servseal 0.1.0__tar.gz

servseal-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 riscoss63
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

servseal-0.1.0/PKG-INFO

@@ -0,0 +1,173 @@
+Metadata-Version: 2.4
+Name: servseal
+Version: 0.1.0
+Summary: Behavioural attestation for deployed language models: is the model you serve the model you validated?
+Author: riscoss63
+License: MIT
+Project-URL: Homepage, https://github.com/riscoss63/servseal
+Keywords: llm,attestation,drift,quantization,fingerprint,deployment
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: numpy>=1.21
+Requires-Dist: scipy>=1.7
+Requires-Dist: sqsketch>=0.3
+Provides-Extra: model
+Requires-Dist: torch>=2.0; extra == "model"
+Requires-Dist: transformers>=4.30; extra == "model"
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Dynamic: license-file
+
+# servseal
+
+**Is the model you serve the model you validated?**
+
+A deployment changes quietly: a provider turns on a sampling filter, an inference stack
+quantises, a template edit ships, a checkpoint is swapped. Task benchmarks are noisy and
+slow; checksums verify files, not behaviour. servseal snapshots what a model actually
+*does* — the full next-token distribution over a fixed probe set, ~1 KB per position —
+and later tells you whether the deployed behaviour is still the reference, **how much**
+it moved, and **which layer** moved it.
+
+```bash
+pip install servseal[model]      # pulls sqsketch >= 0.3 from PyPI
+
+servseal snapshot gpt2 -o reference.seal.npz
+# ... deploy, quantise, migrate serving stacks, wait six months ...
+servseal snapshot /path/to/served-model -o candidate.seal.npz
+servseal verify reference.seal.npz candidate.seal.npz --report attestation.html
+echo $?    # 0 sealed | 3 changed | 2 incomparable
+```
+
+## The change nothing else sees
+
+Measured end to end through this tool on GPT-2 (1500 probe positions, 37 probe texts,
+D=256 — every number below is from the committed run in `experiments/outputs/`):
+
+| deployment event | mean Hellinger | top-1 agreement | perplexity | verdict |
+|---|---:|---:|---:|---|
+| unchanged (re-run) | **0.0000** | 1.000 | 27.83 → 27.83 | **SEALED** |
+| serve: top-p 0.95 | **0.1537** | 1.000 | 27.83 → **27.83** | CHANGED/major — serving-layer |
+| serve: temperature 1.05 | 0.0425 | 1.000 | 27.83 → 27.83 | CHANGED/minor |
+| weights → bfloat16 | 0.0352 | 0.961 | 27.83 → 27.68 | CHANGED/minor — precision |
+| weights → int8/tensor | 0.1684 | 0.773 | 27.83 → 32.03 | CHANGED/major — weight-level |
+| wrong chat template | 0.9072 | 0.037 | 27.83 → 35.10 | CHANGED/major — template |
+| distilgpt2 substituted | 0.2720 | 0.628 | 27.83 → 44.04 | CHANGED/major — weight-level |
+
+Read the top-p row: the provider turned on nucleus sampling, the most likely token is
+unchanged at **every** position, perplexity is unchanged to two decimals — greedy output
+diffs, log-loss checks and eval suites see nothing — and the distribution moved by
+0.15, which this tool measures exactly and labels correctly. A top-k logprob
+fingerprint reports about half of it and does not converge with more memory (measured
+in the sqsketch paper this tool builds on).
+
+Read the template row the other way round: behaviour was destroyed (0.907, top-1
+agreement 3.7%), while perplexity moved only from 27.8 to 35.1 — the class of bug
+routinely misdiagnosed as "the quantisation made it worse". The signature separates
+them: template bugs annihilate top-1 agreement; quantisation dents it; serving filters
+leave it at 100%.
+
+The same battery runs on a second architecture (pythia-160m): unchanged → SEALED at
+0.0000, top-p → 0.1520, CHANGED/serving-layer. Comparing a pythia snapshot to a GPT-2
+snapshot is refused (`INCOMPARABLE`, exit 2) — different tokenizer, not the same
+measurement.
+
+## API mode: endpoints you can only sample from
+
+Against a black-box API the full distribution is unavailable; the endpoint returns
+sampled tokens, already shaped by the provider's serving parameters — which is exactly
+the object under test. Protocol: one `max_tokens=1, temperature=1` completion per probe
+position, N times. Detection is two-sided and calibrated on the unchanged endpoint;
+power measured on real GPT-2 distributions (`experiments/sampling_power.py`):
+
+| sampled tokens | per position | false positives | detects top-p 0.95 | detects temp 1.05 |
