szl-provctl — provenance-DAG control + supply-chain interop

🟩 Kernel + REAL trained surrogate. The provenance-DAG control kernel (Python stdlib-only, in-toto v1 / SLSA v1 interop + edge-by-edge DAG verification) is UNCHANGED and remains the sole ground truth. Since surrogate v1 this repo also ships model.joblib — a real trained sklearn classifier that triages which anomaly class the kernel's verify_dag(...) would report, with MEASURED fidelity 1.0000 (agreement vs the kernel on a held-out split) and 1.0000 per-class recall across every reachable anomaly. The surrogate never replaces the kernel's full DAG traversal. Λ = Conjecture 1 · ADVISORY.

A provenance-DAG and supply-chain interoperability kernel. szl-provctl emits declared in-toto Statement v1 and SLSA provenance v1 shapes, walks an ML provenance DAG and checks its recorded edges, and binds a per-kernel NVML energy observation to a signable provenance chain. It converts a szl-kernels UnifiedReceiptChain into these documented forms. External-verifier compatibility must be tested separately.

Kernel Hub migration (verified 2026-07-15): get_kernel(...) resolves the first-class Kernel Hub repo; main and v1 pin verified revision 81f787f24c7b0612aea8bb7b0374afcca3ab0250.

Quickstart

pip install kernels

from kernels import get_kernel
pc = get_kernel("SZLHOLDINGS/szl-provctl", revision="main", trust_remote_code=True)
print(pc.selfcheck()["ok"])   # True — 23 checks: interop shapes, DAG verify/tamper, MEASURED energy

chain = pc.UnifiedReceiptChain()
chain.emit("governed_norm", "rms_norm", {"in_shape": [4, 64], "eps": 1e-6})

stmt = pc.statement_from_chain(chain, lambda_score=0.9, decision="ALLOWED")
assert stmt["_type"] == "https://in-toto.io/Statement/v1"
assert stmt["subject"][0]["digest"]["sha3_256"] == chain.head()

slsa = pc.slsa_statement(chain=chain, resolved_dependencies=[...], invocation_id="run-1")
assert slsa["predicateType"] == "https://slsa.dev/provenance/v1"

Three implemented capabilities

Interop shapes. statement_from_chain(...) → declared in-toto v1 Statement (subject digest = chain head). slsa_statement(...) → declared SLSA v1.0 provenance predicate. The repository selfcheck covers required fields/bindings; validate against your chosen external verifier before production use.
Provenance-DAG traversal. verify_dag() topologically resolves the graph, verifies each chain's internal hash-chain and each recorded edge's dependency head, returns the first break (chain_integrity / edge_mismatch / missing_dependency / cycle). honest-BLOCKED nodes are surfaced, never dropped.
Per-kernel MEASURED energy. measure_kernel_energy(...) reads the real NVML cumulative-energy counter delta around a single kernel call and writes a receipt naming the exact kernel/op. No GPU/NVML → joules=None, UNAVAILABLE_NO_NVML. Never fabricated.

What it proves — and what it does NOT

✅ The selfcheck validates documented in-toto/SLSA field shapes and chain-head bindings. External compatibility is not claimed until tested.
❌ Does NOT prove Λ uniqueness — proven_trust is structurally locked False. Λ = Conjecture 1 (OPEN), advisory only.
❌ Does NOT fabricate energy — a non-MEASURED joule value is rejected at build time.
The hash-chain digest is an integrity fingerprint, not a signature — signing is szl-govsign's job (DSSE / Sigstore, out of band).

Prior art: in-toto, SLSA, DSSE, OpenSSF model-signing, CodeCarbon. The https://szl.holdings/governance/v1 predicate and governed-run/v1 buildType are SZL's own.

The governed-kernel series

Part of the szl-kernels suite alongside szl-govsign, szl-blocked, szl-lambda-gate, szl-governed-norm, governed-inference-meter. Live demo: szl-provctl-live · substrate a-11-oy.com.

License

Trained provenance-DAG anomaly surrogate v1 (MEASURED — see `TRAINING_RECEIPT.json`)

A real sklearn HistGradientBoostingClassifier trained on 8,300 synthesized provenance DAGs labeled by this kernel itself (ProvenanceDAG.verify_dag()['first_break']['kind']; seed 20260721; 700 DAGs re-audited by full kernel replay during generation — all agreed). Each corrupted DAG injects EXACTLY one anomaly (single-aspect rule). Features are graph-structural observables (node/edge counts, indegrees, edge density) plus cheap per-node chain-integrity recompute and edge-head-match recompute.

metric	value
fidelity vs kernel (held-out agreement)	1.0000
test accuracy	1.0000

per-class recall	value
`clean`	1.0000
`cycle`	1.0000
`edge-mismatch`	1.0000
`chain-integrity`	1.0000

Honest scope + measured kernel limitation: the four classes above are exactly the anomaly verdicts the kernel can actually produce. The kernel's fifth documented kind, missing_dependency, is UNREACHABLE — verify_dag's topological sort raises KeyError on a ghost edge before the per-edge missing-dependency check runs, so no DAG can be labeled with it via the public API. We do not fabricate a class the kernel cannot emit; this is reported, not hidden. Class counts: {'clean': 2600, 'cycle': 1900, 'edge-mismatch': 1900, 'chain-integrity': 1900}. Perfect recall reflects that these anomalies are exactly recoverable from cheap structural recomputes — the surrogate is fast triage; the kernel's full verify_dag traversal + in-toto/SLSA interop stay authoritative. Λ untouched = Conjecture 1.

import joblib
clf = joblib.load("model.joblib")   # feature spec: TRAINING_RECEIPT.json data.features

Re-verify everything: python scripts/eval.py (sha256-checks the shipped model against the receipt, regenerates the seeded kernel-labeled dataset, retrains, and compares fidelity within ±0.02).

Source of record & family. get_kernel resolves the pinned Kernel Hub repo (verified revision 81f787f24c7b0612aea8bb7b0374afcca3ab0250); this kernel has no separate GitHub repository — the Kernel Hub repo is the source of record (honest label, nothing hidden). Family: szl-kernels hub · Governed Kernels & Verifiers · github.com/szl-holdings.

_{SZL Holdings honesty footer. Λ = Conjecture 1 (advisory, never a theorem). locked-proven = exactly 8 {F1,F4,F7,F11,F12,F18,F19,F22}. Honesty labels: MEASURED / REPORTED / MODELED / HEURISTIC / UNKNOWN / UNAVAILABLE. Trust never 100% (ceiling 0.97). honest-BLOCKED is never flipped. a-11-oy.com · huggingface.co/SZLHOLDINGS}