Publish verified torch-cpu kernel v1

Dedicated Kernel Hub migration from legacy model commit 883050fab65a1bb2096c77526dbfdabaf3fc4a3a. Locally loaded with kernels 0.16.0 on CPU and passed its bounded verification.

Files changed (6) hide show

LICENSE +19 -0
README.md +273 -0
build/torch-cpu/metadata.json +10 -0
build/torch-cpu/szl_kernels/__init__.py +257 -0
build/torch-cpu/szl_kernels/_chain.py +265 -0
build/torch-cpu/szl_kernels/_ops.py +220 -0

LICENSE ADDED Viewed

	@@ -0,0 +1,19 @@

+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+   Copyright 2026 SZL Holdings
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+       http://www.apache.org/licenses/LICENSE-2.0
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+   The full Apache License 2.0 text is available at the URL above.

README.md ADDED Viewed

	@@ -0,0 +1,273 @@

+---
+tags:
+- kernel
+- governance
+- provenance
+- suite
+- doi:10.5281/zenodo.19944926
+library_name: kernels
+license: apache-2.0
+szl-governance:
+  verdict: ADVISORY
+  lambda: "Conjecture 1 (open) — uniqueness unproven; advisory only"
+  energy: MEASURED-only (real NVML delta; None when unavailable)
+  provenance: UnifiedReceiptChain (SHA3-256, op-agnostic, cross-kernel)
+  honest_blocked: "a failed check stays failed — never faked green"
+---
+<p align="center">
+  <a href="https://huggingface.co/SZLHOLDINGS/szl-kernels/tree/main/build/torch-universal/szl_kernels"><img src="https://img.shields.io/badge/kernel%20hub-torch--universal-5b8dee?style=flat-square" alt="kernel hub"></a>
+  <a href="https://huggingface.co/SZLHOLDINGS/szl-kernels/blob/main/MODEL_PROVENANCE.json"><img src="https://img.shields.io/badge/provenance-MODEL_PROVENANCE.json-3af4c8?style=flat-square" alt="provenance"></a>
+  <a href="https://huggingface.co/SZLHOLDINGS/szl-kernels/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-7e8aa3?style=flat-square" alt="license"></a>
+</p>
+# szl-kernels — the unified governed-kernel suite
+**The first kernel that governs provenance *across* ops, not just within one.** A `get_kernel`-discoverable suite that ties SZL Holdings' three governed kernels — [`szl-governed-norm`](https://huggingface.co/SZLHOLDINGS/szl-governed-norm), [`szl-lambda-gate`](https://huggingface.co/SZLHOLDINGS/szl-lambda-gate), and [`governed-inference-meter`](https://huggingface.co/SZLHOLDINGS/governed-inference-meter) — into **one shared, hash-chained `UnifiedReceiptChain`**, and anchors a governance/interop layer on top: [`szl-govsign`](https://huggingface.co/SZLHOLDINGS/szl-govsign) (signs the verdict), [`szl-blocked`](https://huggingface.co/SZLHOLDINGS/szl-blocked) (refuses honestly + derives EU AI Act Annex IV), and [`szl-provctl`](https://huggingface.co/SZLHOLDINGS/szl-provctl) (verifies the provenance DAG + bridges to in-toto/SLSA).
+> Every Kernel Hub leader competes on **FLOPs per op**. They do not sign their build artifacts, they do not surface an honest BLOCKED verdict, and they do not stitch provenance *across* ops. `szl-kernels` opens that lane: a real forward pass touching norm + an advisory Λ gate + an energy reading produces **one auditable, tamper-evident log** — not three disconnected ones.
+## Quickstart
+```bash
+pip install kernels torch
+```
+```python
+import torch
+from kernels import get_kernel
+# Current `kernels` (>=0.15) requires an explicit revision/version + trust flag for org kernels:
+suite = get_kernel("SZLHOLDINGS/szl-kernels", revision="main", trust_remote_code=True)
+print(suite.list_kernels())     # the 3 numeric suite members + honest roles
+print(suite.list_series())      # the governance/interop companions (govsign, blocked, provctl)
+print(suite.selfcheck())        # one-shot CPU health: ALL checks pass
+# ONE shared chain spanning multiple ops:
+chain = suite.UnifiedReceiptChain()
+x = torch.randn(4, 64)
+y    = suite.governed_rms_norm(chain, x, eps=1e-6)                      # governed_norm
+gate = suite.governed_lambda_gate(chain, torch.tensor([0.9,0.8,0.95]))  # lambda_gate (advisory)
+e    = suite.governed_measure_energy(chain)                            # energy_core (MEASURED-only)
+ok, depth, brk = chain.verify()       # the WHOLE pass verifies as ONE chain
+print(ok, depth, chain.kernels_touched())   # True 3 ['governed_norm','lambda_gate','energy_core']
+print(chain.to_json())                # export for offline third-party re-verification
+```
+### Flagship — a governed transformer sub-block
+```python
+blk = suite.GovernedBlock()
+res = blk.forward(x, gov_axes=torch.tensor([0.95, 0.9, 0.92]))
+print(res["chain_ok"], res["chain_depth"], res["kernels_touched"])
+# norm + advisory Λ gate + energy + binding receipt = 4 ops, one verifiable chain.
+# The Λ gate is ADVISORY: it is recorded for audit, it does NOT alter the numerics.
+```
+## Cookbook
+Three copy-paste recipes spanning the governed-kernel series. Every printed value is
+labeled **expected shape (not executed here)** — the shapes are transcribed from each
+kernel's committed API, not from a run on this card (SZL doctrine: never self-download to
+inflate counters, never fabricate an output). Λ stays **Conjecture 1 (OPEN)**; energy stays
+**MEASURED-only**; a BLOCKED verdict stays BLOCKED.
+### 1 — One receipt chain across three ops (suite)
+```python
+import torch
+from kernels import get_kernel
+suite = get_kernel("SZLHOLDINGS/szl-kernels", revision="main", trust_remote_code=True)
+chain = suite.UnifiedReceiptChain()
+x = torch.randn(4, 64)
+suite.governed_rms_norm(chain, x, eps=1e-6)                        # op 1: governed_norm
+suite.governed_lambda_gate(chain, torch.tensor([0.9, 0.8, 0.95]))  # op 2: lambda_gate (ADVISORY)
+suite.governed_measure_energy(chain)                              # op 3: energy_core (MEASURED-only)
+ok, depth, first_break = chain.verify()
+print(ok, depth, chain.kernels_touched())
+# expected shape (not executed here):
+#   True 3 ['governed_norm', 'lambda_gate', 'energy_core']
+#   -> one hash-chain, three ops, verifies as ONE ordered sequence.
+#   The Λ gate receipt is ADVISORY (Conjecture 1, OPEN): recorded, never proven trust.
+#   energy_core reports joules=None + UNAVAILABLE_NO_NVML on CPU — never a fabricated joule.
+```
+### 2 — honest-BLOCKED, not fake-green (szl-blocked)
+```python
+from kernels import get_kernel
