--- title: Credenza emoji: 🕯️ colorFrom: blue colorTo: indigo sdk: docker app_port: 7860 pinned: false # Built-in Space sign-in, with NO added scopes. # # `openid` and `profile` are implicit and are not listed here -- HF rejects them # as scope names precisely because it always grants them. Everything HF offers on # top (email, read-repos, write-repos, ...) is power Credenza deliberately does # not use: it wants an identity to attribute acts to, the ledger's `who`, and # nothing else. Storage writes go through the Space's own token rather than the # visitor's, which is the boundary the disclosure below describes -- the operator # holds the key material. # # So the honest request is the empty one. Do not add scopes here without a # feature that needs them and a disclosure that says so. hf_oauth: true short_description: Perform a governed credibility review, end to end --- # Credenza *From the credence table: where things were tested before they were trusted.* Upload a folder of model-credibility evidence and get a fast, honest readout of your gaps — which credibility factors are missing and which weakeners fire — against **ASME V&V 40** or **NASA-STD-7009B**. The flow: upload (or try the sample) → the rule router picks a standard → a hosted model reads your evidence → you confirm what it understood (status only) → a free completeness + weakeners summary → download the assurance package. It reports completeness and weakeners; it does **not** stamp an Accepted / Not-Accepted verdict — that's a human decision. ## The downloadable package "Download UofA package" gives you a zip built by the same code path as the CLI's `uofa import`. The file that carries the assurance is `uofa.jsonld`; the report, manifest, public key, and instructions beside it are convenience copies. ``` unzip uofa-pack-*.zip uofa verify uofa.jsonld \ --pubkey keys/uofa-issuer.pub \ --decision-pubkey keys/demo-reviewer.pub ``` **What a valid signature means here.** Only that the file is unmodified since this demo produced it. It is not a review and not an acceptance decision. The signing key is a *demonstration issuer key* held by the demo, not a research or production key, and not anyone's decision key — so a demo package can never be mistaken for a formally issued one (it does not verify against the default trust anchor; `--pubkey` is required, deliberately). The public key travels inside the zip so verification works offline. A trust anchor shipped inside the artifact it validates only proves self-consistency, so compare it against this independent copy: ``` keys/uofa-issuer.pub sha256:ead2e1e1068f8c6da14b2c9c384e4d00d8900308ad2e406fe294330ce0edd81d keys/demo-reviewer.pub sha256:3605a146f4880d9f7a29db6ef5629655091d2ecd0c2b9919cbe49d90d65d83c8 ``` ## Privacy **Your documents leave this Space.** Evidence is read by a hosted model (Anthropic), so the text of what you upload is sent there to be processed. Anthropic's data-handling terms govern what happens to it in transit and at rest; check them before uploading anything you would not send to a third-party API. What remains true: this Space stores nothing. Each request uses a temporary directory that is deleted afterwards, and payloads are not logged by us. That is a claim about OUR handling, not about the provider's -- turning off our own logging does not stop theirs. **If your evidence is confidential, do not upload it here.** Run the CLI on your own machine instead, where a local model reads it and nothing leaves your environment: ```bash pip install "uofa[extract]" uofa extract ./evidence --pack vv40 ``` Pasting a public model card sends only text that is already public. One exception, by design: if you generate a package, that zip is written to a separate directory so it survives long enough for you to download it. It is deleted when you hit "Start over", when you run another analysis, and in any case within 30 minutes. Your uploaded documents are never retained. ## Build & run (local) The image is split so HF's builder stays under its 30-min limit: `space/Dockerfile.base` carries the heavy layers (JAR, wheel, JRE, Ollama runtime, baked ~3 GB model) and is prebuilt in CI → GHCR; `space/Dockerfile` is the thin `FROM + COPY space/` that HF actually builds. For a self-contained **local** build, build the base first (from the **repo root** — it needs `src/`, `packs/`, `spec/`, and the weakener engine), then the thin app image on top of it: ```bash # 1. heavy base (JAR + wheel + Ollama + ~3 GB model) — tagged so step 2 finds it docker build -f space/Dockerfile.base -t ghcr.io/cloudronin/uofa-demo-base:latest . # 2. thin app image on top, then run docker build -f space/Dockerfile -t uofa-space . docker run --rm -p 7860:7860 uofa-space # CPU (extraction is slow) docker run --rm --gpus all -p 7860:7860 uofa-space # GPU (Ollama auto-detects) ``` Then open http://localhost:7860. Set `UOFA_SPACE_MODEL=mock` to drive the UI without running the model (returns canned extraction data) — useful for development. ## What's inside - `app.py` — Gradio Blocks wizard (thin UI). - `wizard.py` / `pipeline.py` — step logic and the in-process pipeline over `uofa`. - `router.py` — pre-extract standard router. - `summary.py` — completeness + weakeners computation. - `Dockerfile` / `start.sh` — image with Ollama + JRE 17 + qwen3.5:4b baked in. ## Deploying to a HuggingFace Space HuggingFace Docker Spaces expect the `Dockerfile` at the Space repo root. When publishing, place this Space's contents at the root (or mirror the `uofa` repo and ensure the build context includes `src/`, `packs/`, and `spec/`).