szl-blocked — honest-BLOCKED as a first-class governed state

🟩 Kernel + REAL trained surrogate. The governance kernel (pure-Python, stdlib-only) is UNCHANGED and remains the sole ground truth. Since surrogate v1 this repo also ships model.joblib — a real trained sklearn classifier that triages the BLOCK/ALLOW verdict GovernedGate.decide(...) would return, with MEASURED fidelity 0.9977 (agreement vs the kernel on a held-out split). The surrogate is a fast pre-gate; the kernel's honest-BLOCKED policy chain stays authoritative and get_kernel-discoverable. No verdict is ever coerced. Λ is not touched here and stays Conjecture 1 (open).

A refusal-first governed kernel. When a governed call is denied, the op never runs, and the chain records an honest BLOCKED receipt rather than a success. Its companion szl_euaiact derives an EU AI Act Annex IV-style draft technical-documentation skeleton from that provenance — an organizational aid, not compliance evidence, legal advice, or a declaration of conformity.

Kernel Hub migration (verified 2026-07-15): get_kernel(...) resolves the first-class Kernel Hub repo; main and v1 pin verified revision a6642f7346be5839049eb9a5e29361da18a12562. The CPU package passed bounded ALLOW/BLOCK, no-execution-on-block, chain-integrity, tamper, and draft-document tests.

Quickstart

pip install kernels          # load szl_blocked via get_kernel
pip install huggingface_hub  # to fetch the szl_euaiact sibling package

from kernels import get_kernel
blk = get_kernel("SZLHOLDINGS/szl-blocked", revision="main", trust_remote_code=True)

chain = blk.UnifiedReceiptChain()
policy = blk.deny_if_action_in({"exfiltrate", "delete_all"})
def do_work(x): return x * 2

ok = blk.governed_call(do_work, policy, chain, request={"action": "summarize"}, args=(21,))
assert ok.blocked is False and ok.output == 42

no = blk.governed_call(do_work, policy, chain, request={"action": "exfiltrate"}, args=(21,))
assert no.blocked is True and no.output is None    # honest-BLOCKED, not fake-green

szl_euaiact is a SIBLING package in this repo; get_kernel() loads only szl_blocked. Load the Annex IV derivation from a snapshot_download("SZLHOLDINGS/szl-blocked") with build/torch-universal on sys.path.

Doctrine — guaranteed, and NOT

✅ Hard DENY dominates. A matched security deny (deny_if_flag, deny_if_action_in, deny_by_default) cannot be overridden by an advisory Λ pass.
✅ Advisory Λ can only tighten, never loosen. Λ (Conjecture 1, OPEN) may add a block but never upgrades a hard deny to allow, nor a recorded ALLOW to "proven trust."
✅ honest-BLOCKED. On BLOCK the guarded fn is never called; BlockedResult.output is None, blocked is True, and a BLOCK receipt is written before any op could run.
❌ No code path flips BLOCKED → ALLOWED or fabricates a success output.
Energy MEASURED-only — never fabricated.
Annex IV output is a DRAFT SKELETON — explicitly NOT legal advice and NOT a declaration of conformity; missing human input is emitted as explicit TODO markers. Schema szl-annex-iv-skeleton/0.1.0; prior art: EU AI Act Annex IV, SPDX 3.0 AI profile / AI BOM.

API highlights

governed_call(fn, policy, chain, ...) · GovernedGate · policies deny_by_default / deny_if_flag / deny_if_action_in / allow_if_capability · typed outcomes (BlockedResult / AllowedResult / GateDecision / PolicyResult) · UnifiedReceiptChain (SHA3-256) · verdict constants ALLOW / BLOCK / DOMINANT_*. Companion: derive_annex_iv(record) · to_markdown(doc).

The governed-kernel series

Part of the szl-kernels suite alongside szl-govsign, szl-provctl, szl-lambda-gate, szl-governed-norm, governed-inference-meter. Live demo: szl-blocked-live · substrate a-11-oy.com.

License

Trained BLOCK/ALLOW surrogate v1 (MEASURED — see `TRAINING_RECEIPT.json`)

A real sklearn HistGradientBoostingClassifier trained on 24,000 governed requests synthesized and labeled by this kernel itself (GovernedGate.decide, seed 20260721; 600 samples re-audited by independent full kernel replay during generation — all agreed). Features are structural observables of the request (capabilities, action, hard flag) plus the advisory Λ axes — the surrogate never runs the policy chain or signs a receipt.

metric	value
fidelity vs kernel (held-out agreement)	0.9977
test accuracy (3 classes)	0.9977

per-class recall	value
`ALLOW`	0.9963
`BLOCK_HARD` (hard security deny dominates)	1.0000
`BLOCK_ADVISORY` (advisory Λ tightened ALLOW→BLOCK)	0.9846

Honest blind spot / boundary: the surrogate predicts the decision, never the receipt. It cannot emit the tamper-evident SHA3-256 chain receipt and must never be used to flip a BLOCK to ALLOW — the deny-by-default kernel policy remains the authority. Class balance is kernel-driven (BLOCK_HARD dominates because deny-by-default is the safe ground state): counts ALLOW=2713, BLOCK_HARD=18357, BLOCK_ADVISORY=2930. Λ untouched = Conjecture 1.

import joblib
clf = joblib.load("model.joblib")   # feature spec: TRAINING_RECEIPT.json data.features

Re-verify everything: python scripts/eval.py (sha256-checks the shipped model against the receipt, regenerates the seeded kernel-labeled dataset, retrains, and compares fidelity within ±0.02).

Source of record & family. get_kernel resolves the pinned Kernel Hub repo (verified revision a6642f7346be5839049eb9a5e29361da18a12562); this kernel has no separate GitHub repository — the Kernel Hub repo is the source of record (honest label, nothing hidden). Family: szl-kernels hub · Governed Kernels & Verifiers · github.com/szl-holdings.

_{SZL Holdings honesty footer. Λ = Conjecture 1 (advisory, never a theorem). locked-proven = exactly 8 {F1,F4,F7,F11,F12,F18,F19,F22}. Honesty labels: MEASURED / REPORTED / MODELED / HEURISTIC / UNKNOWN / UNAVAILABLE. Trust never 100% (ceiling 0.97). honest-BLOCKED is never flipped. a-11-oy.com · huggingface.co/SZLHOLDINGS}