+blk = get_kernel("SZLHOLDINGS/szl-blocked", revision="main", trust_remote_code=True)
+chain  = blk.UnifiedReceiptChain()
+policy = blk.deny_if_action_in({"exfiltrate", "delete_all"})
+work   = lambda v: v * 2
+allowed = blk.governed_call(work, policy, chain, request={"action": "summarize"},  args=(21,))
+blocked = blk.governed_call(work, policy, chain, request={"action": "exfiltrate"}, args=(21,))
+print(allowed.blocked, allowed.output)
+print(blocked.blocked, blocked.output)
+# expected shape (not executed here):
+#   False 42     -> ALLOWED path ran work(21); an ALLOW receipt is on the chain.
+#   True None    -> BLOCKED path: work was NEVER called, output is None,
+#                   a BLOCK receipt is recorded. Honest-BLOCKED, never faked green.
+```
+### 3 — Sign then verify a governance verdict (szl-govsign / DSSE)
+```python
+from kernels import get_kernel
+gs = get_kernel("SZLHOLDINGS/szl-govsign", revision="main", trust_remote_code=True)
+priv = gs.generate_ephemeral_keypair()   # production: Sigstore keyless / cosign key, out-of-band
+pred = gs.build_governance_predicate(
+    lambda_verdict = gs.LambdaVerdict(score=0.92, notes="advisory only — Conjecture 1 (OPEN)"),
+    energy         = gs.EnergyLabel(value=12.5, unit="joules"),   # MEASURED-only
+    decision       = gs.GovernanceDecision(status="ALLOWED", reason="passed gates"),
+    honest_blocked = False,
+)
+subjects = [gs.Subject(name="szl_kernels/UnifiedReceiptChain", digest={"sha256": "<chain-head>"})]
+envelope = gs.attest(subjects, pred, priv)
+print(gs.verify(envelope, priv.public_key()))
+# expected shape (not executed here):
+#   True   -> DSSE envelope (ECDSA P-256) verifies: authorship + integrity of the verdict.
+#            Any tamper -> verify() returns False (fails closed).
+#            The signature does NOT upgrade Λ to proven trust: proven_trust is locked False.
+```
+> These recipes chain across three separately published, `get_kernel`-discoverable kernels.
+> See [`szl-provctl`](https://huggingface.co/SZLHOLDINGS/szl-provctl) to turn any of these
+> chains into a spec-exact in-toto v1 / SLSA v1 statement the wider supply-chain world verifies.
+## The governed-kernel series
+Independently published, `get_kernel`-discoverable kernels that share one `UnifiedReceiptChain`. The first three are the **numeric core**; govsign + blocked + provctl are the **governance / interop layer**.
+| Kernel | Lane | Live hologram |
+|---|---|---|
+| [`szl-governed-norm`](https://huggingface.co/SZLHOLDINGS/szl-governed-norm) | RMSNorm/LayerNorm + SHA3-256 receipts | [`governed-norm-holo`](https://szlholdings-governed-norm-holo.static.hf.space) ✅ **live** |
+| [`szl-lambda-gate`](https://huggingface.co/SZLHOLDINGS/szl-lambda-gate) | advisory Λ gate (Conjecture 1, OPEN) | [`lambda-gate-holo`](https://szlholdings-lambda-gate-holo.static.hf.space) ✅ **live** |
+| [`governed-inference-meter`](https://huggingface.co/SZLHOLDINGS/governed-inference-meter) | MEASURED-joule energy accounting | [`energy-attest-holo`](https://szlholdings-energy-attest-holo.static.hf.space) ✅ **live** |
+| [`szl-govsign`](https://huggingface.co/SZLHOLDINGS/szl-govsign) | signed governance attestation (DSSE / in-toto, ECDSA P-256) | [`szl-govsign-live`](https://szlholdings-szl-govsign-live.static.hf.space) ✅ **live** |
+| [`szl-blocked`](https://huggingface.co/SZLHOLDINGS/szl-blocked) | honest-BLOCKED first-class state + EU AI Act Annex IV DRAFT | [`szl-blocked-live`](https://szlholdings-szl-blocked-live.static.hf.space) ✅ **live** |
+| [`szl-provctl`](https://huggingface.co/SZLHOLDINGS/szl-provctl) | provenance-DAG verify + in-toto v1 / SLSA v1 interop + per-kernel MEASURED energy | [`szl-provctl-live`](https://szlholdings-szl-provctl-live.static.hf.space) ✅ **live** |
+| **`szl-kernels`** (this repo) | **unified suite — cross-kernel `UnifiedReceiptChain`** | [`szl-kernels-live`](https://szlholdings-szl-kernels-live.static.hf.space) ✅ **live** |
+`suite.list_kernels()` returns the numeric core; `suite.list_series()` returns the govsign + blocked + provctl governance/interop layer.
+### The honest-model trio (offline replays of the live Alloy surface)
+Published as HF **model** repos (NOT trained models, NO weights — pure-Python, stdlib-only offline replays). Each ships a `library_name: kernels` card and MEASURED local test counts:
+| Model | Lane | Tests (MEASURED) |
+|---|---|---|
+| [`szl-invariants`](https://huggingface.co/SZLHOLDINGS/szl-invariants) | 8 falsifiable receipt/ledger invariants, offline | 14/14 |
+| [`szl-ouroboros`](https://huggingface.co/SZLHOLDINGS/szl-ouroboros) | bounded-loop trace + MEASURED/DERIVED loop-tax accounting | 13/13 |
+| [`szl-formulas`](https://huggingface.co/SZLHOLDINGS/szl-formulas) | the 21 canonical formulas + governed-loop composer, PROOF-STATUS mirrored verbatim (locked-proven = exactly 8) | 17/17 |
+## The gap this closes
+Today even SZL's own governance is fragmented: `szl-governed-norm` keeps its own receipt chain, the energy meter keeps its own ledger, and `szl-lambda-gate` keeps none. So a single forward pass yields three logs no third party can re-walk as one ordered, tamper-evident sequence. `UnifiedReceiptChain` is that missing artifact — op-agnostic SHA3-256 receipts that hash-chain norm, Λ, and energy calls into **one** verifiable stream, in call order. `szl-govsign` then makes that chain head third-party-verifiable; `szl-blocked` makes a refusal a recorded, first-class state and derives the compliance paperwork from it; `szl-provctl` verifies the whole multi-run provenance DAG and bridges it to the in-toto/SLSA formats the rest of the supply-chain world reads.
+## API
+| Symbol | What it does |
+|---|---|
+| `UnifiedReceiptChain` | Op-agnostic SHA3-256 hash chain. `emit`, `verify() -> (ok, depth, first_break)`, `kernels_touched()`, `to_json()`, `verify_json()` (offline). |
+| `governed_rms_norm(chain, x, weight=None, eps=1e-6)` | RMSNorm + a receipt into the shared chain. Numerics match `szl-governed-norm`. |
+| `governed_layer_norm(chain, x, ...)` | LayerNorm + receipt. |
+| `governed_lambda_gate(chain, axes, weights=None, threshold=0.5)` | **Advisory** Λ gate; records an advisory receipt (`advisory=True`, never proven trust). |
