surrogate v1: REAL trained BLOCK/ALLOW HistGB (fidelity 0.9977 MEASURED) + receipt + scripts + honest card/provenance

MODEL_PROVENANCE.json

@@ -5,7 +5,23 @@
     "id": "SZLHOLDINGS/szl-blocked",
     "repository_type": "model",
     "artifact_kind": "kernel-code-and-configuration",
-    "trained_weights_present": false
+    "trained_weights_present": true,
+    "surrogate": {
+      "file": "model.joblib",
+      "sha256": "15f0537cd323aff977ff3d5abec065f1144693fe0ab99d5cbd0961fe3b8e7610",
+      "role": "BLOCK/ALLOW decision triage only \u2014 kernel policy chain remains sole ground truth",
+      "fidelity_MEASURED": {
+        "fidelity_vs_kernel_heldout": 0.9977,
+        "per_class_recall": {
+          "ALLOW": 0.9963,
+          "BLOCK_HARD": 1.0,
+          "BLOCK_ADVISORY": 0.9846
+        }
+      },
+      "receipt": "TRAINING_RECEIPT.json",
+      "reverify": "python scripts/eval.py"
+    },
+    "stdlib_only_note": "kernel package itself stays stdlib-only; the OPTIONAL surrogate needs sklearn+joblib"
   },
   "source_of_record": {
     "state": "VERIFIED_HF_SOURCE_OF_RECORD",
@@ -31,7 +47,7 @@
   "claims": {
     "github_repository_parity": "NOT_CLAIMED",
     "reproducible_build": "NOT_CLAIMED",
-    "trained_model": "NOT_CLAIMED",
+    "trained_model": "SURROGATE_PRESENT_MEASURED_FIDELITY",
     "serving_process_revision": "NOT_APPLICABLE_REPOSITORY_ARTIFACT"
   },
   "limits": [
@@ -39,4 +55,4 @@
     "The attestation overlay cannot self-embed its resulting Hub commit, so the immutable artifact_base_revision is the measured pre-overlay base.",
     "No .bin, .safetensors, .pt, .pth, .onnx, or .gguf weight artifact was present in the measured base tree."
   ]
-}
+}

README.md

@@ -5,8 +5,12 @@ tags:
 - compliance
 - annex-iv
 - governance
+- sklearn
+- surrogate
+- tabular-classification
 - doi:10.5281/zenodo.19944926
 library_name: kernels
+pipeline_tag: tabular-classification
 license: apache-2.0
 szl-governance:
   verdict: HONEST-BLOCKED
@@ -28,7 +32,7 @@ szl-governance:
 
 </div>
 
-> **⬛ No `.safetensors`/`.bin`/`.pt`/`.gguf` — governance kernel repo.** Not a runnable model. `get_kernel`-discoverable, pure-Python. Verification proves **integrity & origin only, never accuracy or performance**. Declares no `pipeline_tag` / `base_model`.
+> **🟩 Kernel + REAL trained surrogate.** The governance kernel (pure-Python, stdlib-only) is UNCHANGED and remains the sole ground truth. Since **surrogate v1** this repo also ships `model.joblib` — a real trained sklearn classifier that triages the BLOCK/ALLOW verdict `GovernedGate.decide(...)` would return, with **MEASURED** fidelity **0.9977** (agreement vs the kernel on a held-out split). The surrogate is a fast pre-gate; the kernel's honest-BLOCKED policy chain stays authoritative and `get_kernel`-discoverable. No verdict is ever coerced. **Λ is not touched here and stays Conjecture 1 (open).**
 
 **A refusal-first governed kernel.** When a governed call is denied, the op **never runs**, and the chain records an honest `BLOCKED` receipt rather than a success. Its companion `szl_euaiact` derives an **EU AI Act Annex IV-style draft technical-documentation skeleton** from that provenance — an organizational aid, not compliance evidence, legal advice, or a declaration of conformity.
 
@@ -79,6 +83,40 @@ Part of the [`szl-kernels`](https://huggingface.co/SZLHOLDINGS/szl-kernels) suit
 
 Apache-2.0 · © 2026 SZL Holdings · Stephen P. Lutar · ORCID [0009-0001-0110-4173](https://orcid.org/0009-0001-0110-4173). Concept DOI [10.5281/zenodo.19944926](https://doi.org/10.5281/zenodo.19944926).
 
