szl-govsign — signed governance provenance

🟩 Kernel + REAL trained structural PRE-FILTER. The signing kernel (pure-Python, stdlib + cryptography) is UNCHANGED and remains the sole authority — the DSSE/in-toto ECDSA-P256 signer/verifier. Since surrogate v1 this repo ALSO ships model.joblib — a real trained sklearn classifier that acts as a STRUCTURAL PRE-FILTER ONLY: it triages obvious structural breakage (malformed base64, missing signatures, wrong payloadType, non-JSON payload, missing in-toto fields) cheaply, with MEASURED structural accuracy 1.0000. It NEVER replaces cryptographic verification — passing this pre-filter is NOT "verified." Only the kernel's real verify() (ECDSA-P256 over DSSE PAE) establishes validity. The crypto blind spot is MEASURED and stated: sig-tamper recall 0.0111 ≈ chance (a byte-flipped signature is structurally invisible). Verification proves integrity & origin only, never accuracy or performance. Λ stays Conjecture 1 (open); the signature never upgrades advisory to proven trust.

A signed-attestation kernel for governance provenance. szl-govsign produces an in-toto / DSSE signed governance attestation binding an artifact digest (a szl-kernels UnifiedReceiptChain head, or a build manifest) to a custom governance predicate — Λ advisory verdict, MEASURED energy, honest-BLOCKED status, allow/block decision — signed with ECDSA P-256. No ecosystem-wide novelty claim is made.

Kernel Hub migration (verified 2026-07-15): get_kernel(...) resolves the first-class Kernel Hub repo; main and v1 both pin verified revision 8a99694472bab97b9e00bd3ef1a1fd73cfaabc4a. This model-type repo is the legacy source/card mirror.

Quickstart

pip install kernels cryptography

from kernels import get_kernel

gs = get_kernel("SZLHOLDINGS/szl-govsign", revision="main", trust_remote_code=True)
print(gs.selfcheck())   # sign OK, verify OK, tamper-detected, honest-BLOCKED signed as BLOCKED

priv = gs.generate_ephemeral_keypair()        # production: Sigstore keyless / cosign key, out-of-band
pred = gs.build_governance_predicate(
    lambda_verdict=gs.LambdaVerdict(score=0.92, notes="advisory only"),
    energy=gs.EnergyLabel(value=12.5, unit="joules"),       # MEASURED-only
    decision=gs.GovernanceDecision(status="ALLOWED", reason="passed gates"),
    honest_blocked=False,
)
subjects = [gs.Subject(name="szl_kernels/UnifiedReceiptChain", digest={"sha256": "..."})]
envelope = gs.attest(subjects, pred, priv)    # DSSE envelope (in-toto Statement)
assert gs.verify(envelope, priv.public_key()) # verifies with this key; tamper => False

What it proves — and what it does NOT

✅ With a trusted public key, the signature verifies possession of the corresponding private key + integrity of the attestation (DSSE PAE + ECDSA P-256). It does not by itself establish a real-world author identity.
❌ It does NOT prove Λ uniqueness — that remains Conjecture 1 (OPEN). proven_trust is structurally locked False: no code path sets it True.
❌ It does NOT upgrade an advisory verdict to "proven trust."
Energy MEASURED-only — modeled/estimated/fabricated values are rejected at construction.
honest-BLOCKED — a BLOCKED verdict is signed as BLOCKED; the builder refuses to sign a flipped verdict.

Production signing

The demo uses an ephemeral in-process keypair (no key material written to disk). Production signing is keyless via Sigstore (Fulcio short-lived cert + Rekor transparency log) or a real cosign key managed out-of-band. The envelope shape is unchanged.

Honesty & prior art

Imports: Python stdlib + cryptography only. Prior art attributed: in-toto attestation framework, DSSE, Sigstore model-transparency. The https://szl.holdings/governance/v1 predicate is SZL's own.

The governed-kernel series

Part of the szl-kernels suite — szl-governed-norm · szl-lambda-gate · governed-inference-meter · szl-blocked · szl-provctl. Live demo: szl-govsign-live · substrate a-11-oy.com.

License

Trained structural pre-filter v1 (MEASURED — see `TRAINING_RECEIPT.json`)

PRE-FILTER ONLY — NEVER a substitute for cryptographic verification. Passing this filter is NOT verified. A DSSE envelope is only valid if the kernel's real verify() (ECDSA-P256 over the DSSE PAE) accepts it. The filter exists solely to reject obviously-broken envelopes cheaply before the crypto check.

A real sklearn HistGradientBoostingClassifier trained on 8,000 envelopes built by the kernel's REAL attest() over the REAL subject digests from governed-receipts-bench valid/ (seed 20260721; 84 envelopes re-audited by the kernel's REAL verify() — valid → True, every corruption class → False, proving crypto is the authority). Features are cheap structural observables only; ECDSA verification is excluded by design so the crypto blind spot is measured, not hidden.

metric	value
test accuracy (all classes)	0.8888
test accuracy (structural classes only)	1.0000

per-class recall	value
`valid`	1.0000
`wrong-payload-type`	1.0000
`missing-signatures`	1.0000
`malformed-base64-payload`	1.0000
`non-json-payload`	1.0000
`missing-statement-field`	1.0000
`sig-tamper`	0.0111

The crypto blind spot is the point (MEASURED, stated proudly): sig-tamper recall 0.0111 ≈ chance. a byte-flipped ECDSA signature is STRUCTURALLY IDENTICAL to a valid envelope — the pre-filter cannot detect it (recall ≈ chance). Only real ECDSA-P256 DSSE verify (the kernel's verify()) catches signature tampering. Passing this pre-filter is NOT cryptographic verification and NEVER counts as verified.

import joblib
clf = joblib.load("model.joblib")   # feature spec: TRAINING_RECEIPT.json data.features
# STRUCTURAL PRE-FILTER ONLY. Always run the kernel's gs.verify(envelope, pubkey)
# for the authoritative cryptographic verdict — a pre-filter PASS is NOT verified.

Re-verify everything: python scripts/eval.py (sha256-checks the shipped model against the receipt, regenerates the seeded dataset via the in-repo kernel, retrains, and compares the all-class accuracy within ±0.02).

Source of record & family. get_kernel resolves the pinned Kernel Hub repo (verified revision 8a99694472bab97b9e00bd3ef1a1fd73cfaabc4a); this kernel has no separate GitHub repository — the Kernel Hub repo is the source of record (honest label, nothing hidden). Family: szl-kernels hub · Governed Kernels & Verifiers · github.com/szl-holdings.

_{SZL Holdings honesty footer. Λ = Conjecture 1 (advisory, never a theorem). locked-proven = exactly 8 {F1,F4,F7,F11,F12,F18,F19,F22}. Honesty labels: MEASURED / REPORTED / MODELED / HEURISTIC / UNKNOWN / UNAVAILABLE. Trust never 100% (ceiling 0.97). Verification proves integrity & origin, never accuracy. a-11-oy.com · huggingface.co/SZLHOLDINGS}