+|---:|---:|---:|---:|---:|
+| 1,500 | 1.0 | 0.04 | 0.83 | 0.88 |
+| **5,000** | **3.3** | **0.05** | **1.00** | **1.00** |
+| 15,000 | 10.0 | 0.02 | 1.00 | 1.00 |
+
+**Five thousand single-token completions detect both changes with power 1.00 at a 5%
+false-positive budget** — on a commercial API, a few dollars of traffic. Two designs
+failed before this one and are documented in `servseal/sampler.py`: a one-sided "BC
+must drop" rule (power 0.10 — cutting the tail *concentrates* samples on the head and
+pushes the statistic up) and a pooled corpus-aggregate statistic (power 0.03 — one
+position's tail is another's head; pooling erases the evidence). The shipped statistic
+is per-position, against the per-position sketches the snapshot already stores, and the
+power sweep asserts bit-equality with the product code path before measuring.
+
+## What a verdict gives you
+
+```
+verdict    CHANGED  severity=major
+signature  serving-layer sampling filter (tail-only)
+hellinger  mean=0.1537  max=0.2513  floor=0.0884
+top1       agreement=1.0000
+kl_bound   mean per-position KL >= 0.0000  (certified; 0 certifies nothing, not absence of change)
+report     attestation.html
+```
+
+`--report` writes a self-contained HTML attestation — verdict banner, the numbers, a
+per-position histogram, both snapshot identities and the probe hash — suitable for a
+ticket, a release artifact, or a compliance file.
+
+## What it will not do
+
+- **Compare across tokenizers.** A fingerprint lives in one vocabulary; pythia vs GPT-2
+  is refused, not approximated. (Measured and closed as a negative result in the
+  underlying paper.)
+- **Name the culprit with certainty.** Signatures are calibrated hypotheses, not
+  proofs: a distilled sibling substituted for the reference lands in the same band as
+  an aggressive quantisation (both are "the weights are not the reference weights"),
+  and behavioural evidence alone cannot always split them.
+- **Certify small changes.** The certified-KL line is a one-sided bound that only bites
+  on gross changes at D=256: `0` certifies nothing and must never be read as "nothing
+  changed". The Hellinger measurement, not the certificate, is the detector.
+- **Judge quality.** servseal tells you the behaviour moved, not whether it got worse.
+  A fine-tune you shipped on purpose is CHANGED/major — as it should be.
+- **See what the probes never touch.** Coverage is the probe set's; snapshot your own
+  traffic domain too (`--probes yourfile.txt`). Snapshots refuse comparison across
+  probe sets by hash.
+- **Weights-mode determinism is CPU-grade.** Reference snapshots here are computed in
+  float32 on CPU, where re-running the same model reproduces distance exactly 0.0000.
+  GPU inference can be nondeterministic; snapshot on CPU for the reference of record.
+
+## How it works
+
+Each position's full softmax (vocabulary-sized, tail included) is compressed to D=256
+numbers by a square-root sketch whose inner product estimates the Bhattacharyya
+coefficient of the complete distributions, with error `sqrt(2/D)` independent of
+vocabulary size — the tail is exactly where serving filters and quantisation act, and
+where top-k logprobs are blind by construction. The estimator, its error bars, the
+one-sided KL certificate and the negative results (cross-tokenizer, top-k saturation)
+are established in the sqsketch paper: *Norm-Invariance in Vector-Symbolic Encodings of
+Probability Distributions* (DOI
+[10.5281/zenodo.22214969](https://doi.org/10.5281/zenodo.22214969), code
+[riscoss63/sqsketch](https://github.com/riscoss63/sqsketch)).
+
+## Audit it
+
+Everything above is one command each, on models small enough for a laptop CPU:
+
+```bash
+pip install -e .[model,dev]
+pytest                                    # 24 unit + 5 CLI end-to-end tests
+cd experiments
+python e2e_real_models.py                 # the verdict battery, ~12 min CPU
+python sampling_power.py                  # the API-mode power table, ~1 min
+```
+
+The battery *asserts* every verdict against its ground truth and exits non-zero on any
+miss; the committed outputs in `experiments/outputs/` are what the tables above quote.
+Verdict thresholds live in `servseal/verdict.py` with the calibration documented
+inline; changing them breaks tests until the documentation moves with them.
+
+## Licence
+
+MIT.