+## Trained BLOCK/ALLOW surrogate v1 (MEASURED — see `TRAINING_RECEIPT.json`)
+
+A real sklearn `HistGradientBoostingClassifier` trained on **24,000 governed requests**
+synthesized and **labeled by this kernel itself** (`GovernedGate.decide`, seed 20260721;
+600 samples re-audited by independent full kernel replay during generation — all agreed).
+Features are structural observables of the request (capabilities, action, hard flag) plus
+the advisory Λ axes — the surrogate never runs the policy chain or signs a receipt.
+
+| metric | value |
+|---|---|
+| fidelity vs kernel (held-out agreement) | **0.9977** |
+| test accuracy (3 classes) | **0.9977** |
+
+| per-class recall | value |
+|---|---|
+| `ALLOW` | 0.9963 |
+| `BLOCK_HARD` (hard security deny dominates) | 1.0000 |
+| `BLOCK_ADVISORY` (advisory Λ tightened ALLOW→BLOCK) | 0.9846 |
+
+**Honest blind spot / boundary:** the surrogate predicts the *decision*, never the *receipt*.
+It cannot emit the tamper-evident SHA3-256 chain receipt and must never be used to flip a
+BLOCK to ALLOW — the deny-by-default kernel policy remains the authority. Class balance is
+kernel-driven (`BLOCK_HARD` dominates because deny-by-default is the safe ground state):
+counts ALLOW=2713, BLOCK_HARD=18357, BLOCK_ADVISORY=2930.
+Λ untouched = Conjecture 1.
+
+```python
+import joblib
+clf = joblib.load("model.joblib")   # feature spec: TRAINING_RECEIPT.json data.features
+```
+
+Re-verify everything: `python scripts/eval.py` (sha256-checks the shipped model against the
+receipt, regenerates the seeded kernel-labeled dataset, retrains, and compares fidelity within ±0.02).
+
 ---
 
 <sub><b>SZL Holdings honesty footer.</b> Λ = Conjecture 1 (advisory, never a theorem). locked-proven = exactly 8 {F1,F4,F7,F11,F12,F18,F19,F22}. Honesty labels: MEASURED / REPORTED / MODELED / HEURISTIC / UNKNOWN / UNAVAILABLE. Trust never 100% (ceiling 0.97). honest-BLOCKED is never flipped. <a href="https://a-11-oy.com">a-11-oy.com</a> · <a href="https://huggingface.co/SZLHOLDINGS">huggingface.co/SZLHOLDINGS</a></sub>

TRAINING_RECEIPT.json

@@ -0,0 +1,67 @@
+{
+  "artifact": "SZLHOLDINGS/szl-blocked surrogate v1",
+  "role": "BLOCK/ALLOW decision triage surrogate \u2014 kernel remains ground truth",
+  "generator": {
+    "script": "scripts/forge.py",
+    "seed": 20260721,
+    "kernel_version": "0.1.0",
+    "kernel_labelled": true,
+    "kernel_audited_samples": 600,
+    "policy": "deny_by_default([allow_if_capability('run_norm'), deny_if_flag('exfiltration'), deny_if_action_in({'exfiltrate','delete_all','drop_table'})])",
+    "lambda_threshold": 0.5
+  },
+  "data": {
+    "rows": 24000,
+    "classes": [
+      "ALLOW",
+      "BLOCK_HARD",
+      "BLOCK_ADVISORY"
+    ],
+    "class_counts": {
+      "ALLOW": 2713,
+      "BLOCK_HARD": 18357,
+      "BLOCK_ADVISORY": 2930
+    },
+    "split": "80/20 stratified",
+    "features": [
+      "has_required_capability",
+      "n_capabilities",
+      "action_blocklisted",
+      "hard_flag_set",
+      "advisory_axes_present",
+      "n_axes",
+      "axes_min",
+      "axes_mean",
+      "axes_any_zero"
+    ],
+    "feature_policy": "structural observables of the request + advisory \u039b axes only; the surrogate never signs receipts or replaces the policy chain"
+  },
+  "model": {
+    "type": "sklearn.HistGradientBoostingClassifier",
+    "params": {
+      "max_iter": 300,
+      "early_stopping": true,
+      "random_state": 20260721
+    },
+    "file": "model.joblib",
+    "sha256": "15f0537cd323aff977ff3d5abec065f1144693fe0ab99d5cbd0961fe3b8e7610"
+  },
+  "metrics_MEASURED": {
+    "fidelity_vs_kernel_heldout": 0.9977,
+    "test_accuracy": 0.9977,
+    "per_class_recall": {
+      "ALLOW": 0.9963,
+      "BLOCK_HARD": 1.0,
+      "BLOCK_ADVISORY": 0.9846
+    }
+  },
+  "environment": {
+    "python": "3.12.12",
+    "sklearn": "1.9.0",
+    "numpy": "2.5.1",
+    "host": "replit 2-vCPU container",
+    "wall_seconds": 1.0
+  },
+  "honesty": "Every number above is MEASURED by this run. Fidelity = agreement%% with GovernedGate.decide on a held-out split. The surrogate is a fast pre-gate; the kernel's honest-BLOCKED policy chain stays authoritative. \u039b untouched = Conjecture 1.",
+  "trained_at_utc": "2026-07-21T02:49:46Z"
+}