+| `governed_measure_energy(chain, measurement=None)` | Records an energy reading **verbatim** — `joules=None` + `UNAVAILABLE_NO_NVML` when no GPU. Never fabricated. |
+| `GovernedBlock` | Pre-norm sub-block composing all three + a binding receipt into one auditable pass. |
+| `list_kernels()`, `list_series()`, `get_member()`, `selfcheck()` | Numeric registry + governance-layer series + one-shot CPU health check. |
+## Honesty (SZL doctrine)
+- **Λ is advisory.** Its uniqueness is **Conjecture 1 — OPEN**. A recorded gate "pass" is a non-compensatory advisory signal, **never proven trust**.
+- **Energy is MEASURED-only.** Real NVML cumulative-energy delta when a GPU is present; otherwise `joules=None`, labeled `UNAVAILABLE_NO_NVML`. **No joule is ever fabricated.**
+- **The digest is an integrity fingerprint, not a signature.** SHA3-256 over a canonical receipt body proves tamper-evidence + ordering — not authorship. Signing is a separate, out-of-band layer — see [`szl-govsign`](https://huggingface.co/SZLHOLDINGS/szl-govsign) for DSSE / in-toto attestation.
+- **Honest BLOCKED beats fake green.** A failed verification stays failed — see [`szl-blocked`](https://huggingface.co/SZLHOLDINGS/szl-blocked) for refusal as a first-class, provenanced state.
+- **Universal (pure-Python) suite — a correctness + provenance reference, not a CUDA speed record. No fabricated benchmarks.** Suite tests: 7/7 passing.
+## Provenance
+Backed by the Lean 4 formalization [szl-holdings/lutar-lean](https://github.com/szl-holdings/lutar-lean) (749 declarations / 14 axioms / 163 tracked sorries), DOI [10.5281/zenodo.20434308](https://doi.org/10.5281/zenodo.20434308). Λ uniqueness = Conjecture 1 (open).
+## See it live
+- ✅ **Live now:** [a11oy](https://huggingface.co/spaces/SZLHOLDINGS/a11oy) (live governed inference) · [hatun-mcp](https://huggingface.co/spaces/SZLHOLDINGS/hatun-mcp). **All eight demo Spaces below are live** (static, in-browser).
+- 📚 **Collection:** [Governed Kernels — verifiable AI building blocks](https://huggingface.co/collections/SZLHOLDINGS/governed-kernels-verifiable-ai-building-blocks-6a41d3936cfce4fba83ce378) — the whole family in one page. **Live console:** [a11oy](https://szlholdings-a11oy.hf.space) · [a-11-oy.com](https://a-11-oy.com) · [llm-router](https://szlholdings-llm-router-live.hf.space) · [receipt verifier](https://szlholdings-governed-receipt-verifier.static.hf.space) · [receipt spec (hub)](https://github.com/szl-holdings/governed-receipt-spec).
+- ✅ Suite: [`szl-kernels-live`](https://szlholdings-szl-kernels-live.static.hf.space) ✅ **live** — holographic cross-kernel provenance graph with in-browser SHA3-256 + tamper / honest-BLOCKED demo.
+- ✅ Members: [`governed-norm-holo`](https://szlholdings-governed-norm-holo.static.hf.space) ✅ **live** · [`lambda-gate-holo`](https://szlholdings-lambda-gate-holo.static.hf.space) ✅ **live** · [`energy-attest-holo`](https://szlholdings-energy-attest-holo.static.hf.space) ✅ **live** · [`receipt-chain-live`](https://szlholdings-receipt-chain-live.static.hf.space) ✅ **live**
+- ✅ Governance layer: [`szl-govsign-live`](https://szlholdings-szl-govsign-live.static.hf.space) ✅ **live** · [`szl-blocked-live`](https://szlholdings-szl-blocked-live.static.hf.space) ✅ **live** · [`szl-provctl-live`](https://szlholdings-szl-provctl-live.static.hf.space) ✅ **live**
+- 🔮 `szl-substrate` *(ROADMAP — not yet live)* — the hub tying the whole governed-compute substrate together.
+## Compatibility
+Python 3.9+, `torch>=2.5`, standard library + torch only. Runs on CPU and CUDA.
+## License
+Apache-2.0. Copyright 2026 SZL Holdings.
+---
+<sub><b>SZL Holdings</b> · unified governed-kernel suite · cross-kernel provenance · Λ advisory (Conjecture 1) · energy MEASURED-only · <a href="https://a-11-oy.com">a-11-oy.com</a> · <a href="https://github.com/szl-holdings">github.com/szl-holdings</a> · <a href="https://huggingface.co/SZLHOLDINGS">huggingface.co/SZLHOLDINGS</a></sub>
+---
+[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.19944926.svg)](https://doi.org/10.5281/zenodo.19944926)
+## Citation
+**Cite this.** Part of the SZL Holdings *Ouroboros Thesis* (Governed Post-Determinism).
+Concept DOI (always-latest): [10.5281/zenodo.19944926](https://doi.org/10.5281/zenodo.19944926).
+Author: Stephen P. Lutar Jr. · [ORCID 0009-0001-0110-4173](https://orcid.org/0009-0001-0110-4173) · License CC-BY-4.0.
+Full DOI-pinned lineage (v1→v26) + the 8 papers: [szl-papers PAPERS_INDEX](https://github.com/szl-holdings/szl-papers/blob/main/PAPERS_INDEX.md).
+No artifact-specific DOI is minted for this model; the concept DOI above covers the program.
+Honesty (Doctrine v11): Λ unconditional uniqueness is **Conjecture 1** (machine-checked FALSE as stated) — never a theorem; conditional uniqueness is **Theorem U** (axiom-free). Locked-proven formulas = **exactly 8** {F1,F4,F7,F11,F12,F18,F19,F22}; ~185 experimental theorems are a separate CI-green tier; Khipu BFT safety = Conjecture 2. Trust never 100%.
+```bibtex
+@misc{lutar_szl_ouroboros,
+  author    = {Lutar, Stephen P., Jr.},
+  title     = {SZL Holdings --- The Ouroboros Thesis (Governed Post-Determinism)},
+  year      = {2026},
+  publisher = {Zenodo},
+  doi       = {10.5281/zenodo.19944926},
+  url       = {https://doi.org/10.5281/zenodo.19944926},
+  note      = {Concept DOI --- always resolves to the latest version. ORCID 0009-0001-0110-4173. CC-BY-4.0.}
+}
+```
+*Signed-off-by: Stephen Lutar <stephenlutar2@gmail.com>*
+## Files in this repo
+| Path | What it is |
+|---|---|
+| `build/torch-universal/szl_kernels/__init__.py` | public API — suite entry points + `selfcheck()` |
+| `build/torch-universal/szl_kernels/_chain.py` | cross-kernel `UnifiedReceiptChain` (SHA3-256) |
+| `build/torch-universal/szl_kernels/_ops.py` | the governed op set |
+| `tests/test_suite.py` | suite test |
+| `build.toml` · `metadata.json` | Kernel Hub build/metadata manifests |
+| `LICENSE` · `SECURITY.md` | Apache-2.0 · security policy |
+---
+<p align="center">
+  <a href="https://huggingface.co/SZLHOLDINGS">SZL Holdings</a> ·
+  <a href="https://a-11-oy.com">a-11-oy.com</a> ·
+  <a href="https://huggingface.co/SZLHOLDINGS/a11oy-v19-substrate">a11oy-v19-substrate</a>
+</p>
+<p align="center"><sub>SLSA: L1 honest · L2 attested · L3 roadmap. Λ = Conjecture 1. Trust ceiling 0.97.</sub></p>

