_{Part of the SZL Holdings governed estate — claims are designed to carry checkable receipts. Verification proves integrity & origin, never accuracy or performance.}

⬛ NOT A RUNNABLE MODEL. This repository is a governance kernel / artifact set (specifications, invariants, receipts, or reference material) published under the SZL honesty doctrine. It deliberately declares no pipeline_tag and no base_model because none truthfully applies — you cannot load this repo into an inference pipeline, and tagging it otherwise would fake semantics. Verification of anything here proves integrity & origin only, never accuracy or performance. Λ = Conjecture 1 · ADVISORY.

szl-governed-norm

Kernel Hub migration (verified 2026-07-15): get_kernel(...) now resolves the matching first-class Kernel Hub repository. Its main and stable v1 refs both pin verified revision fe16433d44be03177167e8355c43a4bfdc63e03e. This model-type repository is retained as the legacy source/card mirror; the compatibility-only lifecycle documented below is unchanged.

Lifecycle: DEPRECATED FOR NEW ADOPTION · COMPATIBILITY-ONLY · ARTIFACT RETAINED

Canonical development has moved to SZLHOLDINGS/szl-lambda-gate. The normalization implementation and receipt chain were folded into the successor's GitHub source under szl_lambda_gate.governed_norm. Nothing in this repository has been deleted, renamed, or hidden; it remains a reversible compatibility artifact for existing callers.

Migration gate: the current immutable Hub successor revision fb0481cfc4046c52898aa83a96b1c118a6372f1a does not yet publish the governed_norm compatibility subtree. It is therefore not a drop-in Hub replacement yet. Existing production callers should pin this legacy artifact at 27faddd262c6ee36d08aad9ae234595d75a999f1 until a successor revision containing the folded package is published and independently verified.

Compatibility kernel retained on the Hugging Face Kernel Hub. Correctness-verified RMSNorm & LayerNorm with optional governance receipts that make calls auditable at the kernel layer. (v0.2.0)

Immutable evidence

Evidence	Immutable reference	What it proves
Legacy Hub artifact	27faddd262c6ee36d08aad9ae234595d75a999f1	Retained compatibility package and exact pre-lifecycle-card bytes.
Legacy GitHub source	3ef27eb7ebf491b0a6ce69be170ecef4c37885a2	Source-side deprecation notice, migration map, tests, and kernel implementation.
Successor GitHub source	d3a91edbe2595bac1ead1007963b4b7b8857eb19	Folded szl_lambda_gate.governed_norm source and successor tests.
Current successor Hub artifact	fb0481cfc4046c52898aa83a96b1c118a6372f1a	Current published successor contents; compatibility subtree is not present yet.

Lifecycle labels describe support and consolidation, not model quality: this repository contains a pure-PyTorch kernel and no trained weights.

Most Kernel Hub kernels compete on raw speed. szl-governed-norm opens a different axis: verifiable provenance. Same clean get_kernel one-liner, plus a SHA3-256 hash-chained audit trail no other kernel ships.

A universal (pure-PyTorch) normalization kernel from SZL Holdings. It gives you a trustworthy reference implementation of RMSNorm and LayerNorm that runs on CPU and CUDA and plays nicely with torch.compile — plus an opt-in governed mode that emits content-addressed, SHA3-256 hash-chained receipts of each normalization call.

---

What it is

szl-governed-norm is a Kernel Hub kernel built for two things people actually need from a normalization layer:

1. A correctness reference you can trust. RMSNorm and LayerNorm are implemented in pure PyTorch, computed in float32 for numerical stability and cast back to the input dtype (the standard Llama-style convention). They are verified against PyTorch's own references in the test suite.
2. Provenance you can verify. Run any call with governed=True and the kernel records a small, deterministic receipt — input shape/dtype, eps, and a SHA3-256 digest of the (rounded) output — hash-chained to the previous receipt. The result is an independently re-walkable audit trail for a sequence of kernel calls.

This is a universal kernel: it ships no hand-tuned CUDA/Triton binary. Its differentiator is verifiable governance, not raw FLOPs.