model.joblib

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:15f0537cd323aff977ff3d5abec065f1144693fe0ab99d5cbd0961fe3b8e7610
+size 448832

scripts/eval.py

@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+"""Re-verify the surrogate: sha256 the shipped model against TRAINING_RECEIPT.json,
+then deterministically regenerate the seeded dataset via scripts/forge.py and
+compare re-measured fidelity to the receipt (tolerance 0.02 across lib versions).
+Run from repo root: python scripts/eval.py"""
+import hashlib, json, subprocess, sys, tempfile, os, shutil
+root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+receipt = json.load(open(f"{root}/TRAINING_RECEIPT.json"))
+got = hashlib.sha256(open(f"{root}/model.joblib", "rb").read()).hexdigest()
+want = receipt["model"]["sha256"]
+print(f"model.joblib sha256 {'MATCHES receipt' if got==want else 'MISMATCH — refuse'}: {got[:16]}…")
+if got != want:
+    sys.exit(1)
+with tempfile.TemporaryDirectory() as td:
+    shutil.copy(f"{root}/scripts/forge.py", f"{td}/forge.py")
+    out = subprocess.run([sys.executable, f"{td}/forge.py"], capture_output=True, text=True, cwd=td)
+    print(out.stdout[-400:] if out.returncode == 0 else out.stderr[-600:])
+    if out.returncode:
+        sys.exit(1)
+    re_receipt = json.load(open(f"{td}/TRAINING_RECEIPT.json"))
+    d = abs(re_receipt["metrics_MEASURED"]["fidelity_vs_kernel_heldout"]
+            - receipt["metrics_MEASURED"]["fidelity_vs_kernel_heldout"])
+    print(f"re-measured fidelity delta vs receipt: {d:.4f} ({'OK ≤0.02' if d<=0.02 else 'FAIL'})")
+    sys.exit(0 if d <= 0.02 else 1)

