Publish fail-closed promotion readiness audit

Records exact repository metadata, artifact inventory, and unresolved blockers.
Lineage, consent, legal authority, deployment, and production readiness remain unverified.

PROMOTION_READINESS_AUDIT.json

@@ -0,0 +1,295 @@
+{
+  "asset_type": "model",
+  "audit_generated_at": "2026-08-31T03:36:31.669541Z",
+  "blockers": [
+    "CONSENT_PRIVACY_REVIEW_UNKNOWN",
+    "DEPLOYMENT_EVIDENCE_UNKNOWN",
+    "EVALUATION_EVIDENCE_UNKNOWN",
+    "LEGAL_OWNERSHIP_AND_RELICENSING_AUTHORITY_UNKNOWN",
+    "PROVENANCE_STATUS_EVIDENCE_PARTIAL",
+    "TRAINING_DATA_IDENTITY_UNKNOWN",
+    "TRAINING_RECIPE_UNKNOWN",
+    "UPSTREAM_SOURCE_REVISION_UNKNOWN"
+  ],
+  "claim_boundary": "This candidate records authenticated repository evidence and blockers only. It does not verify legal ownership, consent, training lineage, deployment, served behavior, persistence, or production readiness.",
+  "destination_absent_at_required_parent": true,
+  "destination_path": "PROMOTION_READINESS_AUDIT.json",
+  "fields": {
+    "artifact_inventory_and_hashes": {
+      "classification": "VERIFIED",
+      "evidence": [
+        {
+          "access": "authenticated_read_only",
+          "repository_head": "10b2de5a88c2ffd102f39be4f52a759d7bcd8a32",
+          "source": "https://huggingface.co/api/models/SZLHOLDINGS/szl-ouroboros/tree/10b2de5a88c2ffd102f39be4f52a759d7bcd8a32?recursive=true&expand=true"
+        }
+      ],
+      "limitations": [
+        "Hashes are provider API metadata; large payload bytes were deliberately not downloaded or independently rehashed."
+      ],
+      "value": {
+        "all_files_have_immutable_hash_metadata": true,
+        "file_count": 17,
+        "files_with_immutable_hash_metadata": 17,
+        "files_with_unknown_size": 0,
+        "known_total_bytes": 93861,
+        "lfs_file_count": 0,
+        "payloads_downloaded": false,
+        "tree_complete": true,
+        "tree_pages": 1
+      }
+    },
+    "card_license_declaration": {
+      "classification": "DECLARED",
+      "evidence": [
+        {
+          "access": "authenticated_read_only",
+          "json_pointer": "/cardData/license",
+          "observed_at": "2026-08-31T03:36:30.794700Z",
+          "repository_head": "10b2de5a88c2ffd102f39be4f52a759d7bcd8a32",
+          "source": "https://huggingface.co/api/models/SZLHOLDINGS/szl-ouroboros?full=true",
+          "value": "apache-2.0"
+        },
+        {
+          "line": 3,
+          "repository_head": "10b2de5a88c2ffd102f39be4f52a759d7bcd8a32",
+          "source": "https://huggingface.co/SZLHOLDINGS/szl-ouroboros/resolve/10b2de5a88c2ffd102f39be4f52a759d7bcd8a32/README.md",
+          "source_sha256": "05a32b84efd4b01caedf7f42d4491db01ab2990b40bc71aed13bdca9776a3654",
+          "value": "apache-2.0"
+        }
+      ],
+      "limitations": [
+        "A repository card declaration does not verify ownership, relicensing authority, or artifact coverage."
+      ],
+      "value": [
+        "apache-2.0",
+        "apache-2.0"
+      ]
+    },
+    "consent_privacy_review": {
+      "classification": "UNKNOWN",
+      "evidence": [],
+      "limitations": [
+        "No explicit consent, privacy, PII, or sensitive-data review evidence was located."