---

Quickstart

pip install kernels torch

import torch
from kernels import get_kernel

# Current `kernels` (>=0.15) requires an explicit revision/version + trust flag for org kernels:
# Compatibility use only: pin the immutable retained artifact.
gn = get_kernel(
    "SZLHOLDINGS/szl-governed-norm",
    revision="27faddd262c6ee36d08aad9ae234595d75a999f1",
    trust_remote_code=True,
)

print(gn.__version__)        # "0.2.0"
print(gn.selfcheck())        # one-shot correctness + receipt verification

x = torch.randn(4, 1024, dtype=torch.float16, device="cuda")
w = torch.ones(1024, dtype=torch.float16, device="cuda")

# Plain path — drop-in normalization.
y = gn.rms_norm(x, weight=w, eps=1e-6)
z = gn.layer_norm(x, weight=w, eps=1e-5)

Governed mode + receipts

# Same math, plus an audit receipt.
y = gn.rms_norm(x, weight=w, eps=1e-6, governed=True)

print(gn.receipt_head())     # SHA3-256 head over all governed calls
print(gn.receipt_verify())   # {'ok': True, 'depth': 1, 'first_break_seq': -1, 'head': '...'}

# Per-call chain (no global state — ideal for concurrent threads/requests):
chain = gn.ReceiptChain()
y = gn.rms_norm(x, weight=w, eps=1e-6, chain=chain)
print(chain.verify())        # (ok, depth, first_break_seq)

Governance is strictly opt-in: with governed=False (the default) nothing is recorded, and the kernel never writes to disk or the network.

---

API reference

Functional API

Function	Signature	Notes
rms_norm	rms_norm(x, weight=None, eps=1e-6, governed=False, chain=None)	RMSNorm over the last dim. Emits a receipt when governed=True or a chain is passed.
layer_norm	layer_norm(x, weight=None, bias=None, eps=1e-5, governed=False, chain=None)	LayerNorm over the last dim.
fused_add_rms_norm	fused_add_rms_norm(x, residual, weight=None, eps=1e-6, governed=False, chain=None)	Residual-add + RMSNorm (pre-norm transformer block). Returns (y, new_residual).
selfcheck	selfcheck()	One-shot correctness + governance check; returns a JSON-able dict, never raises.

All compute in float32 and cast back to the input dtype. rms_norm matches a Llama-style RMSNorm reference; layer_norm matches torch.nn.functional.layer_norm for the last-dim case (verified in tests/, 165 passing).

Governance receipt API

Function	Returns	Description
receipt_head()	str	SHA3-256 head of the default receipt chain ("0"*64 if empty).
receipt_count()	int	Number of governed calls recorded on the default chain.
receipt_tail(n=10)	list[dict]	The last n receipts.
receipt_verify()	dict	Re-walks the chain; returns {ok, depth, first_break_seq, head}.
ReceiptChain	class	Construct your own isolated chain (emit, head, count, tail, verify).

nn.Module layers (for the kernels layer-mapping mechanism)

Pure torch.nn.Module subclasses (only forward, no custom __init__, no class variables) so they drop in over an existing module:

Layer	Reads from host module
RMSNorm	self.weight (optional), self.variance_epsilon or self.eps
LayerNorm	self.weight/self.bias (optional), self.eps
FusedAddRMSNorm	self.weight (optional), self.variance_epsilon or self.eps

---

Governed mode — provenance at the kernel layer

When a call runs in governed mode, the kernel builds a receipt body, takes a SHA3-256 digest over its canonical JSON, and links each receipt to the previous one via a prev field — a classic hash chain:

{
  "seq": 0, "op": "rms_norm", "in_shape": [4, 1024], "in_dtype": "float16",
  "eps": 1e-06, "out_digest": "<sha3-256 of the rounded output>", "prev": "<prev digest or 64 zeros>"
}

receipt_verify() re-walks the chain and reports the first break, so tampering with any receipt invalidates everything downstream. This is the same provenance doctrine SZL Holdings applies across its a11oy governed-AI platform — applied here at the lowest layer of the stack, the kernel itself.

---

Correctness & honesty

• Universal, pure-Python kernel — a correctness reference, verified against PyTorch's own references (165 passing tests).
• Runs on CPU and CUDA, torch.compile(fullgraph=True)-compatible. Under compile, governed numerics are unchanged but receipt emission (an eager byte-hashing side effect) is skipped — govern at the eager audit boundary.
• No fabricated benchmarks. This is not a hand-tuned CUDA/Triton binary; we make no speedup claims.
• The receipt digest is an integrity fingerprint, NOT a cryptographic signature. It proves a receipt sequence is internally consistent and untampered — not authorship. DSSE signing is a separate, out-of-band concern.
• Governance is opt-in and side-effect-free by default.

---

Compatibility

Requirement	Version
Python	3.9+
PyTorch	torch>=2.5
Dependencies	Python standard library + torch only

---

Interactive demo

Live demos (in-browser, nothing to install) — governed-norm-holo (this kernel's holographic receipt-chain demo) · receipt-chain-live (receipt-chain walk-through) · szl-kernels-live (unified suite demo).