build/torch-cpu/metadata.json ADDED Viewed

	@@ -0,0 +1,10 @@

+{
+  "name": "szl-kernels",
+  "id": "_szl_kernels_cpu_0d1a832737",
+  "version": 1,
+  "license": "Apache-2.0",
+  "python-depends": [],
+  "backend": {
+    "type": "cpu"
+  }
+}

build/torch-cpu/szl_kernels/__init__.py ADDED Viewed

	@@ -0,0 +1,257 @@

+# SPDX-License-Identifier: Apache-2.0
+# © 2026 SZL Holdings · Stephen P. Lutar · ORCID 0009-0001-0110-4173
+"""szl_kernels — SZL Holdings' unified governed-kernel SUITE.
+ONE get_kernel-discoverable package that ties the three governed kernels plus
+the energy meter into a single suite with a SHARED, op-agnostic
+``UnifiedReceiptChain`` — cross-kernel provenance in one auditable forward pass.
+This is the gap the Kernel Hub leaders leave open: they optimize FLOPs per op;
+SZL governs provenance ACROSS ops.
+Suite members (each independently published as its own Hub kernel):
+  * governed_norm  -> SZLHOLDINGS/szl-governed-norm   (RMSNorm/LayerNorm + receipts)
+  * lambda_gate    -> SZLHOLDINGS/szl-lambda-gate     (advisory Λ gate; Conjecture 1)
+  * energy_core    -> szl_energy_core / governed-inference-meter (MEASURED joules)
+  * govsign        -> SZLHOLDINGS/szl-govsign         (signed governance attestation; DSSE / in-toto)
+  * blocked        -> SZLHOLDINGS/szl-blocked         (honest-BLOCKED first-class state + EU AI Act Annex IV)
+  * provctl        -> SZLHOLDINGS/szl-provctl         (provenance-DAG verify + in-toto v1 / SLSA v1 interop + per-kernel MEASURED energy)
+The first three are the NUMERIC core exercised by the shared forward pass.
+govsign + blocked are GOVERNANCE-LAYER series companions: govsign makes a
+verdict third-party-verifiable (sign/verify offline), and blocked makes a
+refusal a first-class, provenanced state (the op never runs — no fake-green)
+and derives an EU AI Act Annex IV DRAFT skeleton from the same chain.
+Discover + use the suite:
+    from kernels import get_kernel
+    suite = get_kernel("SZLHOLDINGS/szl-kernels", revision="main", trust_remote_code=True)
+    print(suite.list_kernels())            # {'governed_norm':..., 'lambda_gate':..., 'energy_core':...}
+    print(suite.list_series())             # {'govsign':..., 'blocked':..., 'provctl':...}
+    print(suite.selfcheck())               # one-shot suite health (CPU only)
+    # ONE shared chain spanning multiple ops:
+    chain = suite.UnifiedReceiptChain()
+    import torch
+    x = torch.randn(4, 64)
+    y = suite.governed_rms_norm(chain, x, eps=1e-6)
+    gate = suite.governed_lambda_gate(chain, torch.tensor([0.9, 0.8, 0.95]), threshold=0.5)
+    e = suite.governed_measure_energy(chain)   # None joules when no NVML — never faked
+    ok, depth, brk = chain.verify()            # the WHOLE pass verifies as one chain
+    print(chain.kernels_touched())             # ['governed_norm','lambda_gate','energy_core']
+    # Flagship composition — a governed transformer sub-block:
+    blk = suite.GovernedBlock()
+    res = blk.forward(x, gov_axes=torch.tensor([0.95, 0.9, 0.92]))
+    print(res["chain_ok"], res["chain_depth"], res["kernels_touched"])
+HONESTY (SZL doctrine v11):
+  * Λ is the weighted-geometric-mean ADVISORY aggregator; its uniqueness is
+    Conjecture 1 (OPEN). A recorded gate "pass" is advisory, NEVER proven trust.
+  * Energy joules are MEASURED-only (real NVML delta). No GPU/NVML => None /
+    UNAVAILABLE_NO_NVML, NEVER a fabricated joule.
+  * Receipt digests are SHA3-256 integrity fingerprints — tamper-evidence +
+    ordering, NOT signatures and NOT proof of authorship.
+  * This is a UNIVERSAL (pure-Python) suite: a correctness + provenance
+    reference, not a hand-tuned CUDA speed record. No fabricated benchmarks.
+"""
+from typing import Any, Dict
+import torch
+from ._chain import GENESIS, UnifiedReceiptChain, tensor_digest
+from ._ops import (
+    GovernedBlock,
+    governed_layer_norm,
+    governed_lambda_gate,
+    governed_measure_energy,
+    governed_rms_norm,
+)
+__all__ = [
+    "UnifiedReceiptChain",
+    "tensor_digest",
+    "GENESIS",
+    "governed_rms_norm",
+    "governed_layer_norm",
+    "governed_lambda_gate",
+    "governed_measure_energy",
+    "GovernedBlock",
+    "list_kernels",
+    "list_series",
+    "get_member",
+    "selfcheck",
+    "DOCTRINE_FOOTER",
+    "PROVENANCE",
+    "__version__",
+]
+__version__ = "0.1.0"
+DOCTRINE_FOOTER = (
+    "SZL Holdings · unified governed-kernel suite · cross-kernel provenance · "
+    "Λ = Conjecture 1 (advisory) · energy MEASURED-only · honesty over checklist"
+)
+# Suite registry: maps a suite-member key to its Hub coordinates + role. In
+# production, get_member() would resolve these via kernels.get_kernel(); the
+# reference package ships byte-faithful numerics so it runs standalone.
+_REGISTRY: Dict[str, Dict[str, str]] = {
+    "governed_norm": {
+        "hub_id": "SZLHOLDINGS/szl-governed-norm",
+        "role": "RMSNorm/LayerNorm + SHA3-256 hash-chained receipts",
+        "honesty": "integrity fingerprint, not a signature",
+    },
+    "lambda_gate": {
+        "hub_id": "SZLHOLDINGS/szl-lambda-gate",
+        "role": "advisory Λ weighted-geometric-mean gate",
+        "honesty": "Λ uniqueness = Conjecture 1 (open); advisory, NOT proven trust",
+    },
+    "energy_core": {
+        "hub_id": "SZLHOLDINGS/governed-inference-meter",
+        "role": "MEASURED-joule energy accounting (real NVML delta)",
+        "honesty": "no GPU/NVML => UNAVAILABLE_NO_NVML, joules None — never fabricated",
+    },
+}
+# Governance-layer series companions (not part of the numeric forward pass).
+# Each is independently published and operates on the SAME UnifiedReceiptChain
+# provenance, extending the suite from "govern provenance ACROSS ops" to
+# "sign that provenance" and "refuse-and-record honestly."