+      ],
+      "value": null
+    },
+    "deployment_evidence": {
+      "classification": "UNKNOWN",
+      "evidence": [],
+      "limitations": [
+        "No exact artifact/deployment/served-revision evidence was located."
+      ],
+      "value": null
+    },
+    "evaluation_evidence": {
+      "classification": "UNKNOWN",
+      "evidence": [],
+      "limitations": [
+        "No structured model evaluation or dataset-quality evidence was located."
+      ],
+      "value": null
+    },
+    "exact_current_head": {
+      "classification": "VERIFIED",
+      "evidence": [
+        {
+          "access": "authenticated_read_only",
+          "json_pointer": "/sha",
+          "observed_at": "2026-08-31T03:36:30.794700Z",
+          "repository_head": "10b2de5a88c2ffd102f39be4f52a759d7bcd8a32",
+          "source": "https://huggingface.co/api/models/SZLHOLDINGS/szl-ouroboros?full=true"
+        },
+        {
+          "access": "authenticated_read_only",
+          "json_pointer": "/sha",
+          "observed_at": "2026-08-31T03:36:31.596247Z",
+          "repository_head": "10b2de5a88c2ffd102f39be4f52a759d7bcd8a32",
+          "source": "https://huggingface.co/api/models/SZLHOLDINGS/szl-ouroboros?full=true"
+        }
+      ],
+      "limitations": [
+        "The binding is exact for the recorded audit window and may change afterward."
+      ],
+      "value": "10b2de5a88c2ffd102f39be4f52a759d7bcd8a32"
+    },
+    "intended_use_and_limitations": {
+      "classification": "DECLARED",
+      "evidence": [
+        {
+          "excerpt": "Wrap agent retries.",
+          "heading": "Intended use",
+          "line": 73,
+          "repository_head": "10b2de5a88c2ffd102f39be4f52a759d7bcd8a32",
+          "source": "https://huggingface.co/SZLHOLDINGS/szl-ouroboros/resolve/10b2de5a88c2ffd102f39be4f52a759d7bcd8a32/README.md",
+          "source_sha256": "05a32b84efd4b01caedf7f42d4491db01ab2990b40bc71aed13bdca9776a3654"
+        },
+        {
+          "excerpt": "- Kernel. Pair with governed-agent-bench. Canonical GitHub: [`szl-holdings/szl-khipu`](https://github.com/szl-holdings/szl-khipu/blob/main/szl_khipu/ouroboros.py) <!-- SZL-ATELIER-CUT:v1:END --> from kernels import get_kernel ou = get_kernel(\"SZLHOLDINGS/szl-ouroboros\", revision=\"main\", trust_remote_code=True) attempts = [ {\"provider\": \"sovereign\", \"model\": \"own-metal\", \"ok\": False, \"latency_ms...",
+          "heading": "Limitations",
+          "line": 77,
+          "repository_head": "10b2de5a88c2ffd102f39be4f52a759d7bcd8a32",
+          "source": "https://huggingface.co/SZLHOLDINGS/szl-ouroboros/resolve/10b2de5a88c2ffd102f39be4f52a759d7bcd8a32/README.md",
+          "source_sha256": "05a32b84efd4b01caedf7f42d4491db01ab2990b40bc71aed13bdca9776a3654"
+        }
+      ],
+      "limitations": [
+        "Repository-authored scope text was not validated against artifact behavior."