scripts/forge.py

@@ -0,0 +1,171 @@
+#!/usr/bin/env python3
+"""Forge a REAL trained surrogate for szl-blocked.
+Kernel = ground truth. Surrogate = fast BLOCK/ALLOW triage: given a governed
+request's structural observables (capabilities, action, flags) plus the advisory
+Λ axes, predict what GovernedGate.decide(...) would return — ALLOW, BLOCK by
+HARD security, or BLOCK by advisory Λ. The kernel's deny-by-default policy and
+non-compensatory Λ gate are the sole labeler; a sample of labels is re-audited
+by full kernel replay and MUST agree or the run fails loudly.
+Seeded, receipted, reproducible."""
+import json, os, random, sys, time, hashlib, platform
+_here = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+if os.path.isdir(os.path.join(_here, "build", "torch-universal")):
+    sys.path.insert(0, os.path.join(_here, "build", "torch-universal"))  # in-repo run
+else:
+    sys.path.insert(0, "/tmp/kernel-probe/szl-blocked/build/torch-universal")  # forge-dev run
+import szl_blocked as sb
+import numpy as np
+from sklearn.ensemble import HistGradientBoostingClassifier
+from sklearn.model_selection import train_test_split
+from sklearn.metrics import accuracy_score, recall_score
+import joblib
+
+SEED = 20260721
+random.seed(SEED); np.random.seed(SEED)
+T0 = time.time()
+
+# The universe the surrogate learns over. These mirror the kernel's own rules:
+#   allow_if_capability("run_norm")   -> needs capability present
+#   deny_if_action_in({"exfiltrate","delete_all","drop_table"}) -> hard blocklist
+#   deny_if_flag("exfiltration")      -> hard flag deny
+CAPS_UNIVERSE = ["run_norm", "read_public", "write_logs", "call_model"]
+REQUIRED_CAP = "run_norm"
+BLOCKLIST = {"exfiltrate", "delete_all", "drop_table"}
+ACTIONS = ["summarize", "rms_norm", "classify", "embed",
+           "exfiltrate", "delete_all", "drop_table"]
+HARD_FLAG = "exfiltration"
+LAMBDA_THRESHOLD = 0.5
+
+CLASSES = ["ALLOW", "BLOCK_HARD", "BLOCK_ADVISORY"]
+
+
+def build_policy():
+    """The fixed hard policy the surrogate is trained against (deny-by-default)."""
+    return sb.deny_by_default([
+        sb.allow_if_capability(REQUIRED_CAP),
+        sb.deny_if_flag(HARD_FLAG),
+        sb.deny_if_action_in(BLOCKLIST),
+    ])
+
+
+def synth_request():
+    """Synthesize a governed request + advisory axes across the decision space."""
+    caps = [c for c in CAPS_UNIVERSE if random.random() < 0.5]
+    action = random.choice(ACTIONS)
+    flag = 1 if random.random() < 0.18 else 0
+    req = {"capabilities": caps, "action": action}
+    if flag:
+        req[HARD_FLAG] = True
+    # advisory Λ axes: sometimes absent (abstain), sometimes present with a
+    # spread that straddles the threshold; occasionally a zero-route axis.
+    if random.random() < 0.25:
+        axes = None
+    else:
+        k = random.randint(2, 4)
+        axes = [round(random.uniform(0.0, 1.0), 4) for _ in range(k)]
+        if random.random() < 0.12:
+            axes[random.randrange(k)] = 0.0  # non-compensatory zero-route
+    return req, axes
+
+
+def kernel_label(req, axes):
+    """Ground truth: exactly what GovernedGate.decide returns, plus which
+    authority dominated (fresh chain per call — decision is chain-independent)."""
+    gate = sb.GovernedGate(policy=build_policy(), lambda_threshold=LAMBDA_THRESHOLD,
+                           chain=sb.UnifiedReceiptChain())
+    d = gate.decide(request=req, gov_axes=axes)
+    if d.allowed:
+        return "ALLOW"
+    if d.dominant == sb.DOMINANT_HARD:
+        return "BLOCK_HARD"
+    return "BLOCK_ADVISORY"
+
+
+def features(req, axes):
+    """Structural observables of the request + advisory axes. These are what a
+    fast pre-gate can see WITHOUT running the policy chain."""
+    caps = set(req.get("capabilities") or [])
+    action = req.get("action")
+    has_req_cap = int(REQUIRED_CAP in caps)
+    n_caps = len(caps)
+    action_blocklisted = int(action in BLOCKLIST)
+    flag_set = int(bool(req.get(HARD_FLAG)))
+    # advisory axes summary (non-compensatory: min matters most)
+    if axes is None:
+        axes_present = 0
+        k = 0
+        amin = -1.0
+        amean = -1.0
+        any_zero = 0
+    else:
+        axes_present = 1