servseal-0.1.0/README.md

@@ -0,0 +1,146 @@
+# servseal
+
+**Is the model you serve the model you validated?**
+
+A deployment changes quietly: a provider turns on a sampling filter, an inference stack
+quantises, a template edit ships, a checkpoint is swapped. Task benchmarks are noisy and
+slow; checksums verify files, not behaviour. servseal snapshots what a model actually
+*does* — the full next-token distribution over a fixed probe set, ~1 KB per position —
+and later tells you whether the deployed behaviour is still the reference, **how much**
+it moved, and **which layer** moved it.
+
+```bash
+pip install servseal[model]      # pulls sqsketch >= 0.3 from PyPI
+
+servseal snapshot gpt2 -o reference.seal.npz
+# ... deploy, quantise, migrate serving stacks, wait six months ...
+servseal snapshot /path/to/served-model -o candidate.seal.npz
+servseal verify reference.seal.npz candidate.seal.npz --report attestation.html
+echo $?    # 0 sealed | 3 changed | 2 incomparable
+```
+
+## The change nothing else sees
+
+Measured end to end through this tool on GPT-2 (1500 probe positions, 37 probe texts,
+D=256 — every number below is from the committed run in `experiments/outputs/`):
+
+| deployment event | mean Hellinger | top-1 agreement | perplexity | verdict |
+|---|---:|---:|---:|---|
+| unchanged (re-run) | **0.0000** | 1.000 | 27.83 → 27.83 | **SEALED** |
+| serve: top-p 0.95 | **0.1537** | 1.000 | 27.83 → **27.83** | CHANGED/major — serving-layer |
+| serve: temperature 1.05 | 0.0425 | 1.000 | 27.83 → 27.83 | CHANGED/minor |
+| weights → bfloat16 | 0.0352 | 0.961 | 27.83 → 27.68 | CHANGED/minor — precision |
+| weights → int8/tensor | 0.1684 | 0.773 | 27.83 → 32.03 | CHANGED/major — weight-level |
+| wrong chat template | 0.9072 | 0.037 | 27.83 → 35.10 | CHANGED/major — template |
+| distilgpt2 substituted | 0.2720 | 0.628 | 27.83 → 44.04 | CHANGED/major — weight-level |
+
+Read the top-p row: the provider turned on nucleus sampling, the most likely token is
+unchanged at **every** position, perplexity is unchanged to two decimals — greedy output
+diffs, log-loss checks and eval suites see nothing — and the distribution moved by
+0.15, which this tool measures exactly and labels correctly. A top-k logprob
+fingerprint reports about half of it and does not converge with more memory (measured
+in the sqsketch paper this tool builds on).
+
+Read the template row the other way round: behaviour was destroyed (0.907, top-1
+agreement 3.7%), while perplexity moved only from 27.8 to 35.1 — the class of bug
+routinely misdiagnosed as "the quantisation made it worse". The signature separates
+them: template bugs annihilate top-1 agreement; quantisation dents it; serving filters
+leave it at 100%.
+
+The same battery runs on a second architecture (pythia-160m): unchanged → SEALED at
+0.0000, top-p → 0.1520, CHANGED/serving-layer. Comparing a pythia snapshot to a GPT-2
+snapshot is refused (`INCOMPARABLE`, exit 2) — different tokenizer, not the same
+measurement.
+
+## API mode: endpoints you can only sample from
+
+Against a black-box API the full distribution is unavailable; the endpoint returns
+sampled tokens, already shaped by the provider's serving parameters — which is exactly
+the object under test. Protocol: one `max_tokens=1, temperature=1` completion per probe
+position, N times. Detection is two-sided and calibrated on the unchanged endpoint;
+power measured on real GPT-2 distributions (`experiments/sampling_power.py`):
+
+| sampled tokens | per position | false positives | detects top-p 0.95 | detects temp 1.05 |
+|---:|---:|---:|---:|---:|
+| 1,500 | 1.0 | 0.04 | 0.83 | 0.88 |
+| **5,000** | **3.3** | **0.05** | **1.00** | **1.00** |
+| 15,000 | 10.0 | 0.02 | 1.00 | 1.00 |
+
+**Five thousand single-token completions detect both changes with power 1.00 at a 5%
+false-positive budget** — on a commercial API, a few dollars of traffic. Two designs
+failed before this one and are documented in `servseal/sampler.py`: a one-sided "BC