+_SERIES: Dict[str, Dict[str, str]] = {
+    "govsign": {
+        "hub_id": "SZLHOLDINGS/szl-govsign",
+        "role": "signed governance attestation (DSSE / in-toto, ECDSA P-256)",
+        "honesty": "signature proves authorship+integrity, NOT Λ uniqueness; proven_trust locked False; a BLOCKED verdict is signed as BLOCKED",
+    },
+    "blocked": {
+        "hub_id": "SZLHOLDINGS/szl-blocked",
+        "role": "honest-BLOCKED first-class state + EU AI Act Annex IV DRAFT derivation",
+        "honesty": "a BLOCKED op never executes (no fake-green); Annex IV output is a DRAFT skeleton, NOT legal advice",
+    },
+    "provctl": {
+        "hub_id": "SZLHOLDINGS/szl-provctl",
+        "role": "provenance-DAG verify + in-toto v1 / SLSA v1 interop + per-kernel MEASURED energy",
+        "honesty": "in-toto/SLSA field names spec-exact; proven_trust locked False; energy MEASURED-only (never fabricated); honest-BLOCKED DAG nodes surfaced, never dropped",
+    },
+}
+PROVENANCE = {
+    "suite": "szl_kernels",
+    "members": _REGISTRY,
+    "series_companions": _SERIES,
+    "lean_repo": "szl-holdings/lutar-lean",
+    "doi_lutar_lean": "10.5281/zenodo.20434308",
+    "lambda_status": "Conjecture 1 (open) — uniqueness unproven; advisory only",
+    "shared_chain": "UnifiedReceiptChain — op-agnostic SHA3-256 cross-kernel provenance",
+}
+def list_kernels() -> Dict[str, Dict[str, str]]:
+    """Return the suite registry: member key -> {hub_id, role, honesty}."""
+    return {k: dict(v) for k, v in _REGISTRY.items()}
+def list_series() -> Dict[str, Dict[str, str]]:
+    """Return the governance-layer series companions (govsign, blocked, provctl).
+    These extend the numeric suite with signed attestation (govsign),
+    honest-BLOCKED + EU AI Act Annex IV derivation (blocked), and provenance-DAG
+    verification + in-toto/SLSA interop + per-kernel MEASURED energy (provctl).
+    They operate on the same UnifiedReceiptChain but are not part of the numeric
+    forward pass.
+    """
+    return {k: dict(v) for k, v in _SERIES.items()}
+def get_member(key: str) -> Dict[str, str]:
+    """Resolve one suite member's Hub coordinates + honest role string."""
+    if key not in _REGISTRY:
+        raise KeyError(f"unknown suite member {key!r}; have {list(_REGISTRY)}")
+    return dict(_REGISTRY[key])
+def selfcheck() -> Dict[str, Any]:
+    """One-shot CPU-only suite health check; never raises.
+    Proves the suite's CENTRAL claim end-to-end: a single shared chain spans
+    governed_norm + lambda_gate + energy_core in ONE forward pass, verifies as
+    one tamper-evident sequence, AND a deliberately mutated copy fails
+    verification (so the tamper-evidence is real, not decorative).
+    Returns {ok, version, checks:{...}, chain_head, kernels_touched,
+             tamper_detected, error}.
+    """
+    checks: Dict[str, bool] = {}
+    error = None
+    chain_head = GENESIS
+    kernels_touched = []
+    tamper_detected = False
+    try:
+        torch.manual_seed(0)
+        x = torch.randn(4, 64, dtype=torch.float32)
+        w = torch.randn(64, dtype=torch.float32)
+        chain = UnifiedReceiptChain()
+        # norm matches a fp32 RMSNorm reference
+        y = governed_rms_norm(chain, x, weight=w, eps=1e-6)
+        ref = (x * torch.rsqrt(x.pow(2).mean(-1, keepdim=True) + 1e-6)) * w
+        checks["norm_correct"] = bool(torch.allclose(y, ref, rtol=1e-5, atol=1e-5))
+        # advisory Λ gate runs and is recorded as advisory
+        gate = governed_lambda_gate(
+            chain, torch.tensor([0.9, 0.8, 0.95]), threshold=0.5
+        )
+        checks["lambda_advisory"] = bool(gate["advisory"] is True)
+        # energy is MEASURED-only: no NVML here => joules None, honest label
+        e = governed_measure_energy(chain)
+        checks["energy_honest"] = bool(
+            e["joules"] is None and e["label"] == "UNAVAILABLE_NO_NVML"
+        )
+        # the WHOLE multi-op pass verifies as ONE chain
+        ok, depth, brk = chain.verify()
+        checks["cross_kernel_verify"] = bool(ok and depth == 3 and brk == -1)
+        chain_head = chain.head()
+        kernels_touched = chain.kernels_touched()
+        checks["spans_three_kernels"] = bool(
+            kernels_touched == ["governed_norm", "lambda_gate", "energy_core"]
+        )
+        # offline re-verification of the exported chain
+        ok2, _, _ = UnifiedReceiptChain.verify_json(chain.to_json())
+        checks["offline_reverify"] = bool(ok2)
+        # tamper-evidence is REAL: mutate one recorded attr and confirm break
+        blob = chain.to_json()
+        import json as _json
+        recs = _json.loads(blob)
+        recs[0]["attrs"]["eps"] = 9.99e-3  # flip a recorded value
+        ok3, _, brk3 = UnifiedReceiptChain.verify_json(_json.dumps(recs))
+        tamper_detected = bool((not ok3) and brk3 == 0)
+        checks["tamper_detected"] = tamper_detected
+        # GovernedBlock composition runs and self-verifies
+        blk = GovernedBlock()
+        res = blk.forward(x, weight=w, gov_axes=torch.tensor([0.95, 0.9, 0.92]))
+        checks["block_forward"] = bool(
+            res["chain_ok"]
+            and res["chain_depth"] == 4
+            and res["kernels_touched"]
+            == ["governed_norm", "lambda_gate", "energy_core", "governed_block"]
+        )
+    except Exception as exc:  # never raise from a health probe
+        error = f"{type(exc).__name__}: {exc}"
+    ok = bool(checks) and all(checks.values()) and error is None
+    return {
+        "ok": ok,
+        "version": __version__,
+        "checks": checks,
+        "chain_head": chain_head,
+        "kernels_touched": kernels_touched,
+        "tamper_detected": tamper_detected,
+        "error": error,
+    }

