SZL Holdings · verifiable estate

Every claim carries a receipt.

Run the verifier — don't trust the dashboard. Control before action. Evidence after. UNKNOWN is never PASS.

Open the proof explorer Command Center
a-11-oy.com — command center a11oy.net — proof origin
computing counters from committed artifacts…
Rule 01Bytes, not namesEvery digest covers artifact bytes. A name is a claim; bytes are ground truth.
Rule 02Honest namesUnsigned artifacts are named .unsigned.json. An empty signatures array is not a signature.
Rule 03UNKNOWN is never PASSThe verdict vocabulary is closed. Absence of evidence stays visible, never promoted.
The gateForbidden domainOne release-blocking regex keeps the lookalike store domain out of the estate. Shown below.

Proof explorer

Seven artifacts. Every digest computed in front of you.

Each entry below was fetched as raw bytes from data/ and hashed in this page with the Web Crypto API. Recompute any of it independently with the snippet on each card — the tooling is in this repository.

fetching artifacts…

Estate audit

Inventory is computed, not asserted.

The estate refuses to print a repo count it cannot corroborate. Two independent enumeration sources ran; they did not agree — so the published status is PARTIAL, with both sources on the record.

Two-source enumeration PARTIAL

reading data/enumeration.json…

The 101st repo appeared mid-audit — and the tooling caught it

  1. Enumeration ran: source A listed … repos

    The matrix below was cut from that point-in-time inventory: … rows, one audit record per repo.

  2. szl-v14 landed while the audit was in flight

    The org gained a repository between enumeration and publication. This page finds it by set difference between data/enumeration.json and data/repo_matrix.json — the same way the audit tooling did.

  3. Published as drift, not silently re-counted

    Inventory drift is normal. Asserting counts is the sin. The matrix documents … repos; the delta is named, not absorbed.

Per-repo audit matrix

Searchable, sortable, lazy-rendered. Cells reading UNKNOWN are honest readings from an offline audit, not missing styling.

loading data/repo_matrix.json…

KIDS v0.1 · KHIPU-X1

A golden simulator with a receipt habit.

Four frozen ISA primitives, exercised by conformance vectors whose digests are on file. The simulator pins semantics before any RTL exists — differential targets come later and must match this, never the reverse.

Λ

LGATE

Single-cycle policy gate. Privileged opcodes cannot retire without an in-band authorization that hashes to the loaded policy digest.

OP 0x09 · LGATE_CHECK

✳

SHA3-256 receipt engine

Receipt engine with domain separation SZL-KIDS-RECEIPT-V1, so a receipt from this ISA can never collide with any other signing context.

OP 0x0C · RECEIPT_EMIT

▣

RC1 hard-partition mailbox

Compartment mailbox with hard partitions: cross-compartment sends and receives are protocol events, not memory writes.

OP 0x0A/0x0B · RC1_SEND / RC1_RECV

⌗

KV per-block Merkle commitment

Every cache append is committed into a per-block Merkle root, so later reads prove they saw the state the receipts attested.

OP 0x07/0x08 · KV_APPEND / KV_COMMIT

loading data/kids_conformance.json…

Standards work

The receipt format has a name, and it's a draft.

IETF-STYLE §

draft-lutar-governed-action-receipt-00

The Governed Action Receipt: actor, action, policy-by-digest, subject-by-digest, content-addressed identity. Built from source with the scripts in this repo.

../docs/standards/draft-lutar-governed-action-receipt-00.txt →
REPRODUCE ⌁

Appendix B, reproducible

The draft ships a worked example whose key and digests regenerate byte-identically from reproduce-appendix-b.py.

../docs/standards/reproduce-appendix-b.py →
DRAFT-00 ◌

A 00, on purpose

It is named 00 because it has not survived outside review yet. Claiming readiness would be the same sin as claiming a count.

../docs/standards/build_draft.py →

Context, stated once and plainly: receipted actions sit next to — not above — OWASP ASI, CSA MAESTRO, and the IETF process (SCITT and agent-audit-trail are the closest neighbors). Those frameworks model threats and posture; a receipt records what actually happened, over exactly which bytes, so any party can re-check it offline. draft-lutar-governed-action-receipt-00 is an un-submitted draft-00: the estate does not claim endorsement, adoption, or standing in any of those bodies.

Doctrine

Three rules, enforced by tooling, not taste.

These are not values statements. Each rule below is a check that runs against this estate — the same checks that produced the artifacts on this page.

1

Bytes, not names

Receipts digest artifact bytes. Rename a file and its receipt still verifies; flip one byte and verification names the exact mismatch.

2

Honest names

An unsigned artifact carries .unsigned.json in its name, and the library refuses to let a signed name hold an unsigned body — or vice versa.

3

UNKNOWN is never PASS

The outcome vocabulary is closed, is_passing(UNKNOWN) is false, and the promotion gate refuses what it cannot characterize.

The forbidden-domain rule — verbatim from the release gate

FORBIDDEN_PATTERN = r"(?<!-)a11oy\.com"
# alignment/src/szl_alignment/const.py
# Release-blocking CRITICAL. (?<!-) keeps the
# canonical product surface a-11-oy.com from
# ever matching, while still catching the bare
# lookalike. The pattern is shown escaped, so
# this page itself passes the gate it documents.
ALLOWLIST_PATTERN = (
  r"never|forbidden|not in|assertNotIn"
  r"|does not appear|is not a surface|blocklist"
)
# A hit is allowed ONLY in a prohibition/guard
# context on the same line: doctrine notes,
# blocklists, guard assertions.
# CI — alignment/templates/workflows/forbidden-domain.yml
hits="$(rg -n --no-heading --hidden -P "$FORBIDDEN_PATTERN" \
  --glob '!.git' . || true)"
violations="$(printf '%s' "$hits" | rg -v -i \
  'never|forbidden|not in|assertNotIn|does not appear|is not a surface|blocklist' || true)"
[ -z "$violations" ] || exit 1   # release-blocking
# This site passes the same gate: grepping its own
# tree for the forbidden pattern returns zero hits.

Honest unsigned naming — from the library itself

# Attack 15/16 in the public harness prove the rule:
#   naming-rename-unsigned      — a signed envelope renamed *.unsigned.json raises NamingError
#   naming-strip-signatures     — an empty signatures array under a signed name is rejected:
#                                 "an empty signatures array is not a signature"
# See data/adversarial/ATTACK_REPORT.md — and the .unsigned.json this run produced.