SZL HOLDINGS · EVIDENCE LAYER FOR AGENTIC AI
155 repos · 123 models · 28 live Spaces · hash-chained khipu receipts · a measured law of model honesty · fail-closed launch contracts.
72 provenance-bound, inventoried in a machine-readable alignment manifest
cross-lab census: which open-weight leaders actually abstain when they should
copy-constrained decoding moves the confabulation floor — training alone doesn't
THE PROBLEM
Datadog AI Guard, New Relic, Newton TRUST-ANCHOR: intercept and block. But their logs are just… logs. No one can verify the monitor was honest.
RLHF/constitutions: vibes with no provenance. The Kimi/Anthropic distillation fight shows nobody can prove what a model was trained on.
EU AI Act, Korea's AI Basic Act, US hearings: all demand transparency. Nobody has a machine-verifiable answer.
The gap is not better models. It's evidence: tamper-evident, machine-verifiable, attached to everything.
THE SCIENCE · MEASURED, NOT CLAIMED
| Finding | Evidence |
|---|---|
| The honesty floor (0.8B→14B) is flat across 17× parameters | scale sweep: Qwen3-8B 1/6, 14B 1/6 |
| Training doesn't move it (SFT/DPO/cookie-DPO) | doctrine battery: keyword 4/6 vs strict ~1/6 |
| It's a decoding property — copy-constrained decoding moves it 16× | constrained decoding experiments |
| Failures are mostly semantic illusions, not confabulation (SI ≫ CF) | re-elicitation decomposition |
| Frontier alignment clears it: Claude 5/6, Qwen MoE 35B 5/5 | cross-lab census, published receipts |
THE PRIMITIVE
Every record links to the last. Edits break the chain visibly.
Fleet keys; sign/verify live in the runtime (fail-closed 503).
Every daemon loop and emit is gated on the chain verifying.
GPU energy attestation ledger, CI witnesses, eval receipts, launch admissions.
One primitive, three implementations in production. Unify them and it's a database whose records prove themselves — KhipuDB.
THE GATE
14 models trained through it this quarter. This is the answer to the distillation wars: show your receipts.
THE STACK · WITH NEWTON VENTURES
Intercept → verify → enforce. Signed commands, geofences, safe states, TPM TEE, offline. Strong.
"Tamper-evident log" with no verification mechanism. "Hallucination" as a threat, but bounds-checking can't see in-bounds dishonesty. No model provenance. Binary allow/reject.
Hash-chained P-256 khipu receipts on every decision · immutable model pin · measured abstain score on the agent · graded trust (VERIFIED / UNVERIFIED / AGENT_GENERATED).
Live demo: huggingface.co/spaces/SZLHOLDINGS/newton-trust-upgrade — watch command #5: in-bounds, but a measured hallucination. Bounds alone wave it through. We flag it.
THE ESTATE · ALL LIVE, ALL RECEIPTED
| Surface | Status |
|---|---|
| a-11-oy.com — governed runtime (honest endpoint, khipu sign/verify) | LIVE |
| 28 Hugging Face Spaces (killinchu drone intelligence, constellation, frontier labs) | RUNNING |
| SaladCloud fleet — RA3 training + cross-lab battery census on frontier open weights | RUNNING |
| Hatun-24: 24-hour doctrine+math training run → published candidate with receipts | TRAINING NOW |
| Receipted quantum chemistry (DeepQMC on NVIDIA, energy-attested ledger) | VERIFIED |
| x402 monetization (Cloudflare closed beta) — API/MCP/dataset pay-per-use | WIRING |
THE MARKET
THE ASK
The hardest parts are built and running: khipu signing, the launch contract, the measured law, the live estate, the Newton upgrade demo.
KhipuDB (self-proving records), safeagents guard plugin (receipted runtime guard), x402 settlement live, wet-lab co-authorships out after the new year.
Newton has runtime enforcement + federal/UAS channels. SZL has the evidence layer + the science. Together: the complete, provable trust stack — first to market with receipts.
Zenodo: zenodo.org/records/20490218 · Ouroboros Thesis v21 (PURIQ-OS)