Publish fail-closed promotion readiness audit

Records exact repository metadata, artifact inventory, and unresolved blockers.
Lineage, consent, legal authority, deployment, and production readiness remain unverified.

PROMOTION_READINESS_AUDIT.json

@@ -0,0 +1,279 @@
+{
+  "asset_type": "model",
+  "audit_generated_at": "2026-08-31T03:36:31.364823Z",
+  "blockers": [
+    "CONSENT_PRIVACY_REVIEW_UNKNOWN",
+    "DEPLOYMENT_EVIDENCE_UNKNOWN",
+    "EVALUATION_EVIDENCE_UNKNOWN",
+    "LEGAL_OWNERSHIP_AND_RELICENSING_AUTHORITY_UNKNOWN",
+    "PROVENANCE_STATUS_EVIDENCE_MISSING",
+    "TRAINING_DATA_IDENTITY_UNKNOWN",
+    "TRAINING_RECIPE_UNKNOWN",
+    "UPSTREAM_SOURCE_REVISION_UNKNOWN"
+  ],
+  "claim_boundary": "This candidate records authenticated repository evidence and blockers only. It does not verify legal ownership, consent, training lineage, deployment, served behavior, persistence, or production readiness.",
+  "destination_absent_at_required_parent": true,
+  "destination_path": "PROMOTION_READINESS_AUDIT.json",
+  "fields": {
+    "artifact_inventory_and_hashes": {
+      "classification": "VERIFIED",
+      "evidence": [
+        {
+          "access": "authenticated_read_only",
+          "repository_head": "d0cb7368c032735c5b79aaa5105166ca926c38ff",
+          "source": "https://huggingface.co/api/models/SZLHOLDINGS/szl-nemo/tree/d0cb7368c032735c5b79aaa5105166ca926c38ff?recursive=true&expand=true"
+        }
+      ],
+      "limitations": [
+        "Hashes are provider API metadata; large payload bytes were deliberately not downloaded or independently rehashed."
+      ],
+      "value": {
+        "all_files_have_immutable_hash_metadata": true,
+        "file_count": 13,
+        "files_with_immutable_hash_metadata": 13,
+        "files_with_unknown_size": 0,
+        "known_total_bytes": 60051,
+        "lfs_file_count": 0,
+        "payloads_downloaded": false,
+        "tree_complete": true,
+        "tree_pages": 1
+      }
+    },
+    "card_license_declaration": {
+      "classification": "DECLARED",
+      "evidence": [
+        {
+          "access": "authenticated_read_only",
+          "json_pointer": "/cardData/license",
+          "observed_at": "2026-08-31T03:36:30.705550Z",
+          "repository_head": "d0cb7368c032735c5b79aaa5105166ca926c38ff",
+          "source": "https://huggingface.co/api/models/SZLHOLDINGS/szl-nemo?full=true",
+          "value": "apache-2.0"
+        },
+        {
+          "line": 2,
+          "repository_head": "d0cb7368c032735c5b79aaa5105166ca926c38ff",
+          "source": "https://huggingface.co/SZLHOLDINGS/szl-nemo/resolve/d0cb7368c032735c5b79aaa5105166ca926c38ff/README.md",
+          "source_sha256": "84676662176468fbab3eeaefbe9a4b91fadae74f3d41f0cdc6df95d3715d8f6a",
+          "value": "apache-2.0"
+        }
+      ],
+      "limitations": [
+        "A repository card declaration does not verify ownership, relicensing authority, or artifact coverage."
+      ],
+      "value": [
+        "apache-2.0",
+        "apache-2.0"
+      ]
+    },
+    "consent_privacy_review": {
+      "classification": "UNKNOWN",
+      "evidence": [],
+      "limitations": [
+        "No explicit consent, privacy, PII, or sensitive-data review evidence was located."
+      ],
+      "value": null
+    },
+    "deployment_evidence": {
+      "classification": "UNKNOWN",
+      "evidence": [],
+      "limitations": [
+        "No exact artifact/deployment/served-revision evidence was located."
+      ],
+      "value": null
+    },
+    "evaluation_evidence": {
+      "classification": "UNKNOWN",
+      "evidence": [],
+      "limitations": [
+        "No structured model evaluation or dataset-quality evidence was located."
