Open source · local first · public-interest software

Public open-source research preview · exact downloads available · production use not authorized

UVLM IntegrityLock Community Edition

IntegrityLock helps people, teams, researchers, and local-AI enthusiasts fingerprint exact files, build closed package records, create deterministic archives, verify manifests and signatures, preserve provenance events, compare release lineages, and create optional encrypted package vaults—without requiring an account, activation, payment, model provider, or remote service.

  • Version 0.2.0-alpha.5
  • MPL-2.0
  • No charge
  • No account
  • No activation
  • No network required
  • Unsigned Windows x64
  • Production use not authorized
Choose a download Read assurance & verification

What IntegrityLock does

IntegrityLock creates inspectable relationships among local files, hashes, manifests, signatures, archives, provenance events, and release versions. It helps answer a precise question: Do these observed bytes match the declared bytes and lineage?

Hash and index

Hash text, files, and directories; create closed file indexes and SHA256SUMS ledgers.

Seal and verify

Create deterministic ZIP archives, detached checksums, manifests, and replayable verification records.

Sign and validate

Generate user-owned Ed25519 keys, sign canonical manifests, and verify signatures without treating a key as automatic authority.

Protect a package

Create optional AES-256-GCM .uvlock package vaults using a user-controlled passphrase.

Preserve provenance

Initialize, append, and verify hash-chained events so later reviewers can inspect an artifact’s declared history.

Compare lineage

Compare predecessor and successor indexes to identify additions, removals, modifications, and unchanged files.

How it can support local-first AI research

IntegrityLock does not include or call an AI model. It can sit beside Ollama, llama.cpp, LM Studio, a desktop model, a Python pipeline, or another user-selected local tool to preserve the exact experiment inputs and outputs.

Seal an experiment

Preserve the model identity, quantization, prompts, source set, adapter configuration, generation settings, raw output, reviewed output, and metrics as one exact package.

Compare a baseline

Compare an ordinary local-model run with a revised, governed, or differently configured run and see which declared bytes changed.

Replay responsibly

Share exact artifact identities so another researcher can verify whether they possess the same declared files before interpreting the results.

Performance boundary. IntegrityLock does not improve model weights or make a model more intelligent. It may improve experiment traceability, replayability, drift detection, artifact completeness, and correction. Claims of model-quality improvement require a separately declared baseline, model identity, task set, metric, and uncertainty.

Five-minute local start

The exact commands and available interfaces are documented in the version-bound Technical Manual. A typical Windows portable workflow begins like this: 

$IL = 'C:\path with spaces\IntegrityLock.exe'

& $IL --json doctor
& $IL --json hash file .\my-file.txt
& $IL --json index directory .\my-folder `
  --out .\my.FILE_INDEX.json
& $IL --json seal directory .\my-folder `
  --out .\my-package.zip --bundle-id MY-PACKAGE
& $IL --json verify artifact .\my-package.zip `
  --sidecar .\my-package.zip.sha256

Choose your download

Every button below points to an exact approved artifact and its named SHA-256 sidecar. The public source was retrieved through a logged-out browser after upload and matched its approved digest. The remaining artifacts were uploaded from the exact approved bytes with matching sidecars; the declared transmission-evidence boundary is documented on the Assurance & Verification page.

Exact release identities

A filename is not an identity. Before extraction, installation, or execution, calculate the SHA-256 of the downloaded bytes and compare it with the exact value below and its named sidecar.

Public source ZIP
90c6844f4de8a0d27f584a2adfdc4ebf693ae41b629b10f03a61c04f013fb736
Python wheel
3a7f8be73a1dcd826a48e8bf66577a1c61689d314158efafb8d3f8b1e38e0e83
Python sdist
f5aa54ccdcc1d8e3bcea35d0f7ac21a5dc50affbf9a28d7c448a42a3445d402d
Windows portable
30e51f83caa6f3c2a35f93c110b70d7262997899232a3a059a1c79b935fb5099
Windows installer
9c18ed917000aff89937d1378cbfb933b504974348a7c4929381294dcb75e5ee
Hashes are not truth. A matching SHA-256 establishes that observed bytes match the declared bytes. It does not establish that their contents are true, correct, safe, lawful, authored by a named person, free from malware, or authorized for a particular use. A valid signature ties bytes to a key; it does not establish the key holder’s identity or authority.

Known limitations

  • The Windows portable and installer candidate are unsigned. SmartScreen or organizational endpoint policy may warn, delay, quarantine, or block them.
  • Local security-product observations are not malware-absence certification.
  • Same-host deterministic build evidence is not a universal cross-host reproducibility claim.
  • IntegrityLock is not full-disk encryption, a backup system, a malware scanner, an identity service, or legal chain-of-custody certification.
  • Package vaults require user-controlled passphrase custody and do not replace backups, operating-system security, or endpoint controls.
  • The optional local HTTP interface is loopback-only. Loopback does not isolate the product from a malicious process running as the same user.
  • This alpha is an open-source research preview, not a production release or certification.