+      ],
+      "value": {
+        "intended_use": [
+          {
+            "excerpt": "Wrap agent retries.",
+            "heading": "Intended use",
+            "line": 73,
+            "repository_head": "10b2de5a88c2ffd102f39be4f52a759d7bcd8a32",
+            "source": "https://huggingface.co/SZLHOLDINGS/szl-ouroboros/resolve/10b2de5a88c2ffd102f39be4f52a759d7bcd8a32/README.md",
+            "source_sha256": "05a32b84efd4b01caedf7f42d4491db01ab2990b40bc71aed13bdca9776a3654"
+          }
+        ],
+        "limitations": [
+          {
+            "excerpt": "- Kernel. Pair with governed-agent-bench. Canonical GitHub: [`szl-holdings/szl-khipu`](https://github.com/szl-holdings/szl-khipu/blob/main/szl_khipu/ouroboros.py) <!-- SZL-ATELIER-CUT:v1:END --> from kernels import get_kernel ou = get_kernel(\"SZLHOLDINGS/szl-ouroboros\", revision=\"main\", trust_remote_code=True) attempts = [ {\"provider\": \"sovereign\", \"model\": \"own-metal\", \"ok\": False, \"latency_ms...",
+            "heading": "Limitations",
+            "line": 77,
+            "repository_head": "10b2de5a88c2ffd102f39be4f52a759d7bcd8a32",
+            "source": "https://huggingface.co/SZLHOLDINGS/szl-ouroboros/resolve/10b2de5a88c2ffd102f39be4f52a759d7bcd8a32/README.md",
+            "source_sha256": "05a32b84efd4b01caedf7f42d4491db01ab2990b40bc71aed13bdca9776a3654"
+          }
+        ]
+      }
+    },
+    "legal_ownership_and_relicensing_authority": {
+      "classification": "UNKNOWN",
+      "evidence": [],
+      "limitations": [
+        "A license label or license file does not establish ownership or relicensing authority."
+      ],
+      "value": null
+    },
+    "production_ready_posture": {
+      "classification": "BLOCKED",
+      "evidence": [
+        {
+          "blocking_conditions": [
+            "CONSENT_PRIVACY_REVIEW_UNKNOWN",
+            "DEPLOYMENT_EVIDENCE_UNKNOWN",
+            "EVALUATION_EVIDENCE_UNKNOWN",
+            "LEGAL_OWNERSHIP_AND_RELICENSING_AUTHORITY_UNKNOWN",
+            "PROVENANCE_STATUS_EVIDENCE_PARTIAL",
+            "TRAINING_DATA_IDENTITY_UNKNOWN",
+            "TRAINING_RECIPE_UNKNOWN",
+            "UPSTREAM_SOURCE_REVISION_UNKNOWN"
+          ],
+          "repository_head": "10b2de5a88c2ffd102f39be4f52a759d7bcd8a32",
+          "source": "this_audit"
+        }
+      ],
+      "limitations": [
+        "Repository metadata, card declarations, and HTTP availability cannot establish legal ownership, consent, lineage, deployment, function, or production readiness."
+      ],
+      "value": false
+    },
+    "provenance_status_files": {
+      "classification": "OBSERVED",
+      "evidence": [
+        {
+          "bytes_read": 3114,
+          "classification": "VERIFIED",
+          "content_type": "text/plain; charset=utf-8",
+          "final_url": "https://huggingface.co/api/resolve-cache/models/SZLHOLDINGS/szl-ouroboros/10b2de5a88c2ffd102f39be4f52a759d7bcd8a32/MODEL_PROVENANCE.json?%2FSZLHOLDINGS%2Fszl-ouroboros%2Fresolve%2F10b2de5a88c2ffd102f39be4f52a759d7bcd8a32%2FMODEL_PROVENANCE.json=&etag=%2207c07af9d649b5de38a742a8499ea253ac379990%22",
+          "path": "MODEL_PROVENANCE.json",
+          "repository_head": "10b2de5a88c2ffd102f39be4f52a759d7bcd8a32",
+          "scope": "Bounded small evidence bytes fetched at the exact repository revision.",
+          "sha256": "21d6b40206b36821aa82c493f2f706fe2e2e4206841680194e23f5fc33b43786",
+          "source": "https://huggingface.co/SZLHOLDINGS/szl-ouroboros/resolve/10b2de5a88c2ffd102f39be4f52a759d7bcd8a32/MODEL_PROVENANCE.json"
+        }
+      ],
+      "limitations": [
+        "The exact tree contains only partial or unread provenance/status evidence."