+      ],
+      "value": null
+    },
+    "exact_current_head": {
+      "classification": "VERIFIED",
+      "evidence": [
+        {
+          "access": "authenticated_read_only",
+          "json_pointer": "/sha",
+          "observed_at": "2026-08-31T03:36:30.705550Z",
+          "repository_head": "d0cb7368c032735c5b79aaa5105166ca926c38ff",
+          "source": "https://huggingface.co/api/models/SZLHOLDINGS/szl-nemo?full=true"
+        },
+        {
+          "access": "authenticated_read_only",
+          "json_pointer": "/sha",
+          "observed_at": "2026-08-31T03:36:31.292430Z",
+          "repository_head": "d0cb7368c032735c5b79aaa5105166ca926c38ff",
+          "source": "https://huggingface.co/api/models/SZLHOLDINGS/szl-nemo?full=true"
+        }
+      ],
+      "limitations": [
+        "The binding is exact for the recorded audit window and may change afterward."
+      ],
+      "value": "d0cb7368c032735c5b79aaa5105166ca926c38ff"
+    },
+    "intended_use_and_limitations": {
+      "classification": "DECLARED",
+      "evidence": [
+        {
+          "excerpt": "CI doctrine triage. Retrain from forge.py.",
+          "heading": "Intended use",
+          "line": 78,
+          "repository_head": "d0cb7368c032735c5b79aaa5105166ca926c38ff",
+          "source": "https://huggingface.co/SZLHOLDINGS/szl-nemo/resolve/d0cb7368c032735c5b79aaa5105166ca926c38ff/README.md",
+          "source_sha256": "84676662176468fbab3eeaefbe9a4b91fadae74f3d41f0cdc6df95d3715d8f6a"
+        },
+        {
+          "excerpt": "- model.joblib not on Hub at snapshot. - Not Nemotron. Not generative. Canonical GitHub: [`szl-holdings/szl-nemo`](https://github.com/szl-holdings/szl-nemo/blob/main/README.md) <!-- SZL-ATELIER-CUT:v1:END --> - **NOT:** NVIDIA Nemotron 3 Nano 4B. Not ollama-ready Nemotron weights. Not a chatbot. Not a fine-tune. `BASE_MODEL_MANIFEST.json` is an observation of an upstream Ollama tag (mutable); i...",
+          "heading": "Limitations",
+          "line": 82,
+          "repository_head": "d0cb7368c032735c5b79aaa5105166ca926c38ff",
+          "source": "https://huggingface.co/SZLHOLDINGS/szl-nemo/resolve/d0cb7368c032735c5b79aaa5105166ca926c38ff/README.md",
+          "source_sha256": "84676662176468fbab3eeaefbe9a4b91fadae74f3d41f0cdc6df95d3715d8f6a"
+        }
+      ],
+      "limitations": [
+        "Repository-authored scope text was not validated against artifact behavior."
+      ],
+      "value": {
+        "intended_use": [
+          {
+            "excerpt": "CI doctrine triage. Retrain from forge.py.",
+            "heading": "Intended use",
+            "line": 78,
+            "repository_head": "d0cb7368c032735c5b79aaa5105166ca926c38ff",
+            "source": "https://huggingface.co/SZLHOLDINGS/szl-nemo/resolve/d0cb7368c032735c5b79aaa5105166ca926c38ff/README.md",
+            "source_sha256": "84676662176468fbab3eeaefbe9a4b91fadae74f3d41f0cdc6df95d3715d8f6a"
+          }
+        ],
+        "limitations": [
+          {
+            "excerpt": "- model.joblib not on Hub at snapshot. - Not Nemotron. Not generative. Canonical GitHub: [`szl-holdings/szl-nemo`](https://github.com/szl-holdings/szl-nemo/blob/main/README.md) <!-- SZL-ATELIER-CUT:v1:END --> - **NOT:** NVIDIA Nemotron 3 Nano 4B. Not ollama-ready Nemotron weights. Not a chatbot. Not a fine-tune. `BASE_MODEL_MANIFEST.json` is an observation of an upstream Ollama tag (mutable); i...",
+            "heading": "Limitations",
+            "line": 82,
+            "repository_head": "d0cb7368c032735c5b79aaa5105166ca926c38ff",
+            "source": "https://huggingface.co/SZLHOLDINGS/szl-nemo/resolve/d0cb7368c032735c5b79aaa5105166ca926c38ff/README.md",
+            "source_sha256": "84676662176468fbab3eeaefbe9a4b91fadae74f3d41f0cdc6df95d3715d8f6a"
+          }
+        ]
+      }
+    },
+    "legal_ownership_and_relicensing_authority": {
+      "classification": "UNKNOWN",
+      "evidence": [],
+      "limitations": [
+        "A license label or license file does not establish ownership or relicensing authority."
