Harden model download with timeout and checksum

tests/test_aiprocess.py

@@ -7,7 +7,12 @@ SRC = ROOT / "src"
 if str(SRC) not in sys.path:
     sys.path.insert(0, str(SRC))
 
-from aiprocess import _extract_cleaned_text, _supports_response_format
+from aiprocess import (
+    _assert_expected_model_checksum,
+    _extract_cleaned_text,
+    _supports_response_format,
+)
+from constants import MODEL_SHA256
 
 
 class ExtractCleanedTextTests(unittest.TestCase):
@@ -84,5 +89,14 @@ class SupportsResponseFormatTests(unittest.TestCase):
         self.assertFalse(_supports_response_format(chat_completion))
 
 
+class ModelChecksumTests(unittest.TestCase):
+    def test_accepts_expected_checksum_case_insensitive(self):
+        _assert_expected_model_checksum(MODEL_SHA256.upper())
+
+    def test_rejects_unexpected_checksum(self):
+        with self.assertRaisesRegex(RuntimeError, "checksum mismatch"):
+            _assert_expected_model_checksum("0" * 64)
+
+
 if __name__ == "__main__":
     unittest.main()