build/torch-cpu/szl_kernels/_chain.py ADDED Viewed

	@@ -0,0 +1,265 @@

+# SPDX-License-Identifier: Apache-2.0
+# © 2026 SZL Holdings · Stephen P. Lutar · ORCID 0009-0001-0110-4173
+"""Unified, op-agnostic, SHA3-256 hash-chained provenance for the SZL kernel suite.
+THE FRONTIER GAP THIS CLOSES
+----------------------------
+Every governed SZL kernel today owns its OWN receipt log:
+  * szl_governed_norm  -> ReceiptChain over normalization calls
+  * szl_energy_core    -> CheapestWattLedger over placement decisions
+  * szl_lambda_gate    -> (no chain; advisory self-checks only)
+So a real forward pass that touches norm AND an advisory Λ gate AND the energy
+meter produces THREE disconnected logs. There is no single artifact a third
+party can re-walk to prove "these ops happened, in this order, on these
+tensors, and nothing was inserted or reordered between them". That cross-op
+provenance is the genuine gap the Kernel Hub leaders leave open: they optimize
+FLOPs per op, not auditable provenance ACROSS ops.
+``UnifiedReceiptChain`` is that missing artifact: one append-only,
+SHA3-256 hash-chained log whose entries are op-agnostic. A norm call, an
+advisory Λ-gate call, and an energy reading all hash-chain into the SAME chain,
+in call order, so the whole forward pass verifies as one tamper-evident
+sequence.
+HONESTY (SZL doctrine v11)
+--------------------------
+* The digest is a real SHA3-256 over a canonical JSON body. It is an INTEGRITY
+  fingerprint (tamper-evidence + ordering), NOT a cryptographic signature and
+  NOT a proof of authorship. DSSE / sigstore signing is a separate, out-of-band
+  concern and is explicitly NOT claimed here.
+* Tensor fingerprints round to a fixed decimal precision so they reproduce
+  across devices/dtypes for the same logical values. This is the same scheme
+  szl_governed_norm already ships — we reuse it verbatim so a unified-chain
+  tensor digest equals the per-kernel chain's digest for the same tensor.
+* Any Λ entry is recorded as ADVISORY metadata only. A recorded "passed=True"
+  is a non-compensatory advisory signal, NEVER "proven trust" (Λ uniqueness =
+  Conjecture 1, OPEN).
+* Any energy entry carries the kernel's honest label verbatim (MEASURED /
+  SAMPLE / UNAVAILABLE_NO_NVML / ESTIMATE / UNKNOWN). The chain NEVER upgrades
+  an UNAVAILABLE reading to a number — if joules is None it stays None.
+* Stdlib + torch only (Kernel Hub universal-kernel requirement). Nothing is
+  written to disk or the network from inside the chain.
+"""
+from __future__ import annotations
+import hashlib
+import json
+import threading
+import time
+from typing import Any, Dict, List, Optional
+try:  # torch is optional at import time so the chain stays inspectable headless
+    import torch  # noqa: F401
+    _HAS_TORCH = True
+except Exception:  # pragma: no cover - exercised only in torch-less envs
+    _HAS_TORCH = False
+# Genesis link: 64 hex zeros, identical to szl_governed_norm and szl_energy_core
+# so the unified chain's genesis is byte-compatible with the per-kernel chains.
+GENESIS = "0" * 64
+# Default rounding precision for tensor fingerprints. MUST match
+# szl_governed_norm._receipt._tensor_digest so a unified-chain norm receipt's
+# out_digest is bit-identical to the standalone kernel's.
+_DECIMALS = 6
+def tensor_digest(t: "Any", decimals: int = _DECIMALS) -> str:
+    """Deterministic SHA3-256 over a tensor's rounded float32 contents.
+    Identical scheme to szl_governed_norm._receipt._tensor_digest: round to a
+    fixed number of decimals, integerize, hash the raw little-endian bytes. This
+    makes the digest stable across devices/dtypes for the same logical values
+    (tiny FP noise won't change it). Integrity fingerprint, NOT a signature.
+    Falls back to hashing the repr only if torch is unavailable (headless
+    inspection); in a real kernel run torch is always present.
+    """
+    if _HAS_TORCH and hasattr(t, "detach"):
+        flat = t.detach().to(torch.float32).reshape(-1)
+        scaled = (
+            torch.round(flat * (10 ** decimals)).to(torch.int64).cpu().numpy().tobytes()
+        )
+        return hashlib.sha3_256(scaled).hexdigest()
+    return hashlib.sha3_256(repr(t).encode("utf-8")).hexdigest()
+class UnifiedReceiptChain:
+    """Append-only, SHA3-256 hash-chained log spanning MANY kernel ops.
+    Each receipt body is canonical JSON with a fixed, sorted schema:
+        {seq, kernel, op, attrs, prev}
+    where:
+        seq    -- 0-based position in the chain
+        kernel -- which suite member emitted it ('governed_norm', 'lambda_gate',
+                  'energy_core', or a composed block name)
+        op     -- the operation ('rms_norm', 'lambda_gate', 'measure_energy', ...)
+        attrs  -- an op-agnostic, JSON-able dict of honest, reproducible
+                  attributes (shapes, eps, out_digest, advisory Λ fields,
+                  energy label/joules, ...). NEVER fabricated.
+        prev   -- digest of the previous receipt (GENESIS for seq 0)
+    digest = SHA3-256 over the canonical JSON of {seq,kernel,op,attrs,prev}
+    (ts is excluded so the digest is reproducible offline).
+    verify() re-walks the chain and returns (ok, depth, first_break_seq):
+    it recomputes every digest and checks every prev-link, so ANY insertion,
+    deletion, reordering, or mutation of a recorded attribute is detected.
+    """
+    def __init__(self) -> None:
+        self._lock = threading.RLock()
+        self._records: List[Dict[str, Any]] = []
+    # -- canonical hashing (sorted keys, tight separators, strict no-NaN) --
+    @staticmethod
+    def _digest_body(body: Dict[str, Any]) -> str:
+        raw = json.dumps(
+            body, sort_keys=True, separators=(",", ":"), allow_nan=False
+        ).encode("utf-8")
+        return hashlib.sha3_256(raw).hexdigest()