In the meantime, the quickstart above runs fully locally in any Python environment. See the szl-kernels model card for the full kernel suite.

---

SZL Kernels Suite

Part of the szl-kernels governed-kernel suite — the hub links every member, and each member links back to the hub so no leaf is orphaned:

Kernel	Lane
szl-kernels	hub — unified suite, cross-kernel UnifiedReceiptChain
szl-governed-norm (this repo)	RMSNorm/LayerNorm + SHA3-256 receipts
szl-lambda-gate	advisory Λ gate (Conjecture 1, OPEN)
governed-inference-meter	MEASURED-joule energy accounting (NVML)
szl-govsign	signed governance attestation (DSSE / in-toto)
szl-blocked	honest-BLOCKED state + EU AI Act Annex IV DRAFT
szl-provctl	provenance-DAG verify + in-toto/SLSA interop

Live Spaces: a11oy · hatun-mcp.

Related — Governed Kernels collection: Governed Kernels & Verifiers groups the whole family in one page. Live console: a11oy · a-11-oy.com · llm-router · receipt verifier · receipt spec (hub).

---

About SZL Holdings

SZL Holdings, founded by Stephen Lutar, builds governed-AI infrastructure — provenance, observability, and security tooling for AI systems. Its work includes the a11oy governed-AI platform and killinchu, and a large public dataset corpus on the SZL Holdings Hugging Face org.

License

Apache-2.0. Copyright 2026 SZL Holdings.

---

SZL Holdings · Doctrine v11 LOCKED 749/14/163 @ c7c0ba17 · Λ = Conjecture 1 · SLSA L1 honest
Signed-off-by: Stephen Lutar stephenlutar2@gmail.com

_{SZL Holdings · governed normalization · provenance at the kernel layer · a-11-oy.com · github.com/szl-holdings · huggingface.co/SZLHOLDINGS}

---

Citation

Cite this. Part of the SZL Holdings Ouroboros Thesis (Governed Post-Determinism).
Concept DOI (always-latest): 10.5281/zenodo.19944926.
Author: Stephen P. Lutar Jr. · ORCID 0009-0001-0110-4173 · License CC-BY-4.0.
Full DOI-pinned lineage (v1→v26) + the 8 papers: szl-papers PAPERS_INDEX.
No artifact-specific DOI is minted for this model; the concept DOI above covers the program.

Honesty (Doctrine v11): Λ unconditional uniqueness is Conjecture 1 (machine-checked FALSE as stated) — never a theorem; conditional uniqueness is Theorem U (axiom-free). Locked-proven formulas = exactly 8 {F1,F4,F7,F11,F12,F18,F19,F22}; ~185 experimental theorems are a separate CI-green tier; Khipu BFT safety = Conjecture 2. Trust never 100%.

@misc{lutar_szl_ouroboros,
  author    = {Lutar, Stephen P., Jr.},
  title     = {SZL Holdings --- The Ouroboros Thesis (Governed Post-Determinism)},
  year      = {2026},
  publisher = {Zenodo},
  doi       = {10.5281/zenodo.19944926},
  url       = {https://doi.org/10.5281/zenodo.19944926},
  note      = {Concept DOI --- always resolves to the latest version. ORCID 0009-0001-0110-4173. CC-BY-4.0.}
}

Signed-off-by: Stephen Lutar stephenlutar2@gmail.com

Files in this repo

Path	What it is
build/torch-universal/szl_governed_norm/__init__.py	public API — rms_norm, layer_norm, receipts, selfcheck()
build/torch-universal/szl_governed_norm/_norm.py	the normalization math (pure PyTorch, float32 internal)
build/torch-universal/szl_governed_norm/_receipt.py	SHA3-256 hash-chained receipt engine
build/torch-universal/szl_governed_norm/layers.py	nn.Module wrappers
build.toml · metadata.json	Kernel Hub build/metadata manifests
LICENSE · SECURITY.md	Apache-2.0 · security policy

---

SZL Holdings · a-11-oy.com · szl-lambda-gate

_{SLSA: L1 honest · L2 attested · L3 roadmap. Λ = Conjecture 1 (advisory, never a theorem). Trust ceiling 0.97 — never 100%. Labels honest by default: MEASURED / REPORTED / MODELED / HEURISTIC / UNKNOWN / UNAVAILABLE. locked-proven = exactly 8 {F1,F4,F7,F11,F12,F18,F19,F22}.}