+must drop" rule (power 0.10 — cutting the tail *concentrates* samples on the head and
+pushes the statistic up) and a pooled corpus-aggregate statistic (power 0.03 — one
+position's tail is another's head; pooling erases the evidence). The shipped statistic
+is per-position, against the per-position sketches the snapshot already stores, and the
+power sweep asserts bit-equality with the product code path before measuring.
+
+## What a verdict gives you
+
+```
+verdict    CHANGED  severity=major
+signature  serving-layer sampling filter (tail-only)
+hellinger  mean=0.1537  max=0.2513  floor=0.0884
+top1       agreement=1.0000
+kl_bound   mean per-position KL >= 0.0000  (certified; 0 certifies nothing, not absence of change)
+report     attestation.html
+```
+
+`--report` writes a self-contained HTML attestation — verdict banner, the numbers, a
+per-position histogram, both snapshot identities and the probe hash — suitable for a
+ticket, a release artifact, or a compliance file.
+
+## What it will not do
+
+- **Compare across tokenizers.** A fingerprint lives in one vocabulary; pythia vs GPT-2
+  is refused, not approximated. (Measured and closed as a negative result in the
+  underlying paper.)
+- **Name the culprit with certainty.** Signatures are calibrated hypotheses, not
+  proofs: a distilled sibling substituted for the reference lands in the same band as
+  an aggressive quantisation (both are "the weights are not the reference weights"),
+  and behavioural evidence alone cannot always split them.
+- **Certify small changes.** The certified-KL line is a one-sided bound that only bites
+  on gross changes at D=256: `0` certifies nothing and must never be read as "nothing
+  changed". The Hellinger measurement, not the certificate, is the detector.
+- **Judge quality.** servseal tells you the behaviour moved, not whether it got worse.
+  A fine-tune you shipped on purpose is CHANGED/major — as it should be.
+- **See what the probes never touch.** Coverage is the probe set's; snapshot your own
+  traffic domain too (`--probes yourfile.txt`). Snapshots refuse comparison across
+  probe sets by hash.
+- **Weights-mode determinism is CPU-grade.** Reference snapshots here are computed in
+  float32 on CPU, where re-running the same model reproduces distance exactly 0.0000.
+  GPU inference can be nondeterministic; snapshot on CPU for the reference of record.
+
+## How it works
+
+Each position's full softmax (vocabulary-sized, tail included) is compressed to D=256
+numbers by a square-root sketch whose inner product estimates the Bhattacharyya
+coefficient of the complete distributions, with error `sqrt(2/D)` independent of
+vocabulary size — the tail is exactly where serving filters and quantisation act, and
+where top-k logprobs are blind by construction. The estimator, its error bars, the
+one-sided KL certificate and the negative results (cross-tokenizer, top-k saturation)
+are established in the sqsketch paper: *Norm-Invariance in Vector-Symbolic Encodings of
+Probability Distributions* (DOI
+[10.5281/zenodo.22214969](https://doi.org/10.5281/zenodo.22214969), code
+[riscoss63/sqsketch](https://github.com/riscoss63/sqsketch)).
+
+## Audit it
+
+Everything above is one command each, on models small enough for a laptop CPU:
+
+```bash
+pip install -e .[model,dev]
+pytest                                    # 24 unit + 5 CLI end-to-end tests
+cd experiments
+python e2e_real_models.py                 # the verdict battery, ~12 min CPU
+python sampling_power.py                  # the API-mode power table, ~1 min
+```
+
+The battery *asserts* every verdict against its ground truth and exits non-zero on any
+miss; the committed outputs in `experiments/outputs/` are what the tables above quote.
+Verdict thresholds live in `servseal/verdict.py` with the calibration documented
+inline; changing them breaks tests until the documentation moves with them.
+
+## Licence
+
+MIT.