+    def emit(self, kernel: str, op: str, attrs: Dict[str, Any]) -> Dict[str, Any]:
+        """Append one op-agnostic receipt and return it (with digest + ts).
+        ``attrs`` must be JSON-able and finite (no NaN/Inf) — a non-finite value
+        would make the receipt un-attestable by a strict third-party verifier,
+        so it is rejected at hash time by allow_nan=False. Callers screen
+        non-finite numbers to None/UNKNOWN upstream (the energy kernel already
+        does this).
+        """
+        with self._lock:
+            prev = self._records[-1]["digest"] if self._records else GENESIS
+            seq = len(self._records)
+            body = {
+                "seq": seq,
+                "kernel": str(kernel),
+                "op": str(op),
+                "attrs": attrs,
+                "prev": prev,
+            }
+            digest = self._digest_body(body)
+            rec = dict(body, digest=digest, ts=time.time())
+            self._records.append(rec)
+            return rec
+    # -- convenience emitters that enforce the honesty schema per kernel ----
+    def emit_norm(self, op: str, x: "Any", out: "Any", eps: float) -> Dict[str, Any]:
+        """Record a governed-norm op. out_digest matches szl_governed_norm."""
+        return self.emit(
+            "governed_norm",
+            op,
+            {
+                "in_shape": list(getattr(x, "shape", [])),
+                "in_dtype": str(getattr(x, "dtype", "")).replace("torch.", ""),
+                "eps": float(eps),
+                "out_digest": tensor_digest(out),
+            },
+        )
+    def emit_lambda(
+        self,
+        score: float,
+        threshold: float,
+        passed: bool,
+        k: int,
+    ) -> Dict[str, Any]:
+        """Record an ADVISORY Λ-gate evaluation.
+        ``advisory`` is hard-coded True and ``lambda_status`` is stamped on every
+        entry so the chain itself is self-documenting: a recorded pass is NEVER
+        proven trust (Λ uniqueness = Conjecture 1, open).
+        """
+        return self.emit(
+            "lambda_gate",
+            "lambda_gate",
+            {
+                "score": float(score),
+                "threshold": float(threshold),
+                "passed": bool(passed),
+                "k": int(k),
+                "advisory": True,
+                "lambda_status": "Conjecture 1 (open) — advisory only, NOT proven trust",
+            },
+        )
+    def emit_energy(self, measurement: Dict[str, Any]) -> Dict[str, Any]:
+        """Record an energy reading VERBATIM (label + joules as-given).
+        ``joules`` may be None (UNAVAILABLE/UNKNOWN) — it is recorded as None,
+        never upgraded to a fabricated number. ``label`` is the kernel's honest
+        MEASURED/SAMPLE/UNAVAILABLE_NO_NVML/ESTIMATE/UNKNOWN string.
+        """
+        joules = measurement.get("joules", None)
+        return self.emit(
+            "energy_core",
+            "measure_energy",
+            {
+                "label": str(measurement.get("label", "UNKNOWN")),
+                "joules": (None if joules is None else float(joules)),
+                "source": str(measurement.get("source", "")),
+            },
+        )
+    # -- read surface --------------------------------------------------------
+    def head(self) -> str:
+        with self._lock:
+            return self._records[-1]["digest"] if self._records else GENESIS
+    def count(self) -> int:
+        with self._lock:
+            return len(self._records)
+    def tail(self, n: int = 10) -> List[Dict[str, Any]]:
+        with self._lock:
+            return list(self._records[-n:])
+    def kernels_touched(self) -> List[str]:
+        """Distinct kernels that appear in the chain, in first-seen order.
+        The cross-kernel provenance summary: proof that a single auditable chain
+        actually spanned multiple suite members in one run.
+        """
+        with self._lock:
+            seen: List[str] = []
+            for r in self._records:
+                if r["kernel"] not in seen:
+                    seen.append(r["kernel"])
+            return seen
+    def verify(self):
+        """Re-walk the chain. Returns (ok: bool, depth: int, first_break: int).
+        Recomputes every digest from {seq,kernel,op,attrs,prev} and checks each
+        prev-link. Detects insertion, deletion, reorder, or any attribute
+        mutation. first_break is the seq of the first bad record, or -1 if clean.
+        """
+        with self._lock:
+            prev = GENESIS
+            for i, rec in enumerate(self._records):
+                body = {k: rec[k] for k in ("seq", "kernel", "op", "attrs", "prev")}
+                if rec["prev"] != prev or rec["digest"] != self._digest_body(body):
+                    return (False, len(self._records), i)
+                prev = rec["digest"]
+            return (True, len(self._records), -1)
+    def to_json(self) -> str:
+        """Export the full chain as canonical JSON for OFFLINE re-verification.
+        A third party can load this, recompute each digest, and confirm the
+        chain independently — no trust in the emitting process required.
+        """
+        with self._lock:
+            return json.dumps(self._records, sort_keys=True, separators=(",", ":"))
+    @staticmethod
+    def verify_json(blob: str):
+        """Verify an exported chain offline. Returns (ok, depth, first_break)."""
+        records = json.loads(blob)
+        prev = GENESIS
+        for i, rec in enumerate(records):
+            body = {k: rec[k] for k in ("seq", "kernel", "op", "attrs", "prev")}
+            if rec["prev"] != prev or rec["digest"] != UnifiedReceiptChain._digest_body(body):
+                return (False, len(records), i)
+            prev = rec["digest"]
+        return (True, len(records), -1)