+      ],
+      "value": null
+    },
+    "production_ready_posture": {
+      "classification": "BLOCKED",
+      "evidence": [
+        {
+          "blocking_conditions": [
+            "CONSENT_PRIVACY_REVIEW_UNKNOWN",
+            "DEPLOYMENT_EVIDENCE_UNKNOWN",
+            "EVALUATION_EVIDENCE_UNKNOWN",
+            "LEGAL_OWNERSHIP_AND_RELICENSING_AUTHORITY_UNKNOWN",
+            "PROVENANCE_STATUS_EVIDENCE_MISSING",
+            "TRAINING_DATA_IDENTITY_UNKNOWN",
+            "TRAINING_RECIPE_UNKNOWN",
+            "UPSTREAM_SOURCE_REVISION_UNKNOWN"
+          ],
+          "repository_head": "d0cb7368c032735c5b79aaa5105166ca926c38ff",
+          "source": "this_audit"
+        }
+      ],
+      "limitations": [
+        "Repository metadata, card declarations, and HTTP availability cannot establish legal ownership, consent, lineage, deployment, function, or production readiness."
+      ],
+      "value": false
+    },
+    "provenance_status_files": {
+      "classification": "BLOCKED",
+      "evidence": [],
+      "limitations": [
+        "No explicit provenance or promotion-status document was found."
+      ],
+      "value": {
+        "fetched_and_hashed": [],
+        "provenance_paths": [],
+        "status_paths": []
+      }
+    },
+    "root_license": {
+      "classification": "VERIFIED",
+      "evidence": [
+        {
+          "bytes_read": 11358,
+          "classification": "VERIFIED",
+          "content_type": "text/plain; charset=utf-8",
+          "final_url": "https://huggingface.co/api/resolve-cache/models/SZLHOLDINGS/szl-nemo/d0cb7368c032735c5b79aaa5105166ca926c38ff/LICENSE?%2FSZLHOLDINGS%2Fszl-nemo%2Fresolve%2Fd0cb7368c032735c5b79aaa5105166ca926c38ff%2FLICENSE=&etag=%22d645695673349e3947e8e5ae42332d0ac3164cd7%22",
+          "path": "LICENSE",
+          "repository_head": "d0cb7368c032735c5b79aaa5105166ca926c38ff",
+          "scope": "Bounded small evidence bytes fetched at the exact repository revision.",
+          "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+          "source": "https://huggingface.co/SZLHOLDINGS/szl-nemo/resolve/d0cb7368c032735c5b79aaa5105166ca926c38ff/LICENSE"
+        }
+      ],
+      "limitations": [
+        "File presence and bytes are verified; legal applicability and chain of title are not."
+      ],
+      "value": [
+        {
+          "bytes": 11358,
+          "path": "LICENSE",
+          "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30"
+        }
+      ]
+    },
+    "training_data_identity": {
+      "classification": "UNKNOWN",
+      "evidence": [],
+      "limitations": [
+        "No immutable training-data or source-data identity was located."
+      ],
+      "value": null
+    },
+    "training_recipe": {
+      "classification": "UNKNOWN",
+      "evidence": [],
+      "limitations": [
+        "No structured training or dataset-preparation recipe was located."
+      ],
+      "value": null
+    },
+    "upstream_source_revision": {
+      "classification": "UNKNOWN",
+      "evidence": [],
+      "limitations": [
+        "No explicit upstream source plus immutable revision was located."
+      ],
+      "value": null
+    }
+  },
+  "overwrite_allowed": false,
+  "production_ready": false,
+  "production_ready_classification": "BLOCKED",
+  "publication_evidence": {
+    "commit_sha_binding": "REPOSITORY_HISTORY_AND_EXTERNAL_BATCH_RECEIPT",
+    "destination_path": "PROMOTION_READINESS_AUDIT.json",
+    "method": "HUGGING_FACE_ATOMIC_COMMIT",
+    "post_commit_head_and_bytes_verification": "REQUIRED",
+    "production_ready": false,
+    "provider_tree_hashes_are_independent_payload_rehashes": false,
+    "required_parent_sha": "d0cb7368c032735c5b79aaa5105166ca926c38ff",
+    "state": "PUBLISHED_IN_THIS_ATOMIC_COMMIT"
+  },
+  "publication_performed": true,
+  "registry_binding": {
+    "commit": "ea9ac04176ca1e985fbe263dcc097bf679cb4f4a",
+    "json_pointer": "/assets/68",
+    "path": "estate-registry.json",
+    "repository": "SZLHOLDINGS/szl-estate-live"
+  },
+  "repository_id": "SZLHOLDINGS/szl-nemo",
+  "required_exact_parent": "d0cb7368c032735c5b79aaa5105166ca926c38ff",
+  "schema": "szl.promoted-artifact-provenance-audit.publication-candidate/v1"
+}