servseal-0.1.0/pyproject.toml

@@ -0,0 +1,40 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "servseal"
+version = "0.1.0"
+description = "Behavioural attestation for deployed language models: is the model you serve the model you validated?"
+readme = "README.md"
+license = { text = "MIT" }
+requires-python = ">=3.9"
+authors = [{ name = "riscoss63" }]
+keywords = ["llm", "attestation", "drift", "quantization", "fingerprint", "deployment"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Topic :: Scientific/Engineering :: Artificial Intelligence",
+    "Topic :: Software Development :: Quality Assurance",
+]
+dependencies = ["numpy>=1.21", "scipy>=1.7", "sqsketch>=0.3"]
+
+[project.optional-dependencies]
+# Only snapshotting a model needs these. Verifying, reporting and testing verdict logic
+# work on saved snapshots with numpy alone.
+model = ["torch>=2.0", "transformers>=4.30"]
+dev = ["pytest>=7.0"]
+
+[project.scripts]
+servseal = "servseal.cli:main"
+
+[project.urls]
+Homepage = "https://github.com/riscoss63/servseal"
+
+[tool.setuptools]
+packages = ["servseal"]
+
+[tool.setuptools.package-data]
+servseal = ["probes/*.txt"]

servseal-0.1.0/servseal/__init__.py

@@ -0,0 +1,19 @@
+"""servseal: behavioural attestation for deployed language models.
+
+    from servseal import Snapshot, classify
+    from servseal.runner import snapshot_model         # needs torch
+
+    ref = snapshot_model("gpt2")
+    ref.save("gpt2.seal.npz")
+    ...
+    verdict = classify(Snapshot.load("gpt2.seal.npz").compare(snapshot_model(served)))
+    print(verdict.status, "-", verdict.signature)
+"""
+__version__ = "0.1.0"
+
+from .probes import load_probes, probe_id          # noqa: E402
+from .snapshot import Snapshot                     # noqa: E402
+from .verdict import Verdict, classify             # noqa: E402
+
+__all__ = ["Snapshot", "Verdict", "classify", "load_probes", "probe_id",
+           "__version__"]