build/torch-cpu/szl_kernels/_ops.py ADDED Viewed

	@@ -0,0 +1,220 @@

+# SPDX-License-Identifier: Apache-2.0
+# © 2026 SZL Holdings · Stephen P. Lutar · ORCID 0009-0001-0110-4173
+"""Governed ops + a composed GovernedBlock, all writing ONE unified chain.
+This module is the thin "suite" layer. It does NOT reimplement the kernels'
+numerics — the canonical math lives in szl_governed_norm / szl_lambda_gate /
+szl_energy_core. Here we provide:
+  * self-contained REFERENCE numerics (rms_norm, layer_norm, Λ aggregate) that
+    are byte-faithful ports of the published kernels, so this reference package
+    RUNS standalone with only torch installed (no Hub fetch needed for the
+    self-test). In production the suite delegates to the installed kernels via
+    get_kernel(); see NEXT_ARTIFACT_SPEC.md "Delegation".
+  * governed wrappers that emit op-agnostic receipts into a shared
+    UnifiedReceiptChain (cross-kernel provenance).
+  * GovernedBlock: a pre-norm transformer sub-block that composes governed-norm
+    + an ADVISORY Λ gate + an energy measurement into ONE auditable forward
+    pass with an end-to-end receipt.
+HONESTY: Λ stays advisory (Conjecture 1, open). Energy stays MEASURED-only
+(None when no NVML — never fabricated). No benchmarks are claimed.
+"""
+from __future__ import annotations
+import time
+from typing import Any, Dict, Optional, Tuple
+import torch
+from ._chain import UnifiedReceiptChain
+# ---------------------------------------------------------------------------
+# Reference numerics — faithful ports of the published kernel math.
+# (rms_norm / layer_norm mirror szl_governed_norm._norm; lambda_aggregate
+#  mirrors szl_lambda_gate._lambda. Kept minimal but numerically identical.)
+# ---------------------------------------------------------------------------
+def _rms_norm(x: torch.Tensor, weight: Optional[torch.Tensor], eps: float) -> torch.Tensor:
+    xf = x.to(torch.float32)
+    out = xf * torch.rsqrt(xf.pow(2).mean(-1, keepdim=True) + eps)
+    if weight is not None:
+        out = out * weight.to(torch.float32)
+    return out.to(x.dtype)
+def _layer_norm(
+    x: torch.Tensor,
+    weight: Optional[torch.Tensor],
+    bias: Optional[torch.Tensor],
+    eps: float,
+) -> torch.Tensor:
+    return torch.nn.functional.layer_norm(
+        x, (x.shape[-1],), weight=weight, bias=bias, eps=eps
+    )
+def _lambda_aggregate(axes: torch.Tensor, weights: Optional[torch.Tensor]) -> torch.Tensor:
+    """Weighted geometric mean Λ(x)=∏ xᵢ^{wᵢ} with non-compensatory zero-routing.
+    Faithful to szl_lambda_gate: any zero or non-finite axis drives Λ to 0.
+    """
+    cdt = torch.float32 if axes.dtype in (torch.float16, torch.bfloat16) else axes.dtype
+    xf = axes.to(cdt)
+    k = xf.shape[-1]
+    if weights is None:
+        w = torch.full((k,), 1.0 / k, dtype=cdt, device=xf.device)
+    else:
+        w = weights.to(cdt)
+        w = w / w.sum()
+    finite = torch.isfinite(xf)
+    xc = xf.clamp(0.0, 1.0)
+    bad = (~finite) | (xc <= 0.0)
+    any_bad = torch.any(bad, dim=-1)
+    safe = torch.where(bad, torch.ones_like(xc), xc)
+    val = torch.exp((torch.log(safe) * w).sum(dim=-1))
+    out = torch.where(any_bad, torch.zeros_like(val), val).clamp(0.0, 1.0)
+    return out.to(axes.dtype)
+# ---------------------------------------------------------------------------
+# Governed wrappers — numerics + a receipt into the SHARED unified chain.
+# ---------------------------------------------------------------------------
+def governed_rms_norm(
+    chain: UnifiedReceiptChain,
+    x: torch.Tensor,
+    weight: Optional[torch.Tensor] = None,
+    eps: float = 1e-6,
+) -> torch.Tensor:
+    out = _rms_norm(x, weight, eps)
+    chain.emit_norm("rms_norm", x, out, eps)
+    return out
+def governed_layer_norm(
+    chain: UnifiedReceiptChain,
+    x: torch.Tensor,
+    weight: Optional[torch.Tensor] = None,
+    bias: Optional[torch.Tensor] = None,
+    eps: float = 1e-5,
+) -> torch.Tensor:
+    out = _layer_norm(x, weight, bias, eps)
+    chain.emit_norm("layer_norm", x, out, eps)
+    return out
+def governed_lambda_gate(
+    chain: UnifiedReceiptChain,
+    axes: torch.Tensor,
+    weights: Optional[torch.Tensor] = None,
+    threshold: float = 0.5,
+) -> Dict[str, Any]:
+    """ADVISORY Λ gate that records an advisory receipt. NOT proven trust.
+    Returns a dict {score, passed, threshold, advisory=True}. ``passed`` is an
+    advisory, non-compensatory signal only (Λ uniqueness = Conjecture 1, open).
+    """
+    score = _lambda_aggregate(axes, weights)
+    s = float(score.reshape(-1)[0]) if score.dim() else float(score)
+    passed = s >= float(threshold)
+    chain.emit_lambda(s, float(threshold), passed, int(axes.shape[-1]))
+    return {"score": s, "passed": passed, "threshold": float(threshold), "advisory": True}
+def governed_measure_energy(
+    chain: UnifiedReceiptChain,
+    measurement: Optional[Dict[str, Any]] = None,
+) -> Dict[str, Any]:
+    """Record an energy reading. MEASURED-only honesty.
+    If ``measurement`` is None we DO NOT fabricate joules: we record the honest
+    UNAVAILABLE_NO_NVML label with joules=None. (In production this delegates to
+    szl_energy_core.measure_energy(), which reads a real NVML cumulative-energy
+    delta when a GPU is present.)
+    """
+    if measurement is None:
+        measurement = {
+            "joules": None,
+            "label": "UNAVAILABLE_NO_NVML",
+            "source": "no GPU/NVML in this reference run — joules NOT fabricated",
+        }
+    chain.emit_energy(measurement)
+    return measurement
+# ---------------------------------------------------------------------------
+# GovernedBlock — the flagship composition (candidate (c)) on the meta-package.
+# ---------------------------------------------------------------------------
+class GovernedBlock:
+    """A pre-norm transformer sub-block with end-to-end cross-kernel provenance.
+    Forward pass, all into ONE shared chain, in order:
+      1. governed RMSNorm of the hidden state            (governed_norm)
+      2. an ADVISORY Λ gate over caller-supplied governance axis scores
+         (lambda_gate) — recorded as advisory, never gating the math
+      3. an energy measurement of the step               (energy_core)
+      4. a final 'block_forward' receipt binding the block's input/output digests
+    The result is a single hash-chained sequence a third party can re-walk to
+    confirm: norm ran, an advisory gate was evaluated, energy was accounted
+    (honestly labeled), and the block output is the one that was produced — with
+    nothing inserted or reordered between steps.
+    HONESTY: the Λ gate is ADVISORY; ``forward`` does NOT block, mask, or alter
+    the numerics based on the gate. The gate result is recorded for audit only.
+    Energy is MEASURED-only. No speed claims.
+    """
+    def __init__(self, chain: Optional[UnifiedReceiptChain] = None) -> None:
+        self.chain = chain if chain is not None else UnifiedReceiptChain()
+    def forward(
+        self,
+        hidden: torch.Tensor,
+        weight: Optional[torch.Tensor] = None,
+        eps: float = 1e-6,
+        gov_axes: Optional[torch.Tensor] = None,
+        gov_weights: Optional[torch.Tensor] = None,
+        threshold: float = 0.5,
+        energy_measurement: Optional[Dict[str, Any]] = None,
+    ) -> Dict[str, Any]:
+        c = self.chain
+        in_digest = __import__("hashlib").sha3_256(
+            __import__("json").dumps(list(hidden.shape)).encode()
+        ).hexdigest()
+        # 1. governed normalization (numerics + receipt)
+        normed = governed_rms_norm(c, hidden, weight=weight, eps=eps)
+        # 2. ADVISORY Λ gate (recorded, does NOT alter numerics)
+        if gov_axes is None:
+            # default: neutral advisory axes; still recorded honestly as advisory
+            gov_axes = torch.tensor([0.9, 0.9, 0.9], dtype=torch.float32)
+        gate = governed_lambda_gate(c, gov_axes, weights=gov_weights, threshold=threshold)
+        # 3. energy measurement (MEASURED-only; None when no NVML)
+        energy = governed_measure_energy(c, energy_measurement)
+        # 4. bind the block I/O into a final receipt
+        from ._chain import tensor_digest
+        c.emit(
+            "governed_block",
+            "block_forward",
+            {
+                "in_shape_digest": in_digest,
+                "out_digest": tensor_digest(normed),
+                "gate_passed_advisory": bool(gate["passed"]),
+                "energy_label": str(energy.get("label", "UNKNOWN")),
+            },
+        )
+        ok, depth, brk = c.verify()
+        return {
+            "output": normed,
+            "gate": gate,                # advisory only
+            "energy": energy,            # MEASURED-only label/joules
+            "chain_head": c.head(),
+            "chain_depth": depth,
+            "chain_ok": ok,
+            "chain_first_break": brk,
+            "kernels_touched": c.kernels_touched(),
+        }