README.md

---
title: Credenza
emoji: 🕯️
colorFrom: blue
colorTo: indigo
sdk: docker
app_port: 7860
pinned: false
# Built-in Space sign-in, with NO added scopes.
#
# `openid` and `profile` are implicit and are not listed here -- HF rejects them
# as scope names precisely because it always grants them. Everything HF offers on
# top (email, read-repos, write-repos, ...) is power Credenza deliberately does
# not use: it wants an identity to attribute acts to, the ledger's `who`, and
# nothing else. Storage writes go through the Space's own token rather than the
# visitor's, which is the boundary the disclosure below describes -- the operator
# holds the key material.
#
# So the honest request is the empty one. Do not add scopes here without a
# feature that needs them and a disclosure that says so.
hf_oauth: true
short_description: Perform a governed credibility review, end to end
---

# Credenza

*From the credence table: where things were tested before they were trusted.*

Upload a folder of model-credibility evidence and get a fast, honest readout of
your gaps — which credibility factors are missing and which weakeners fire —
against **ASME V&V 40** or **NASA-STD-7009B**.

The flow: upload (or try the sample) → the rule router picks a standard → a
hosted model reads your evidence → you confirm what it understood (status only)
→ a free completeness + weakeners summary → download the assurance package.

It reports completeness and weakeners; it does **not** stamp an Accepted /
Not-Accepted verdict — that's a human decision.

## The downloadable package

"Download UofA package" gives you a zip built by the same code path as the CLI's
`uofa import`. The file that carries the assurance is `uofa.jsonld`; the report,
manifest, public key, and instructions beside it are convenience copies.

```
unzip uofa-pack-*.zip
uofa verify uofa.jsonld \
  --pubkey keys/uofa-issuer.pub \
  --decision-pubkey keys/demo-reviewer.pub
```

**What a valid signature means here.** Only that the file is unmodified since
this demo produced it. It is not a review and not an acceptance decision. The
signing key is a *demonstration issuer key* held by the demo, not a research or
production key, and not anyone's decision key — so a demo package can never be
mistaken for a formally issued one (it does not verify against the default trust
anchor; `--pubkey` is required, deliberately).

The public key travels inside the zip so verification works offline. A trust
anchor shipped inside the artifact it validates only proves self-consistency, so
compare it against this independent copy:

```
keys/uofa-issuer.pub    sha256:ead2e1e1068f8c6da14b2c9c384e4d00d8900308ad2e406fe294330ce0edd81d
keys/demo-reviewer.pub  sha256:3605a146f4880d9f7a29db6ef5629655091d2ecd0c2b9919cbe49d90d65d83c8
```

## Privacy

**Your documents leave this Space.** Evidence is read by a hosted model
(Anthropic), so the text of what you upload is sent there to be processed.
Anthropic's data-handling terms govern what happens to it in transit and at
rest; check them before uploading anything you would not send to a third-party
API.

What remains true: this Space stores nothing. Each request uses a temporary
directory that is deleted afterwards, and payloads are not logged by us. That
is a claim about OUR handling, not about the provider's -- turning off our own
logging does not stop theirs.

**If your evidence is confidential, do not upload it here.** Run the CLI on
your own machine instead, where a local model reads it and nothing leaves your
environment:

```bash
pip install "uofa[extract]"
uofa extract ./evidence --pack vv40
```

Pasting a public model card sends only text that is already public.

One exception, by design: if you generate a package, that zip is written to a
separate directory so it survives long enough for you to download it. It is
deleted when you hit "Start over", when you run another analysis, and in any
case within 30 minutes. Your uploaded documents are never retained.

## Build & run (local)

The image is split so HF's builder stays under its 30-min limit:
`space/Dockerfile.base` carries the heavy layers (JAR, wheel, JRE, Ollama
runtime, baked ~3 GB model) and is prebuilt in CI → GHCR; `space/Dockerfile` is
the thin `FROM <base> + COPY space/` that HF actually builds.

For a self-contained **local** build, build the base first (from the **repo
root** — it needs `src/`, `packs/`, `spec/`, and the weakener engine), then the
thin app image on top of it:

```bash
# 1. heavy base (JAR + wheel + Ollama + ~3 GB model) — tagged so step 2 finds it
docker build -f space/Dockerfile.base -t ghcr.io/cloudronin/uofa-demo-base:latest .
# 2. thin app image on top, then run
docker build -f space/Dockerfile -t uofa-space .
docker run --rm -p 7860:7860 uofa-space            # CPU (extraction is slow)
docker run --rm --gpus all -p 7860:7860 uofa-space # GPU (Ollama auto-detects)
```

Then open http://localhost:7860.

Set `UOFA_SPACE_MODEL=mock` to drive the UI without running the model (returns
canned extraction data) — useful for development.

## What's inside

- `app.py` — Gradio Blocks wizard (thin UI).
- `wizard.py` / `pipeline.py` — step logic and the in-process pipeline over `uofa`.
- `router.py` — pre-extract standard router.
- `summary.py` — completeness + weakeners computation.
- `Dockerfile` / `start.sh` — image with Ollama + JRE 17 + qwen3.5:4b baked in.

## Deploying to a HuggingFace Space

HuggingFace Docker Spaces expect the `Dockerfile` at the Space repo root. When
publishing, place this Space's contents at the root (or mirror the `uofa` repo
and ensure the build context includes `src/`, `packs/`, and `spec/`).