--- tags: - kernel - governance - provenance - suite - doi:10.5281/zenodo.19944926 library_name: kernels license: apache-2.0 szl-governance: verdict: ADVISORY lambda: "Conjecture 1 (open) — uniqueness unproven; advisory only" energy: MEASURED-only (real NVML delta; None when unavailable) provenance: UnifiedReceiptChain (SHA3-256, op-agnostic, cross-kernel) honest_blocked: "a failed check stays failed — never faked green" --- # szl-kernels — the unified governed-kernel suite **The first kernel that governs provenance *across* ops, not just within one.** A `get_kernel`-discoverable suite that ties SZL Holdings' three governed kernels — [`szl-governed-norm`](https://huggingface.co/SZLHOLDINGS/szl-governed-norm), [`szl-lambda-gate`](https://huggingface.co/SZLHOLDINGS/szl-lambda-gate), and [`governed-inference-meter`](https://huggingface.co/SZLHOLDINGS/governed-inference-meter) — into **one shared, hash-chained `UnifiedReceiptChain`**, and anchors a governance/interop layer on top: [`szl-govsign`](https://huggingface.co/SZLHOLDINGS/szl-govsign) (signs the verdict), [`szl-blocked`](https://huggingface.co/SZLHOLDINGS/szl-blocked) (refuses honestly + derives EU AI Act Annex IV), and [`szl-provctl`](https://huggingface.co/SZLHOLDINGS/szl-provctl) (verifies the provenance DAG + bridges to in-toto/SLSA). > Every Kernel Hub leader competes on **FLOPs per op**. They do not sign their build artifacts, they do not surface an honest BLOCKED verdict, and they do not stitch provenance *across* ops. `szl-kernels` opens that lane: a real forward pass touching norm + an advisory Λ gate + an energy reading produces **one auditable, tamper-evident log** — not three disconnected ones. ## Quickstart ```bash pip install kernels torch ``` ```python import torch from kernels import get_kernel # Current `kernels` (>=0.15) requires an explicit revision/version + trust flag for org kernels: suite = get_kernel("SZLHOLDINGS/szl-kernels", revision="main", trust_remote_code=True) print(suite.list_kernels()) # the 3 numeric suite members + honest roles print(suite.list_series()) # the governance/interop companions (govsign, blocked, provctl) print(suite.selfcheck()) # one-shot CPU health: ALL checks pass # ONE shared chain spanning multiple ops: chain = suite.UnifiedReceiptChain() x = torch.randn(4, 64) y = suite.governed_rms_norm(chain, x, eps=1e-6) # governed_norm gate = suite.governed_lambda_gate(chain, torch.tensor([0.9,0.8,0.95])) # lambda_gate (advisory) e = suite.governed_measure_energy(chain) # energy_core (MEASURED-only) ok, depth, brk = chain.verify() # the WHOLE pass verifies as ONE chain print(ok, depth, chain.kernels_touched()) # True 3 ['governed_norm','lambda_gate','energy_core'] print(chain.to_json()) # export for offline third-party re-verification ``` ### Flagship — a governed transformer sub-block ```python blk = suite.GovernedBlock() res = blk.forward(x, gov_axes=torch.tensor([0.95, 0.9, 0.92])) print(res["chain_ok"], res["chain_depth"], res["kernels_touched"]) # norm + advisory Λ gate + energy + binding receipt = 4 ops, one verifiable chain. # The Λ gate is ADVISORY: it is recorded for audit, it does NOT alter the numerics. ``` ## Cookbook Three copy-paste recipes spanning the governed-kernel series. Every printed value is labeled **expected shape (not executed here)** — the shapes are transcribed from each kernel's committed API, not from a run on this card (SZL doctrine: never self-download to inflate counters, never fabricate an output). Λ stays **Conjecture 1 (OPEN)**; energy stays **MEASURED-only**; a BLOCKED verdict stays BLOCKED. ### 1 — One receipt chain across three ops (suite) ```python import torch from kernels import get_kernel suite = get_kernel("SZLHOLDINGS/szl-kernels", revision="main", trust_remote_code=True) chain = suite.UnifiedReceiptChain() x = torch.randn(4, 64) suite.governed_rms_norm(chain, x, eps=1e-6) # op 1: governed_norm suite.governed_lambda_gate(chain, torch.tensor([0.9, 0.8, 0.95])) # op 2: lambda_gate (ADVISORY) suite.governed_measure_energy(chain) # op 3: energy_core (MEASURED-only) ok, depth, first_break = chain.verify() print(ok, depth, chain.kernels_touched()) # expected shape (not executed here): # True 3 ['governed_norm', 'lambda_gate', 'energy_core'] # -> one hash-chain, three ops, verifies as ONE ordered sequence. # The Λ gate receipt is ADVISORY (Conjecture 1, OPEN): recorded, never proven trust. # energy_core reports joules=None + UNAVAILABLE_NO_NVML on CPU — never a fabricated joule. ``` ### 2 — honest-BLOCKED, not fake-green (szl-blocked) ```python from kernels import get_kernel blk = get_kernel("SZLHOLDINGS/szl-blocked", revision="main", trust_remote_code=True) chain = blk.UnifiedReceiptChain() policy = blk.deny_if_action_in({"exfiltrate", "delete_all"}) work = lambda v: v * 2 allowed = blk.governed_call(work, policy, chain, request={"action": "summarize"}, args=(21,)) blocked = blk.governed_call(work, policy, chain, request={"action": "exfiltrate"}, args=(21,)) print(allowed.blocked, allowed.output) print(blocked.blocked, blocked.output) # expected shape (not executed here): # False 42 -> ALLOWED path ran work(21); an ALLOW receipt is on the chain. # True None -> BLOCKED path: work was NEVER called, output is None, # a BLOCK receipt is recorded. Honest-BLOCKED, never faked green. ``` ### 3 — Sign then verify a governance verdict (szl-govsign / DSSE) ```python from kernels import get_kernel gs = get_kernel("SZLHOLDINGS/szl-govsign", revision="main", trust_remote_code=True) priv = gs.generate_ephemeral_keypair() # production: Sigstore keyless / cosign key, out-of-band pred = gs.build_governance_predicate( lambda_verdict = gs.LambdaVerdict(score=0.92, notes="advisory only — Conjecture 1 (OPEN)"), energy = gs.EnergyLabel(value=12.5, unit="joules"), # MEASURED-only decision = gs.GovernanceDecision(status="ALLOWED", reason="passed gates"), honest_blocked = False, ) subjects = [gs.Subject(name="szl_kernels/UnifiedReceiptChain", digest={"sha256": ""})] envelope = gs.attest(subjects, pred, priv) print(gs.verify(envelope, priv.public_key())) # expected shape (not executed here): # True -> DSSE envelope (ECDSA P-256) verifies: authorship + integrity of the verdict. # Any tamper -> verify() returns False (fails closed). # The signature does NOT upgrade Λ to proven trust: proven_trust is locked False. ``` > These recipes chain across three separately published, `get_kernel`-discoverable kernels. > See [`szl-provctl`](https://huggingface.co/SZLHOLDINGS/szl-provctl) to turn any of these > chains into a spec-exact in-toto v1 / SLSA v1 statement the wider supply-chain world verifies. ## The governed-kernel series Independently published, `get_kernel`-discoverable kernels that share one `UnifiedReceiptChain`. The first three are the **numeric core**; govsign + blocked + provctl are the **governance / interop layer**. | Kernel | Lane | Live hologram | |---|---|---| | [`szl-governed-norm`](https://huggingface.co/SZLHOLDINGS/szl-governed-norm) | RMSNorm/LayerNorm + SHA3-256 receipts | [`governed-norm-holo`](https://szlholdings-governed-norm-holo.static.hf.space) ✅ **live** | | [`szl-lambda-gate`](https://huggingface.co/SZLHOLDINGS/szl-lambda-gate) | advisory Λ gate (Conjecture 1, OPEN) | [`lambda-gate-holo`](https://szlholdings-lambda-gate-holo.static.hf.space) ✅ **live** | | [`governed-inference-meter`](https://huggingface.co/SZLHOLDINGS/governed-inference-meter) | MEASURED-joule energy accounting | [`energy-attest-holo`](https://szlholdings-energy-attest-holo.static.hf.space) ✅ **live** | | [`szl-govsign`](https://huggingface.co/SZLHOLDINGS/szl-govsign) | signed governance attestation (DSSE / in-toto, ECDSA P-256) | [`szl-govsign-live`](https://szlholdings-szl-govsign-live.static.hf.space) ✅ **live** | | [`szl-blocked`](https://huggingface.co/SZLHOLDINGS/szl-blocked) | honest-BLOCKED first-class state + EU AI Act Annex IV DRAFT | [`szl-blocked-live`](https://szlholdings-szl-blocked-live.static.hf.space) ✅ **live** | | [`szl-provctl`](https://huggingface.co/SZLHOLDINGS/szl-provctl) | provenance-DAG verify + in-toto v1 / SLSA v1 interop + per-kernel MEASURED energy | [`szl-provctl-live`](https://szlholdings-szl-provctl-live.static.hf.space) ✅ **live** | | **`szl-kernels`** (this repo) | **unified suite — cross-kernel `UnifiedReceiptChain`** | [`szl-kernels-live`](https://szlholdings-szl-kernels-live.static.hf.space) ✅ **live** | `suite.list_kernels()` returns the numeric core; `suite.list_series()` returns the govsign + blocked + provctl governance/interop layer. ### The honest-model trio (offline replays of the live Alloy surface) Published as HF **model** repos (NOT trained models, NO weights — pure-Python, stdlib-only offline replays). Each ships a `library_name: kernels` card and MEASURED local test counts: | Model | Lane | Tests (MEASURED) | |---|---|---| | [`szl-invariants`](https://huggingface.co/SZLHOLDINGS/szl-invariants) | 8 falsifiable receipt/ledger invariants, offline | 14/14 | | [`szl-ouroboros`](https://huggingface.co/SZLHOLDINGS/szl-ouroboros) | bounded-loop trace + MEASURED/DERIVED loop-tax accounting | 13/13 | | [`szl-formulas`](https://huggingface.co/SZLHOLDINGS/szl-formulas) | the 21 canonical formulas + governed-loop composer, PROOF-STATUS mirrored verbatim (locked-proven = exactly 8) | 17/17 | ## The gap this closes Today even SZL's own governance is fragmented: `szl-governed-norm` keeps its own receipt chain, the energy meter keeps its own ledger, and `szl-lambda-gate` keeps none. So a single forward pass yields three logs no third party can re-walk as one ordered, tamper-evident sequence. `UnifiedReceiptChain` is that missing artifact — op-agnostic SHA3-256 receipts that hash-chain norm, Λ, and energy calls into **one** verifiable stream, in call order. `szl-govsign` then makes that chain head third-party-verifiable; `szl-blocked` makes a refusal a recorded, first-class state and derives the compliance paperwork from it; `szl-provctl` verifies the whole multi-run provenance DAG and bridges it to the in-toto/SLSA formats the rest of the supply-chain world reads. ## API | Symbol | What it does | |---|---| | `UnifiedReceiptChain` | Op-agnostic SHA3-256 hash chain. `emit`, `verify() -> (ok, depth, first_break)`, `kernels_touched()`, `to_json()`, `verify_json()` (offline). | | `governed_rms_norm(chain, x, weight=None, eps=1e-6)` | RMSNorm + a receipt into the shared chain. Numerics match `szl-governed-norm`. | | `governed_layer_norm(chain, x, ...)` | LayerNorm + receipt. | | `governed_lambda_gate(chain, axes, weights=None, threshold=0.5)` | **Advisory** Λ gate; records an advisory receipt (`advisory=True`, never proven trust). | | `governed_measure_energy(chain, measurement=None)` | Records an energy reading **verbatim** — `joules=None` + `UNAVAILABLE_NO_NVML` when no GPU. Never fabricated. | | `GovernedBlock` | Pre-norm sub-block composing all three + a binding receipt into one auditable pass. | | `list_kernels()`, `list_series()`, `get_member()`, `selfcheck()` | Numeric registry + governance-layer series + one-shot CPU health check. | ## Honesty (SZL doctrine) - **Λ is advisory.** Its uniqueness is **Conjecture 1 — OPEN**. A recorded gate "pass" is a non-compensatory advisory signal, **never proven trust**. - **Energy is MEASURED-only.** Real NVML cumulative-energy delta when a GPU is present; otherwise `joules=None`, labeled `UNAVAILABLE_NO_NVML`. **No joule is ever fabricated.** - **The digest is an integrity fingerprint, not a signature.** SHA3-256 over a canonical receipt body proves tamper-evidence + ordering — not authorship. Signing is a separate, out-of-band layer — see [`szl-govsign`](https://huggingface.co/SZLHOLDINGS/szl-govsign) for DSSE / in-toto attestation. - **Honest BLOCKED beats fake green.** A failed verification stays failed — see [`szl-blocked`](https://huggingface.co/SZLHOLDINGS/szl-blocked) for refusal as a first-class, provenanced state. - **Universal (pure-Python) suite — a correctness + provenance reference, not a CUDA speed record. No fabricated benchmarks.