docs(security): add Ollama vulnerabilities and air-gapped protocol

- Add known Ollama vulnerabilities (CNVD-2025-04094, OOB write, model poisoning)
- Add 3-stage air-gapped model verification protocol
- Correct RAM requirements: 32GB min for 24B, 48GB for 32B+64K
- Document KV Cache Quantization (q4_0, reduces cache 75%)
- Add warning for non-agentic models (Llama3.1:8b = 15% SWE-bench)
- Bump version to 1.4.1

Sources: Cisco Shodan Case Study, Perplexity research report

Co-Authored-By: Claude <noreply@anthropic.com>

Author: FlorianBruniaux

CHANGELOG.md

@@ -9,7 +9,44 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-**Security**
+**Security Documentation (Ollama)**
+- 🔐 Added Ollama security vulnerabilities section in `docs/SECURITY.md`:
+  - CNVD-2025-04094: No authentication by default (Critical)
+  - Model File OOB Write: RCE potential via malformed .gguf (High)
+  - Model Poisoning: Unrestricted upload API (High)
+- 🔐 Added recommended hardening steps (firewall, resource limits)
+- 🔐 Source: Cisco Shodan Case Study on Ollama (2025)
+
+**Air-Gapped Model Verification Protocol**
+- 🔒 Added 3-stage verification protocol in `docs/SECURITY.md`:
+  - Stage 1: Download with SHA-256 checksums
+  - Stage 2: Transfer with archive verification
+  - Stage 3: Import with individual checksum verification
+- 🔒 Added audit trail requirements for regulated environments
+- 🔒 Reference: GitHub Issue #9756 (Ollama cannot verify integrity in air-gapped)
+
+**KV Cache Quantization Documentation**
+- ✨ Documented `OLLAMA_KV_CACHE_TYPE=q4_0` (Ollama 2025 feature)
+- ✨ Reduces KV cache memory by ~75% (48GB → 12GB for 64K context)
+- ✨ Enables 64K context on 32GB machines
+
+### Changed
+
+**Memory Requirements Updated**
+- 🔧 Corrected RAM specs in `CLAUDE.md`:
+  - Devstral 24B: 30-37GB total (was 23-27GB)
+  - Granite4 32B: 34-41GB total
+  - **Minimum**: 32GB for 24B, **48GB recommended** for 32B + 64K
+- 🔧 Updated `docs/OPTIMISATION-M4-PRO.md` with q4_0 cache type
+
+**Model Recommendations**
+- ⚠️ Added warning for non-agentic models in `CLAUDE.md`:
+  - CodeLlama:13b (~40% SWE-bench) - No tool calling
+  - Llama3.1:8b (**15%** SWE-bench) - "Catastrophic failure" on agentic tasks
+- ⚠️ Note: High HumanEval ≠ agentic capability (Llama3.1:8b = 68% HumanEval but 15% SWE-bench)
+
+### Security
+
 - 🔐 Added `.gitleaks.toml` configuration for secret detection
 - 🔐 Added GitHub Actions workflow `.github/workflows/security-scan.yml` for automated security scanning
 - 🔐 Gitleaks scans on every push/PR to detect accidentally committed credentials

CLAUDE.md

@@ -156,8 +156,13 @@ ollama create devstral-64k -f ~/.ollama/Modelfile.devstral-64k
 **Verify effective context:** `ollama ps` (not `ollama show`)
 
 **Memory footprint on M4 Pro 48GB with 64K context:**
-- Devstral Q4_K_M: 15GB model + 8-12GB cache = **23-27GB total** → ~21GB libre
-- Recommendation: 32K for comfort, 64K possible but tight
+- Devstral Q4_K_M (24B): 18-22GB model + 12-15GB KV cache = **30-37GB total**
+- Granite4 (32B): 22-26GB model + 12-15GB KV cache = **34-41GB total**
+- **Minimum RAM**: 32GB for 24B models, **48GB recommended** for 32B + 64K context
+
+**KV Cache Quantization (Ollama 2025 feature):**
+- Enable with `OLLAMA_KV_CACHE_TYPE=q4_0` to reduce cache memory by ~75%
+- Enables 64K context on 32GB machines (previously required 48GB+)
 
 **Recommendations by Project Size:**
 | Project Size | Files | Recommended Solution |
@@ -177,6 +182,14 @@ ollama create devstral-64k -f ~/.ollama/Modelfile.devstral-64k
 | ibm/granite4:small-h | 32B (9B active) | ~62% | 1M | Long context, 70% less VRAM |
 | qwen3-coder:30b | 30B | 85% | 256K | Highest accuracy, needs template work |
 
