SZL Holdings 的 szl-trust 仓库：Covenant Proof Standard 运行工件与离线验证

SZL Holdings · Doctrine v11 · Λ = Conjecture 1 (advisory, never "green"/theorem) · canonical a-11-oy.com

Control before action. Evidence after.

Product · Proof · GitHub organization

STATUS — ACTIVE HISTORICAL PROOF REGISTRY. This repository remains the source-of-record for the published trust run artifacts and their offline verification helpers stored here. The former docs-site consolidation target is now an archived mirror whose repository metadata points to a11oy-net as the canonical proof-site source. The public proof surface is a11oy.net. See DEPRECATED.md for the superseded consolidation history; it is not current deprecation authority for this repository.

SZL Holdings Public Trust Portal · Doctrine v11 LOCKED (749 / 14 / 163) · CC-BY-4.0

Source-of-truth note (2026-09-22): The June docs-site copy is historical. szl-trust owns the published historical artifact bytes and verification material in this repository; a11oy-net owns the current proof-site source and deployment evidence for a11oy.net. A copied or archived mirror does not establish current runtime alignment.

A measurable governance operator on the receipt-bus σ-algebra of agentic AI — publishing Covenant Proof Standard run artifacts from experiment executions that the run producer flagged mocked:false, with evidence chains for external auditability.

What this is

szl-trust is the public transparency layer of the SZL Holdings governed AI platform. It publishes Covenant Proof Standard (CPS) run artifacts — hash-chained, cryptographically verifiable governance receipts from experiment executions flagged mocked:false by the run producer. The canonical reference run is the E4 Codex Kernel (2026-04-29): 12 receipts, all mocked:false, 12 proof ledger steps, 12 trace spans in trace.jsonl (all validators PASS), with a deployment_contract.json anchoring the full run to a specific repo_commit. mocked:false is a flag the producer sets; on its own it does not show how the run was executed. The run's version_lineage.json records model_provider: proxy_or_offline_emulator and model_version: deterministic.

External auditors, partners, and regulators can verify every decision without SZL tooling.

Quickstart

Receipts are plain JSON, verifiable without any SZL tooling:

git clone https://github.com/szl-holdings/szl-trust
cd szl-trust

# Inspect the E4 Codex Kernel run
cat runs/E4-codex-kernel-2026-04-29/run_manifest.json | jq '.deliverables'
cat runs/E4-codex-kernel-2026-04-29/proof_ledger.jsonl | head -3 | jq '.'

# Verify mocked:false on all receipts
cat runs/E4-codex-kernel-2026-04-29/trace.jsonl | jq '[.decision_receipt.mocked] | unique'
# → [false]

E4 Codex Kernel run at a glance

Key files

Honesty scope

• Not a live execution system. Read-only audit artifact registry — publishes receipts, does not execute AI decisions.
• Not independently sufficient for trust. Receipts should be verified against the Ouroboros runtime.
• Not a general-purpose blockchain ledger. JSON artifacts anchored by Merkle roots; Cardano anchoring (via the receipt-minting layer) is separate.
• SLSA L1 honest — provenance generated; L2/L3 not claimed.
• Λ-uniqueness = Conjecture 1 (not a theorem).
• No FedRAMP / Iron Bank / CMMC claims.

Related

Citation

See CITATION.cff. Preferred: The Ouroboros Substrate (v18.0), DOI 10.5281/zenodo.20434276.

License

CC-BY-4.0. Artifacts may be used and redistributed with attribution to SZL Holdings. Security disclosures: security@szlholdings.com — see SECURITY.md.

Doctrine v11 LOCKED · 749/14/163 · kernel c7c0ba17 · Λ = Conjecture 1 · SLSA L1 honest

Signed-off-by: stephenlutar2-hash stephenlutar2@gmail.com

One-click buyer verification

Run verify.sh to verify a receipt from this repo in under 30 seconds — no SZL tooling required:

# Clone and run
git clone https://github.com/szl-holdings/szl-trust
cd szl-trust
chmod +x verify.sh
./verify.sh

The script:

1. Fetches the org cosign public key from szl-lake
2. Fetches decision_receipt.json from the E4 run in this repo
3. Confirms the receipt carries mocked:false (a flag set by the run producer)
4. Recomputes SHA-256 of the decoded payload
5. Attempts ECDSA-P256 DSSE signature verification against the cosign public key
6. Probes Lean-kernel liveness against the ROADMAP HF Space SZLHOLDINGS/lean-kernel (not yet deployed — the probe reports unreachable and is non-fatal). Live governed-kernel artifacts: SZLHOLDINGS/szl-kernels

Expected verdict line when the mocked:false check passes: ✓ VERIFIED — receipt is flagged mocked:false by its producer

Honest limits: DSSE signing is PLACEHOLDER when HATUN_MCP_SIGNING_KEY is unset at runtime — the receipt will say so honestly (never fabricates a signature). Trust ceiling = 0.97 (never 1.0 by doctrine). Λ = Conjecture 1 (advisory, not a theorem).

To verify the DSSE sig with cosign directly:

cosign verify-blob \
  --key /tmp/szl_cosign.pub \
  --bundle runs/E4-codex-kernel-2026-04-29/cosign-bundle.json \
  runs/E4-codex-kernel-2026-04-29/decision_receipt.json

Offline chain-integrity check (no network, no SZL tooling)

scripts/verify_chain.py verifies the internal consistency of a published run entirely offline (Python 3 standard library only — no deps, no network):

python3 scripts/verify_chain.py            # verify every run under runs/
python3 scripts/verify_chain.py runs/E4-codex-kernel-2026-04-29

It is fail-closed: a malformed / truncated JSON record, a step gap or reorder, a broken hash-chain link, a ledger↔trace state-binding mismatch, a receipt-id disagreement, a non-boolean mocked posture, or a manifest anchor that does not match the final ledger state each cause a non-zero exit — nothing is silently skipped. The adversarial suite in tests/test_verify_chain.py (run: python3 -m unittest discover -s tests) mutates a copy of the real E4 artifacts and asserts every such tampering is rejected.

State hashes in the ledger, trace (previous and next), and manifest anchor must be 32-character lowercase hexadecimal strings, matching the historical E4 run format. Nulls, non-string values, and malformed hash strings are rejected before comparison. Every span after the first must link to its predecessor; the first previous-state hash is checked for format but has no external genesis anchor. This format check does not identify a hash algorithm or establish authenticity.

Honest scope: this is advisory tamper-evidence — it shows the published artifacts are self-consistent (any edit to one record breaks a cross-referenced invariant), not a proof of authenticity. It does not assert the state hashes were produced by a trusted signer and never fabricates a signature. Λ = Conjecture 1 (advisory). Trust ceiling 0.97 — never 1.0 by doctrine.