---
tags:
- kernel
- eu-ai-act
- compliance
- annex-iv
- governance
- sklearn
- surrogate
- tabular-classification
- doi:10.5281/zenodo.19944926
library_name: kernels
pipeline_tag: tabular-classification
license: apache-2.0
szl-governance:
verdict: HONEST-BLOCKED
doctrine: "hard DENY dominates; advisory Λ can only tighten, never override; a BLOCKED op never executes — no fake-green"
lambda: "Conjecture 1 (open) — a recorded ALLOW is never proven trust"
energy: MEASURED-only
honest_blocked: "BLOCKED is a first-class governed state; fn is NEVER called on block"
annex_iv: "DRAFT skeleton auto-derived from provenance — NOT legal advice, NOT a conformity guarantee"
---
# szl-blocked — honest-BLOCKED as a first-class governed state
[](https://huggingface.co/kernels/SZLHOLDINGS/szl-blocked)
[](https://a-11-oy.com)
[](https://a-11-oy.com)
[](./LICENSE)
> **🟩 Kernel + REAL trained surrogate.** The governance kernel (pure-Python, stdlib-only) is UNCHANGED and remains the sole ground truth. Since **surrogate v1** this repo also ships `model.joblib` — a real trained sklearn classifier that triages the BLOCK/ALLOW verdict `GovernedGate.decide(...)` would return, with **MEASURED** fidelity **0.9977** (agreement vs the kernel on a held-out split). The surrogate is a fast pre-gate; the kernel's honest-BLOCKED policy chain stays authoritative and `get_kernel`-discoverable. No verdict is ever coerced. **Λ is not touched here and stays Conjecture 1 (open).**
**A refusal-first governed kernel.** When a governed call is denied, the op **never runs**, and the chain records an honest `BLOCKED` receipt rather than a success. Its companion `szl_euaiact` derives an **EU AI Act Annex IV-style draft technical-documentation skeleton** from that provenance — an organizational aid, not compliance evidence, legal advice, or a declaration of conformity.
> **Kernel Hub migration (verified 2026-07-15):** `get_kernel(...)` resolves the first-class [Kernel Hub repo](https://huggingface.co/kernels/SZLHOLDINGS/szl-blocked); `main` and `v1` pin verified revision `a6642f7346be5839049eb9a5e29361da18a12562`. The CPU package passed bounded ALLOW/BLOCK, no-execution-on-block, chain-integrity, tamper, and draft-document tests.
## Quickstart
```bash
pip install kernels # load szl_blocked via get_kernel
pip install huggingface_hub # to fetch the szl_euaiact sibling package
```
```python
from kernels import get_kernel
blk = get_kernel("SZLHOLDINGS/szl-blocked", revision="main", trust_remote_code=True)
chain = blk.UnifiedReceiptChain()
policy = blk.deny_if_action_in({"exfiltrate", "delete_all"})
def do_work(x): return x * 2
ok = blk.governed_call(do_work, policy, chain, request={"action": "summarize"}, args=(21,))
assert ok.blocked is False and ok.output == 42
no = blk.governed_call(do_work, policy, chain, request={"action": "exfiltrate"}, args=(21,))
assert no.blocked is True and no.output is None # honest-BLOCKED, not fake-green
```
`szl_euaiact` is a SIBLING package in this repo; `get_kernel()` loads only `szl_blocked`. Load the Annex IV derivation from a `snapshot_download("SZLHOLDINGS/szl-blocked")` with `build/torch-universal` on `sys.path`.
## Doctrine — guaranteed, and NOT
- ✅ **Hard DENY dominates.** A matched security deny (`deny_if_flag`, `deny_if_action_in`, `deny_by_default`) cannot be overridden by an advisory Λ pass.
- ✅ **Advisory Λ can only tighten, never loosen.** Λ (Conjecture 1, **OPEN**) may add a block but never upgrades a hard deny to allow, nor a recorded ALLOW to "proven trust."
- ✅ **honest-BLOCKED.** On BLOCK the guarded `fn` is **never called**; `BlockedResult.output is None`, `blocked is True`, and a `BLOCK` receipt is written before any op could run.
- ❌ No code path flips BLOCKED → ALLOWED or fabricates a success output.
- **Energy MEASURED-only** — never fabricated.
- **Annex IV output is a DRAFT SKELETON** — explicitly **NOT legal advice** and **NOT a declaration of conformity**; missing human input is emitted as explicit `TODO` markers. Schema `szl-annex-iv-skeleton/0.1.0`; prior art: EU AI Act Annex IV, SPDX 3.0 AI profile / AI BOM.