servseal-0.1.0/servseal/cli.py

@@ -0,0 +1,140 @@
+"""The command line: snapshot, verify, report, probes.
+
+Exit codes are the contract, so a pipeline can gate on them:
+
+    0  sealed        the served model behaves as the reference
+    1  tool error    bad arguments, missing file, model failed to load
+    2  incomparable  the snapshots measured different things; no attestation made
+    3  changed       the served model does NOT behave as the reference
+
+Output is ASCII, one fact per line, machine-greppable; --json gives the whole record.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+
+from .probes import load_probes, probe_id
+from .snapshot import Snapshot
+from .verdict import EXIT_ERROR, classify
+
+__all__ = ["main"]
+
+
+def _cmd_snapshot(a):
+    from .runner import snapshot_model                     # torch only here
+    snap = snapshot_model(a.model, probes=a.probes, D=a.D, seed=a.seed,
+                          max_positions=a.positions, max_length=a.max_length,
+                          template=a.template, dtype=a.dtype, label=a.label)
+    snap.save(a.out)
+    m = snap.meta
+    print(f"snapshot   {a.out}")
+    print(f"model      {m['model']}  dtype={m['dtype']}")
+    print(f"positions  {m['n_positions']}  D={m['D']}  size={snap.nbytes() / 1024:.0f} KB")
+    print(f"probe      {m['probe']}  ({m.get('probe_file')})")
+    print(f"perplexity {m.get('perplexity')}")
+    return 0
+
+
+def _cmd_verify(a):
+    ref = Snapshot.load(a.reference)
+    cand = Snapshot.load(a.candidate)
+    metrics = ref.compare(cand)
+    verdict = classify(metrics)
+    record = {"metrics": metrics, "verdict": verdict.as_dict()}
+
+    if a.json:
+        with open(a.json, "w", encoding="utf-8") as fh:
+            json.dump(record, fh, indent=2)
+    print(f"verdict    {verdict.status.upper()}"
+          + (f"  severity={verdict.severity}" if verdict.status == "changed" else ""))
+    print(f"signature  {verdict.signature}")
+    if not metrics.get("incomparable"):
+        print(f"hellinger  mean={metrics['mean_hellinger']:.4f}"
+              f"  max={metrics['max_hellinger']:.4f}"
+              f"  floor={metrics['noise_floor']:.4f}")
+        if metrics.get("top1_agreement") is not None:
+            print(f"top1       agreement={metrics['top1_agreement']:.4f}")
+        klb = metrics.get('mean_kl_lower_bound',
+                          max(0.0, metrics['aggregate_kl_lower_bound']))
+        print(f"kl_bound   mean per-position KL >= {klb:.4f}"
+              f"  (certified; 0 certifies nothing, not absence of change)")
+    else:
+        print(f"reason     {metrics['incomparable']}")
+    if a.report:
+        from .report import render_report
+        with open(a.report, "w", encoding="utf-8") as fh:
+            fh.write(render_report(record))
+        print(f"report     {a.report}")
+    return verdict.exit_code
+
+
+def _cmd_report(a):
+    from .report import load_result, render_report
+    record = load_result(a.result)
+    with open(a.out, "w", encoding="utf-8") as fh:
+        fh.write(render_report(record))
+    print(f"report     {a.out}")
+    return 0
+
+
+def _cmd_probes(a):
+    texts = load_probes(a.set)
+    print(f"probe set  {a.set or 'default-v1'}")
+    print(f"texts      {len(texts)}")
+    print(f"probe id   {probe_id(texts)}")
+    return 0
+
+
+def main(argv=None):
+    p = argparse.ArgumentParser(
+        prog="servseal",
+        description="Behavioural attestation for deployed language models: "
+                    "is the model you serve the model you validated?")
+    sub = p.add_subparsers(dest="cmd", required=True)
+
+    s = sub.add_parser("snapshot", help="fingerprint a model over the probe set")
+    s.add_argument("model", help="HF model id or local path")
+    s.add_argument("-o", "--out", required=True, help="output .seal.npz file")
+    s.add_argument("--probes", default=None, help="bundled set name or probe file")
+    s.add_argument("--positions", type=int, default=1500)
+    s.add_argument("--max-length", type=int, default=96)
+    s.add_argument("--D", type=int, default=256)
+    s.add_argument("--seed", type=int, default=0)
+    s.add_argument("--dtype", default="float32",
+                   choices=["float32", "bfloat16", "float16"])
+    s.add_argument("--template", default=None,
+                   help="prompt template with {text}, if the deployment applies one")
+    s.add_argument("--label", default=None)
+    s.set_defaults(fn=_cmd_snapshot)
+
+    v = sub.add_parser("verify", help="compare a candidate snapshot to a reference")
+    v.add_argument("reference")
+    v.add_argument("candidate")
+    v.add_argument("--json", default=None, help="write the full record here")
+    v.add_argument("--report", default=None, help="write an HTML attestation here")
+    v.set_defaults(fn=_cmd_verify)
+
+    r = sub.add_parser("report", help="render an HTML attestation from a verify --json")
+    r.add_argument("result")
+    r.add_argument("-o", "--out", required=True)
+    r.set_defaults(fn=_cmd_report)
+
+    pr = sub.add_parser("probes", help="show a probe set and its id")
+    pr.add_argument("--set", default=None)
+    pr.set_defaults(fn=_cmd_probes)
+
+    a = p.parse_args(argv)
+    try:
+        return a.fn(a)
+    except FileNotFoundError as e:
+        print(f"error      {e}", file=sys.stderr)
+        return EXIT_ERROR
+    except ValueError as e:
+        print(f"error      {e}", file=sys.stderr)
+        return EXIT_ERROR
+
+
+if __name__ == "__main__":
+    sys.exit(main())