+        k = len(axes)
+        amin = min(axes) if axes else -1.0
+        amean = sum(axes) / len(axes) if axes else -1.0
+        any_zero = int(any(a <= 0.0 for a in axes))
+    return [has_req_cap, n_caps, action_blocklisted, flag_set,
+            axes_present, k, amin, amean, any_zero]
+
+
+FEATURE_NAMES = ["has_required_capability", "n_capabilities", "action_blocklisted",
+                 "hard_flag_set", "advisory_axes_present", "n_axes",
+                 "axes_min", "axes_mean", "axes_any_zero"]
+
+# ---- generate ----
+N = 24000
+X, y = [], []
+audit_idx = set(random.sample(range(N), 600))
+audit_checked = 0
+policy = build_policy()
+for i in range(N):
+    req, axes = synth_request()
+    lbl = kernel_label(req, axes)
+    X.append(features(req, axes)); y.append(lbl)
+    # ground-truth audit: independent fresh kernel replay must agree
+    if i in audit_idx:
+        gate2 = sb.GovernedGate(policy=build_policy(), lambda_threshold=LAMBDA_THRESHOLD,
+                                chain=sb.UnifiedReceiptChain())
+        d2 = gate2.decide(request=req, gov_axes=axes)
+        replay = ("ALLOW" if d2.allowed else
+                  ("BLOCK_HARD" if d2.dominant == sb.DOMINANT_HARD else "BLOCK_ADVISORY"))
+        assert replay == lbl, f"kernel disagrees on sample {i}: {replay} != {lbl} req={req} axes={axes}"
+        audit_checked += 1
+
+X = np.array(X, dtype=np.float64); y = np.array(y)
+Xtr, Xte, ytr, yte = train_test_split(X, y, test_size=0.2, random_state=SEED, stratify=y)
+clf = HistGradientBoostingClassifier(random_state=SEED, max_iter=300, early_stopping=True)
+clf.fit(Xtr, ytr)
+pred = clf.predict(Xte)
+acc = accuracy_score(yte, pred)  # this IS the fidelity: agreement% vs kernel on held-out
+per_class_recall = {c: float(recall_score(yte == c, pred == c, zero_division=0)) for c in CLASSES}
+
+out = os.path.dirname(os.path.abspath(__file__))
+joblib.dump(clf, f"{out}/model.joblib")
+model_sha = hashlib.sha256(open(f"{out}/model.joblib", "rb").read()).hexdigest()
+receipt = {
+  "artifact": "SZLHOLDINGS/szl-blocked surrogate v1",
+  "role": "BLOCK/ALLOW decision triage surrogate — kernel remains ground truth",
+  "generator": {"script": "scripts/forge.py", "seed": SEED, "kernel_version": sb.__version__,
+                 "kernel_labelled": True, "kernel_audited_samples": audit_checked,
+                 "policy": "deny_by_default([allow_if_capability('run_norm'), deny_if_flag('exfiltration'), deny_if_action_in({'exfiltrate','delete_all','drop_table'})])",
+                 "lambda_threshold": LAMBDA_THRESHOLD},
+  "data": {"rows": int(len(y)), "classes": CLASSES,
+            "class_counts": {c: int((y == c).sum()) for c in CLASSES},
+            "split": "80/20 stratified", "features": FEATURE_NAMES,
+            "feature_policy": "structural observables of the request + advisory Λ axes only; the surrogate never signs receipts or replaces the policy chain"},
+  "model": {"type": "sklearn.HistGradientBoostingClassifier",
+             "params": {"max_iter": 300, "early_stopping": True, "random_state": SEED},
+             "file": "model.joblib", "sha256": model_sha},
+  "metrics_MEASURED": {"fidelity_vs_kernel_heldout": round(float(acc), 4),
+                        "test_accuracy": round(float(acc), 4),
+                        "per_class_recall": {k: round(v, 4) for k, v in per_class_recall.items()}},
+  "environment": {"python": platform.python_version(), "sklearn": __import__("sklearn").__version__,
+                   "numpy": np.__version__, "host": "replit 2-vCPU container",
+                   "wall_seconds": round(time.time() - T0, 1)},
+  "honesty": "Every number above is MEASURED by this run. Fidelity = agreement%% with GovernedGate.decide on a held-out split. The surrogate is a fast pre-gate; the kernel's honest-BLOCKED policy chain stays authoritative. Λ untouched = Conjecture 1.",
+  "trained_at_utc": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+}
+with open(f"{out}/TRAINING_RECEIPT.json", "w") as f:
+    json.dump(receipt, f, indent=2)
+print(json.dumps(receipt["metrics_MEASURED"], indent=2))
+print(f"rows={len(y)} kernel_audited_samples={audit_checked} wall={receipt['environment']['wall_seconds']}s")