** Suite tests: 7/7 passing. ## Provenance Backed by the Lean 4 formalization [szl-holdings/lutar-lean](https://github.com/szl-holdings/lutar-lean) (749 declarations / 14 axioms / 163 tracked sorries), DOI [10.5281/zenodo.20434308](https://doi.org/10.5281/zenodo.20434308). Λ uniqueness = Conjecture 1 (open). ## See it live - ✅ **Live now:** [a11oy](https://huggingface.co/spaces/SZLHOLDINGS/a11oy) (live governed inference) · [hatun-mcp](https://huggingface.co/spaces/SZLHOLDINGS/hatun-mcp). **All eight demo Spaces below are live** (static, in-browser). - 📚 **Collection:** [Governed Kernels — verifiable AI building blocks](https://huggingface.co/collections/SZLHOLDINGS/governed-kernels-verifiable-ai-building-blocks-6a41d3936cfce4fba83ce378) — the whole family in one page. **Live console:** [a11oy](https://szlholdings-a11oy.hf.space) · [a-11-oy.com](https://a-11-oy.com) · [llm-router](https://szlholdings-llm-router-live.hf.space) · [receipt verifier](https://szlholdings-governed-receipt-verifier.static.hf.space) · [receipt spec (hub)](https://github.com/szl-holdings/governed-receipt-spec). - ✅ Suite: [`szl-kernels-live`](https://szlholdings-szl-kernels-live.static.hf.space) ✅ **live** — holographic cross-kernel provenance graph with in-browser SHA3-256 + tamper / honest-BLOCKED demo. - ✅ Members: [`governed-norm-holo`](https://szlholdings-governed-norm-holo.static.hf.space) ✅ **live** · [`lambda-gate-holo`](https://szlholdings-lambda-gate-holo.static.hf.space) ✅ **live** · [`energy-attest-holo`](https://szlholdings-energy-attest-holo.static.hf.space) ✅ **live** · [`receipt-chain-live`](https://szlholdings-receipt-chain-live.static.hf.space) ✅ **live** - ✅ Governance layer: [`szl-govsign-live`](https://szlholdings-szl-govsign-live.static.hf.space) ✅ **live** · [`szl-blocked-live`](https://szlholdings-szl-blocked-live.static.hf.space) ✅ **live** · [`szl-provctl-live`](https://szlholdings-szl-provctl-live.static.hf.space) ✅ **live** - 🔮 `szl-substrate` *(ROADMAP — not yet live)* — the hub tying the whole governed-compute substrate together. ## Compatibility Python 3.9+, `torch>=2.5`, standard library + torch only. Runs on CPU and CUDA. ## License Apache-2.0. Copyright 2026 SZL Holdings. --- SZL Holdings · unified governed-kernel suite · cross-kernel provenance · Λ advisory (Conjecture 1) · energy MEASURED-only · a-11-oy.com · github.com/szl-holdings · huggingface.co/SZLHOLDINGS --- [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.19944926.svg)](https://doi.org/10.5281/zenodo.19944926) ## Citation **Cite this.** Part of the SZL Holdings *Ouroboros Thesis* (Governed Post-Determinism). Concept DOI (always-latest): [10.5281/zenodo.19944926](https://doi.org/10.5281/zenodo.19944926). Author: Stephen P. Lutar Jr. · [ORCID 0009-0001-0110-4173](https://orcid.org/0009-0001-0110-4173) · License CC-BY-4.0. Full DOI-pinned lineage (v1→v26) + the 8 papers: [szl-papers PAPERS_INDEX](https://github.com/szl-holdings/szl-papers/blob/main/PAPERS_INDEX.md). No artifact-specific DOI is minted for this model; the concept DOI above covers the program. Honesty (Doctrine v11): Λ unconditional uniqueness is **Conjecture 1** (machine-checked FALSE as stated) — never a theorem; conditional uniqueness is **Theorem U** (axiom-free). Locked-proven formulas = **exactly 8** {F1,F4,F7,F11,F12,F18,F19,F22}; ~185 experimental theorems are a separate CI-green tier; Khipu BFT safety = Conjecture 2. Trust never 100%. ```bibtex @misc{lutar_szl_ouroboros, author = {Lutar, Stephen P., Jr.}, title = {SZL Holdings --- The Ouroboros Thesis (Governed Post-Determinism)}, year = {2026}, publisher = {Zenodo}, doi = {10.5281/zenodo.19944926}, url = {https://doi.org/10.5281/zenodo.19944926}, note = {Concept DOI --- always resolves to the latest version. ORCID 0009-0001-0110-4173. CC-BY-4.0.} } ``` *Signed-off-by: Stephen Lutar * ## Files in this repo | Path | What it is | |---|---| | `build/torch-universal/szl_kernels/__init__.py` | public API — suite entry points + `selfcheck()` | | `build/torch-universal/szl_kernels/_chain.py` | cross-kernel `UnifiedReceiptChain` (SHA3-256) | | `build/torch-universal/szl_kernels/_ops.py` | the governed op set | | `tests/test_suite.py` | suite test | | `build.toml` · `metadata.json` | Kernel Hub build/metadata manifests | | `LICENSE` · `SECURITY.md` | Apache-2.0 · security policy |