SPACE_PROVENANCE.json

{
  "schema": "szl.space-source-attestation/v1",
  "observed_at": "2026-07-12T01:54:25Z",
  "space": {
    "id": "SZLHOLDINGS/yarqa",
    "repository_type": "space",
    "sdk": "docker",
    "runtime_stage_observed": "RUNNING",
    "artifact_kind": "space-repository-snapshot",
    "purpose": "Clean-room plug-flow compartment engineering-method package and interactive Space overlay.",
    "source_files_reviewed": [
      "README.md",
      "Dockerfile",
      "pyproject.toml",
      "space/Dockerfile",
      "space/app.py",
      "space/README.md",
      "yarqa/core.py",
      "yarqa/provenance.py"
    ]
  },
  "source_of_record": {
    "state": "VERIFIED_GITHUB_SOURCE_WITH_DECLARED_HF_OVERLAY",
    "relation": "github-canonical-source-with-declared-hf-overlay",
    "platform": "github+huggingface",
    "repository": "SZLHOLDINGS/yarqa",
    "artifact_base_revision": "9772c457290ed2185709a76c68adf240a7181e5e",
    "artifact_base_state": "MEASURED_PRE_ATTESTATION_BASE",
    "artifact_base_url": "https://huggingface.co/spaces/SZLHOLDINGS/yarqa/tree/9772c457290ed2185709a76c68adf240a7181e5e",
    "file_count": 26,
    "total_bytes": 1500729,
    "tree_sha256": "ad222517ae7e33089a4af759ae14026be429b7b29b90bc7cedced96d5df90cb0",
    "tree_hash_algorithm": "sha256 of UTF-8 path + NUL + per-file content sha256 + LF, sorted by path; .cache excluded",
    "canonical_repository": "szl-holdings/yarqa",
    "canonical_commit": "98d07ce7b72d6a5e335ea5131e52b06649e28409"
  },
  "public_github": {
    "state": "VERIFIED_DECLARED_GITHUB_SOURCE_WITH_HF_OVERLAY",
    "repository": "szl-holdings/yarqa",
    "commit": "98d07ce7b72d6a5e335ea5131e52b06649e28409",
    "commit_url": "https://github.com/szl-holdings/yarqa/commit/98d07ce7b72d6a5e335ea5131e52b06649e28409",
    "deploy_declaration": {
      "path": ".github/workflows/hf-deploy.yml",
      "immutable_url": "https://github.com/szl-holdings/yarqa/blob/98d07ce7b72d6a5e335ea5131e52b06649e28409/.github/workflows/hf-deploy.yml",
      "sha256": "9abd1dc0af5a72896223865596a4ae3f8137ecb93f62e90274b4edb94e0e319c",
      "payload": [
        "pyproject.toml",
        "yarqa/**",
        "space/**"
      ],
      "dockerfile_mapping": "HF Dockerfile == GitHub space/Dockerfile",
      "readme_overlay": "HF root README intentionally excluded from GitHub deploy payload"
    },
    "comparison": {
      "github_files_excluding_gitattributes": 56,
      "hf_files_excluding_gitattributes": 25,
      "common_paths": 24,
      "byte_identical_common_paths": 23,
      "changed_common_paths": [
        "README.md"
      ],
      "github_only_paths": [
        ".github/CODEOWNERS",
        ".github/dependabot.yml",
        ".github/workflows/codeql.yml",
        ".github/workflows/dco.yml",
        ".github/workflows/gitleaks.yml",
        ".github/workflows/hf-deploy.yml",
        ".github/workflows/pin-check.yml",
        ".github/workflows/pr-title.yml",
        ".github/workflows/receipt-sign.yml",
        ".github/workflows/sbom.yml",
        ".github/workflows/scorecard.yml",
        ".github/workflows/space-ci.yml",
        ".github/workflows/trivy.yml",
        ".gitignore",
        ".gitleaks.toml",
        "CITATIONS.md",
        "LICENSE",
        "PROVENANCE.md",
        "examples/synthetic_channel.py",
        "scripts/sign_receipt.py",
        "scripts/verify_receipt.py",
        "tests/test_agentic.py",
        "tests/test_attestation.py",
        "tests/test_chain.py",
        "tests/test_cli.py",
        "tests/test_core.py",
        "tests/test_meshio.py",
        "tests/test_prediction_receipt.py",
        "tests/test_provenance.py",
        "tests/test_routing_topk.py",
        "tests/test_signing.py",
        "tests/test_surrogate.py"
      ],
      "hf_only_paths": [
        "Dockerfile"
      ],
      "declared_deploy_payload_files": 23,
      "declared_deploy_payload_byte_identical": 23
    },
    "contextual_references": [
      "https://github.com/szl-holdings"
    ],
    "contextual_reference_role": "DECLARED_DEPLOY_SOURCE_PLUS_CONTEXTUAL_LINKS; FULL_REPOSITORY_PARITY_NOT_CLAIMED"
  },
  "claims": {
    "full_github_repository_parity": "NOT_CLAIMED",
    "reproducible_build": "NOT_CLAIMED",
    "binary_provenance": "NOT_CLAIMED",
    "serving_process_revision": "NOT_CLAIMED"
  },
  "limits": [
    "The attestation overlay cannot self-embed its resulting Hub commit, so artifact_base_revision is the immutable measured pre-overlay tree.",
    "Repository-head evidence does not prove the exact serving-process revision during a rolling deployment.",
    "Reproducible build, binary provenance, and serving-process identity are not claimed.",
    "No claim is made about private repositories or unobserved producer systems."
  ]
}