Nucleus Seal

Verify it, don't trust it

Stage 07 of the Nucleus pipeline — the model's immutable DNA, minted only after the three-gate audit passes; refusal is the default, and there is no code path that produces a seal for a failing candidate. The full design takes four SHA-256 component hashes — the teacher model's weights, the training corpus, the pipeline configuration, and the trained artifacts — binds them into a single chain hash, attaches the complete gate and regression results, and signs the canonical payload with a persistent Ed25519 key into a self-contained certificate anyone can verify offline with the embedded public key: cryptographic proof of how the model was made, monitorable after release and revocable if it ever fails new adversarial tests. Today's built seal is the engine-side hash-join binding model ↔ corpus_sha256 ↔ terms.json — a pure, deterministic, refusal-default verifier that re-hashes the compiled World's bytes exactly as read from disk and writes nothing unless every check holds; we aim to chain-sign the full design with Ed25519 at the first real bake. Sealing is a fork point, not a terminus: the sealed v1.0 ships immutably to its owner while the pedagogical loop keeps cycling toward v1.N — two seals, one chain.

The chain begins with one fingerprint. The compiled dictionary, terms.json, is hashed byte-for-byte into corpus_sha256 — and that one value is pinned through every link that follows: the training-corpus manifest, the hand-off envelope sent to the trainer, and the descriptor the trainer hands back. The seal is the moment of proof: it re-hashes the file straight from disk and demands that the whole chain agree.

Because every link is a plain hash over a portable file, the audit needs nothing exotic: the entire chain verifies on a laptop, with zero GPUs and zero model weights present.

Built today — the hash-join

● available now — the corpus-hash seal: deterministic, refusal-default, tested

The built engine-side seal: a pure sha256 hash-join that refuses to bind a model to a corpus it cannot prove the model was trained on.

On success the seal writes a record whose identity is itself deterministic: seal_id = sha256(world | corpus_sha256 | model.name | artifact_ref) — no timestamp inside the hash, so the same inputs always yield the same seal, and any drift between a re-derived seal and the one on disk is detected mechanically.

The fixture label is the story: the chain runs end-to-end today, with every hash real and every check live — and the descriptor says so, honestly, because the training run is the next bet.

Refusal is the default

If any link disagrees, the seal writes nothing and tells you which check failed. The repository keeps a deliberately tampered fixture — a BakeResult claiming a corpus hash of all zeros — so the refusal path is provable, not theoretical:

The seal it grows into

Roadmap: the Ed25519-signed Nucleus Seal with live revocation

The hash-join is the built rail; the signed seal is what it carries. The full design takes four SHA-256 component hashes — the teacher model's weights, the training corpus, the pipeline configuration, and the trained artifacts — and binds them into a single chain hash, attaches the complete gate and regression results, and signs the canonical payload with a persistent Ed25519 key. The result is a self-contained certificate anyone can verify offline with the embedded public key, and re-check with --recompute to detect any drift in the artifacts since minting.

A signed seal stays alive after release: monitorable against new adversarial tests, and instantly revocable if the model ever fails one. And sealing is a fork point, not a terminus — the sealed v1.0 ships immutably to its owner, yours forever, while the pedagogical loop keeps cycling toward v1.N, with a regression gate every new version must clear.

The minter and verifier run in the Nucleus lab today; we aim to mint the first signed seal for a DaC World with the first real bake.

Accountable to its sources

A seal binds more than hashes. The seal record carries the World's full source closure — the exact, sorted list of every source cited across the training corpus — so the sealed model is accountable to a named bibliography, not a vague provenance claim. The provenance gate enforces the same law upstream: every term in the compiled World carries a source, and the corpus cannot be pinned until the gate passes. What the model may speak from is written into the seal itself.

And the dogfood closes the loop: this page is rendered from a compiled DaC World — the provenance footer below shows the corpus hash of the very artifact it was built from.

The vocabulary

For agents