Peer-first model fetch

# The iroh endpoint binds at startup on every node.
tenzro-node --roles validator

# Open the iroh UDP port so peers can reach you directly.
# config.toml
[iroh]
bind_addr = "0.0.0.0:9001"

A node fetch consults connected iroh peers via a PeerHint before reaching Hugging Face. If a peer has the BLAKE3 already, the transfer runs over QUIC with every block BLAKE3-verified; if not, Hugging Face is the fallback. Point the CLI at a node with --rpc to drive that path.

tenzro model download timesfm-2.5 --rpc http://127.0.0.1:8545

On successful HF fetch the downloader publishes the blob into the local iroh-blobs store. Subsequent fetchers on this or any peer node skip the HF round trip — the network warms itself.

Weights are content-addressed. Every model carries a canonical hash record — the BLAKE3 root, the SHA-256, and the per-file manifest hash — recorded first-recorder-wins in the node's transparency log. Downloaded weights are checked against that record before load; a mismatch refuses the load. Read the record by model_id, or list every recorded hash.

tenzro model get-hash timesfm-2.5 --rpc http://127.0.0.1:8545
tenzro model list-hashes --rpc http://127.0.0.1:8545

Any artifact resolved this way is reachable through the unified scheme — tenzro://blob/<blake3-hex> — regardless of which path supplied the bytes.