What does the safetensors format define (header layout, __metadata__, dtypes, alignment) and how can an agent read a model file's header without loading weights?

A .safetensors file is: 8 bytes (little-endian u64 N), N bytes of UTF-8 JSON header, then a raw byte buffer. The header maps tensor names to {dtype, shape, data_offsets[begin,end]} (offsets relative to the start of the byte buffer) and may contain a '__metadata__' string-to-string map. At the inspected commit the library accepts the dtypes listed in tensor.rs (BOOL through F64/U64, BF16, several FP8 and sub-byte types), caps the header at 100,000,000 bytes, requires contiguous gap-free offsets, and its writer sorts tensors by dtype alignment and pads the header with spaces to a multiple of 8. An agent can read the header with a few lines of standard code (no ML library) and learn tensor names, shapes, dtypes and metadata. Curator correction 2026-10-23 (discovery audit record C3-B595-05; sources re-fetched 2026-10-23, excerpts re-located by curator GET): Problem. The earlier finding states the library 'caps the header at 100,000,000 bytes', accepts dtypes listed in tensor.rs and pads the writer's header to a multiple of 8, but its cited URLs were the README format section and two ComfyUI utils.py ranges, none of which contain those details. Method. safetensors commit e246a256, tensor.rs: const MAX_HEADER_SIZE: usize = 100_000_000; the writer sorts by descending dtype alignment and forces 8-byte alignment of the header by padding with spaces. ComfyUI commit 46aad33e comfy/utils.py: safetensors_header(path, max_size=100*1024*1024) returns None above that size, i.e. 104,857,600 bytes, a different limit from the library's. So a header between 100,000,000 and 104,857,600 bytes would be refused by the library but read by ComfyUI's helper (inference). Changed since. ComfyUI main now also contains create_safetensors in comfy/utils.py (builds zero-valued descriptors, sorts by element size, pads the header to 8 bytes), which was absent at the cited commit. Limitations. Only the stated lines were read. Curator qualifications: README (byte-identical to producer pin 0a932f12) line 76 '8 bytes: N, an unsigned little-endian 64-bit integer'; line 83 '__metadata__ ... free form string-to-string map. Arbitrary JSON is not allowed'. tensor.rs line 10 'const MAX_HEADER_SIZE: usize = 100_000_000'; Dtype enum lists exactly 22 variants: BOOL F4 F6_E2M3 F6_E3M2 U8 I8 F8_E5M2 F8_E4M3 F8_E8M0 F8_E4M3FNUZ F8_E5M2FNUZ I16 U16 F16 BF16 I32 U32 F32 C64 F64 I64 U64. ComfyUI comfy/utils.py: line 86 '_SAFETENSORS_MAX_HEADER_SIZE = 100_000_000' used by the load path (lines 110-111 'header is too large'), and line 950 'def safetensors_header(safetensors_path, max_size=100*1024*1024)'. Rights/verification notes are shown as limitations (L00 0019/ADR-0011): they restrict reuse of the cited material or record what was not verified; they are not cleared by this summary. Limitations: [component_reuse_restriction] LICENSE text not read (metadata Apache-2.0). Evidence status: statements located in the cited sources by a correlated desk review (Claude); not executed; not independently reviewed.

{
  "citations": [
    {
      "url": "https://github.com/huggingface/safetensors",
      "note": "see curator disposition"
    },
    {
      "url": "https://github.com/comfyanonymous/ComfyUI",
      "note": "see curator disposition"
    }
  ]
}