+      ],
+      "value": {
+        "fetched_and_hashed": [
+          "MODEL_PROVENANCE.json"
+        ],
+        "provenance_paths": [
+          "MODEL_PROVENANCE.json"
+        ],
+        "status_paths": []
+      }
+    },
+    "root_license": {
+      "classification": "VERIFIED",
+      "evidence": [
+        {
+          "bytes_read": 776,
+          "classification": "VERIFIED",
+          "content_type": "text/plain; charset=utf-8",
+          "final_url": "https://huggingface.co/api/resolve-cache/models/SZLHOLDINGS/szl-ouroboros/10b2de5a88c2ffd102f39be4f52a759d7bcd8a32/LICENSE?%2FSZLHOLDINGS%2Fszl-ouroboros%2Fresolve%2F10b2de5a88c2ffd102f39be4f52a759d7bcd8a32%2FLICENSE=&etag=%227c317ba373932bf7f56ab969a3698aa3468811be%22",
+          "path": "LICENSE",
+          "repository_head": "10b2de5a88c2ffd102f39be4f52a759d7bcd8a32",
+          "scope": "Bounded small evidence bytes fetched at the exact repository revision.",
+          "sha256": "acf6ce407174b791ceddc263dfc7b1e3ea16579cec3e0caca3d4469e6ccf544b",
+          "source": "https://huggingface.co/SZLHOLDINGS/szl-ouroboros/resolve/10b2de5a88c2ffd102f39be4f52a759d7bcd8a32/LICENSE"
+        }
+      ],
+      "limitations": [
+        "File presence and bytes are verified; legal applicability and chain of title are not."
+      ],
+      "value": [
+        {
+          "bytes": 776,
+          "path": "LICENSE",
+          "sha256": "acf6ce407174b791ceddc263dfc7b1e3ea16579cec3e0caca3d4469e6ccf544b"
+        }
+      ]
+    },
+    "training_data_identity": {
+      "classification": "UNKNOWN",
+      "evidence": [],
+      "limitations": [
+        "No immutable training-data or source-data identity was located."
+      ],
+      "value": null
+    },
+    "training_recipe": {
+      "classification": "UNKNOWN",
+      "evidence": [],
+      "limitations": [
+        "No structured training or dataset-preparation recipe was located."
+      ],
+      "value": null
+    },
+    "upstream_source_revision": {
+      "classification": "UNKNOWN",
+      "evidence": [],
+      "limitations": [
+        "No explicit upstream source plus immutable revision was located."
+      ],
+      "value": null
+    }
+  },
+  "overwrite_allowed": false,
+  "production_ready": false,
+  "production_ready_classification": "BLOCKED",
+  "publication_evidence": {
+    "commit_sha_binding": "REPOSITORY_HISTORY_AND_EXTERNAL_BATCH_RECEIPT",
+    "destination_path": "PROMOTION_READINESS_AUDIT.json",
+    "method": "HUGGING_FACE_ATOMIC_COMMIT",
+    "post_commit_head_and_bytes_verification": "REQUIRED",
+    "production_ready": false,
+    "provider_tree_hashes_are_independent_payload_rehashes": false,
+    "required_parent_sha": "10b2de5a88c2ffd102f39be4f52a759d7bcd8a32",
+    "state": "PUBLISHED_IN_THIS_ATOMIC_COMMIT"
+  },
+  "publication_performed": true,
+  "registry_binding": {
+    "commit": "ea9ac04176ca1e985fbe263dcc097bf679cb4f4a",
+    "json_pointer": "/assets/69",
+    "path": "estate-registry.json",
+    "repository": "SZLHOLDINGS/szl-estate-live"
+  },
+  "repository_id": "SZLHOLDINGS/szl-ouroboros",
+  "required_exact_parent": "10b2de5a88c2ffd102f39be4f52a759d7bcd8a32",
+  "schema": "szl.promoted-artifact-provenance-audit.publication-candidate/v1"
+}