+**⚠️ Models NOT recommended for agentic tasks:**
+| Model | SWE-bench | Why Not |
+|-------|-----------|---------|
+| CodeLlama:13b | ~40% | No tool calling, weak on multi-file editing |
+| Llama3.1:8b | **15%** | "Catastrophic failure" on agentic tasks - cannot reliably use tools |
+
+> **Note**: High HumanEval scores (Llama3.1:8b = 68%) do NOT indicate agentic capability. SWE-bench measures real GitHub issue resolution, which requires tool use and multi-step reasoning.
+
 **Sources:**
 - [Taletskiy blog](https://taletskiy.com/blogs/ollama-claude-code/)
 - [docs.ollama - Context](https://docs.ollama.com/context-length)

docs/OPTIMISATION-M4-PRO.md

@@ -12,13 +12,15 @@
 
 ```bash
 OLLAMA_FLASH_ATTENTION=1          # Flash Attention pour Gemma 3/Qwen 3
-OLLAMA_KV_CACHE_TYPE=q8_0         # KV Cache optimisé pour M4 Pro
+OLLAMA_KV_CACHE_TYPE=q4_0         # KV Cache quantization - reduces memory by ~75%
 OLLAMA_NUM_PARALLEL=4             # 4 requêtes parallèles
 OLLAMA_MAX_LOADED_MODELS=3        # 3 modèles chargés simultanément
 OLLAMA_CONTEXT_LENGTH=8192        # Contexte optimal pour 32B
 OLLAMA_KEEP_ALIVE=24h             # Garde le modèle en RAM 24h
 ```
 
+> **New in 2025**: `OLLAMA_KV_CACHE_TYPE=q4_0` enables KV cache quantization, reducing cache memory from ~48GB to ~12GB for 64K context. This makes 64K context feasible on 32GB machines.
+
 ### Performances Attendues
 
 | Métrique | Valeur |

docs/SECURITY.md

@@ -185,6 +185,88 @@ cco                      # Should still work
 ❯ Write a function      # Works offline
 ```
 
+#### ⚠️ Ollama Security Vulnerabilities (January 2026)
+
+**CRITICAL: Ollama has known security vulnerabilities that require operational mitigation.**
+
+| Vulnerability | Severity | Description | Mitigation |
+|---------------|----------|-------------|------------|
+| **CNVD-2025-04094** | 🔴 Critical | No authentication by default - any network access to port 11434 can call API | Never expose port 11434; firewall to 127.0.0.1 only |
+| **Model File OOB Write** | 🔴 High | Malformed .gguf files can trigger out-of-bounds write (RCE potential) | Only load models from trusted sources; verify checksums |
+| **Model Poisoning** | 🟡 High | Unrestricted model upload API allows backdoored models | Disable upload API; whitelist approved models |
+
+**Recommended Hardening**:
+```bash
+# 1. Firewall: Block external access to Ollama
+sudo ufw deny 11434
+# Or allow only localhost
+sudo ufw allow from 127.0.0.1 to any port 11434
+
+# 2. Resource limits (prevent DoS)
+export OLLAMA_MAX_QUEUE=5
+export OLLAMA_NUM_PARALLEL=1
+export OLLAMA_MAX_LOADED_MODELS=1
+
+# 3. Run as non-root user (if containerized)
+# See Dockerfile example in docs
+```
+
+**Source**: [Cisco Shodan Case Study on Ollama (2025)](https://blogs.cisco.com/security/detecting-exposed-llm-servers-shodan-case-study-on-ollama)
+
+---
+
+#### 🔒 Air-Gapped Model Verification Protocol
+
+**Problem**: Ollama cannot verify model integrity in air-gapped environments (GitHub Issue #9756). When models are transferred offline, the system assumes manifest data is authoritative.
+
+**3-Stage Verification Protocol**:
+
+**Stage 1: Download (Internet-connected system)**
+```bash
+# 1. Pull model from ollama.com
+ollama pull devstral-small-2
+
+# 2. Compute SHA-256 for each model file
+sha256sum ~/.ollama/models/blobs/* > model-checksums.sha256
+
+# 3. Document in audit log
+echo "$(date) | devstral-small-2 | $(cat model-checksums.sha256)" >> model-audit.log
+```
+
+**Stage 2: Transfer (Physical media)**
+```bash
+# 1. Create archive
+tar -czf ollama-models.tar.gz ~/.ollama/models/
+
+# 2. Compute archive checksum
+sha256sum ollama-models.tar.gz > archive.sha256
+
+# 3. Transfer via USB (scan for malware before transfer)
+# 4. Keep checksums on separate medium for verification
+```
+
+**Stage 3: Import (Air-gapped system)**
+```bash
+# 1. Verify archive checksum
+sha256sum -c archive.sha256
+
+# 2. Extract models
+tar -xzf ollama-models.tar.gz -C ~/
+
+# 3. Verify individual model checksums
+sha256sum -c model-checksums.sha256
+
+# 4. Create Modelfile and register
+ollama create devstral-airgap -f ~/.ollama/Modelfile.devstral
+```
+
+**Audit Trail Requirements** (for regulated environments):
+- Model name, version, parameter count
+- Source URL (ollama.com vs HuggingFace vs private)
+- SHA-256 hash at each transfer stage
+- Date, time, operator identity
+- Approval chain before loading
+
 ---
 
 ### 1.3 MCP Server Data Sharing
@@ -1424,6 +1506,6 @@ sudo ifconfig en0 up                       # Re-enable network
 
 ---
 
-**Document Version**: 1.0.0
-**Last Updated**: 2026-01-22
+**Document Version**: 1.1.0
+**Last Updated**: 2026-01-23
 **Maintained By**: cc-copilot-bridge project

scripts/VERSION

@@ -1 +1 @@
-1.2.0
+1.4.1