executed behind Worker RPC. |
| Other formats | Bounded JavaScript parsers and range readers executed in an isolated metadata/static-audit Worker where payload work is heavy. |
| Evidence model | Artifact Evidence IR separates canonical artifact facts, static projections, and imported runtime observations. |
| Distribution | npm, PyPI, crates.io launcher, and the browser workspace. |
| Maintenance | Apache-2.0 public core, one primary maintainer, hash-pinned upstream evidence, automated release gates. |
CI entry point
npx deepbom self-test
npx deepbom audit model.tflite --output-format sarif --gate defectsEvidence gaps remain visible but do not fail the defect gate unless the deployment policy explicitly requires them.
What it will not infer
- Actual accelerator assignment without imported runtime or engine evidence.
- GPU tactics, latency, energy, accuracy, robustness, or clinical performance from an artifact alone.
- An executable graph for GGUF or SafeTensors, because those containers do not serialize one.
- A definite device-memory fit when allocator and runtime reserve contracts are unbound.
Try the exact path
Run npx deepbom self-test, audit one controlled artifact, inspect the top-level defects/cautions/evidence-needed summary, then retain the full JSON or evidence package for review.
Open the browser workspace or review the source and CI configuration.