## API highlights
`governed_call(fn, policy, chain, ...)` · `GovernedGate` · policies `deny_by_default` / `deny_if_flag` / `deny_if_action_in` / `allow_if_capability` · typed outcomes (`BlockedResult` / `AllowedResult` / `GateDecision` / `PolicyResult`) · `UnifiedReceiptChain` (SHA3-256) · verdict constants `ALLOW` / `BLOCK` / `DOMINANT_*`. Companion: `derive_annex_iv(record)` · `to_markdown(doc)`.
## The governed-kernel series
Part of the [`szl-kernels`](https://huggingface.co/SZLHOLDINGS/szl-kernels) suite alongside [`szl-govsign`](https://huggingface.co/SZLHOLDINGS/szl-govsign), [`szl-provctl`](https://huggingface.co/SZLHOLDINGS/szl-provctl), [`szl-lambda-gate`](https://huggingface.co/SZLHOLDINGS/szl-lambda-gate), [`szl-governed-norm`](https://huggingface.co/SZLHOLDINGS/szl-governed-norm), [`governed-inference-meter`](https://huggingface.co/SZLHOLDINGS/governed-inference-meter). Live demo: [`szl-blocked-live`](https://szlholdings-szl-blocked-live.static.hf.space) · substrate [a-11-oy.com](https://a-11-oy.com).
## License
Apache-2.0 · © 2026 SZL Holdings · Stephen P. Lutar · ORCID [0009-0001-0110-4173](https://orcid.org/0009-0001-0110-4173). Concept DOI [10.5281/zenodo.19944926](https://doi.org/10.5281/zenodo.19944926).
## Trained BLOCK/ALLOW surrogate v1 (MEASURED — see `TRAINING_RECEIPT.json`)
A real sklearn `HistGradientBoostingClassifier` trained on **24,000 governed requests**
synthesized and **labeled by this kernel itself** (`GovernedGate.decide`, seed 20260721;
600 samples re-audited by independent full kernel replay during generation — all agreed).
Features are structural observables of the request (capabilities, action, hard flag) plus
the advisory Λ axes — the surrogate never runs the policy chain or signs a receipt.
| metric | value |
|---|---|
| fidelity vs kernel (held-out agreement) | **0.9977** |
| test accuracy (3 classes) | **0.9977** |
| per-class recall | value |
|---|---|
| `ALLOW` | 0.9963 |
| `BLOCK_HARD` (hard security deny dominates) | 1.0000 |
| `BLOCK_ADVISORY` (advisory Λ tightened ALLOW→BLOCK) | 0.9846 |
**Honest blind spot / boundary:** the surrogate predicts the *decision*, never the *receipt*.
It cannot emit the tamper-evident SHA3-256 chain receipt and must never be used to flip a
BLOCK to ALLOW — the deny-by-default kernel policy remains the authority. Class balance is
kernel-driven (`BLOCK_HARD` dominates because deny-by-default is the safe ground state):
counts ALLOW=2713, BLOCK_HARD=18357, BLOCK_ADVISORY=2930.
Λ untouched = Conjecture 1.
```python
import joblib
clf = joblib.load("model.joblib") # feature spec: TRAINING_RECEIPT.json data.features
```
Re-verify everything: `python scripts/eval.py` (sha256-checks the shipped model against the
receipt, regenerates the seeded kernel-labeled dataset, retrains, and compares fidelity within ±0.02).
**Source of record & family.** `get_kernel` resolves the pinned [Kernel Hub repo](https://huggingface.co/kernels/SZLHOLDINGS/szl-blocked) (verified revision `a6642f7346be5839049eb9a5e29361da18a12562`); this kernel has **no separate GitHub repository** — the Kernel Hub repo is the source of record (honest label, nothing hidden). Family: [szl-kernels hub](https://huggingface.co/SZLHOLDINGS/szl-kernels) · [Governed Kernels & Verifiers](https://huggingface.co/collections/SZLHOLDINGS/governed-kernels-and-verifiers-6a542ad83a4b75151bf5eae3) · [github.com/szl-holdings](https://github.com/szl-holdings).
---
SZL Holdings honesty footer. Λ = Conjecture 1 (advisory, never a theorem). locked-proven = exactly 8 {F1,F4,F7,F11,F12,F18,F19,F22}. Honesty labels: MEASURED / REPORTED / MODELED / HEURISTIC / UNKNOWN / UNAVAILABLE. Trust never 100% (ceiling 0.97). honest-BLOCKED is never flipped. a-11-oy.com · huggingface.co/SZLHOLDINGS