servseal-0.1.0/servseal/probes/default-v1.txt

@@ -0,0 +1,93 @@
+# servseal probe set: default-v1
+# One paragraph per block, blank-line separated. Lines starting with # are ignored.
+# This file is part of the product contract: two snapshots are comparable only if they
+# were taken on byte-identical probes, and the probe id in every snapshot is a hash of
+# exactly these texts. Do not edit this file; add a new versioned file instead.
+
+The water cycle describes how water moves between the oceans, the atmosphere and the land. Heat from the sun evaporates water from the sea surface, and the vapour rises, cools and condenses into clouds. When the droplets grow heavy enough they fall as rain or snow, feeding rivers and soaking into the ground, and the rivers carry the water back to the sea, where the cycle begins again.
+
+The committee met on Tuesday to review the proposed amendments to the zoning ordinance. After two hours of discussion, the members voted five to two in favour of forwarding the revised draft to the city council, with the recommendation that the height restriction along the waterfront be retained and the parking requirement for mixed-use buildings be reduced from two spaces per unit to one.
+
+def merge_sorted(a, b):
+    out = []
+    i = j = 0
+    while i < len(a) and j < len(b):
+        if a[i] <= b[j]:
+            out.append(a[i]); i += 1
+        else:
+            out.append(b[j]); j += 1
+    return out + a[i:] + b[j:]
+
+Preheat the oven to 220 degrees. Toss the potatoes with olive oil, salt and rosemary, then spread them in a single layer on a baking tray, cut side down. Roast for twenty-five minutes without turning, until the undersides are deeply browned, then flip them, add the crushed garlic, and roast for another ten minutes. Finish with lemon zest and a little more salt before serving.
+
+"Did you hear the news about the bridge?" she asked, setting down her cup. "They're closing it for repairs starting Monday." He frowned and looked out of the window at the traffic already backed up along the avenue. "That's going to double my commute," he said. "Maybe. Or maybe people will finally start taking the ferry, and you'll get the quiet morning you keep saying you want."
+
+In the second half the visitors changed their shape, pushing the full-backs high and playing through the middle, and for twenty minutes the home side could barely get out of their own half. The equaliser came from a corner, a glancing header at the near post, and by the time the fourth official signalled six minutes of added time both sets of supporters seemed to sense that one more goal was coming.
+
+The quarterly report showed revenue of 4.2 billion, up nine percent from a year earlier, driven mostly by the services division, while hardware sales declined for the third consecutive quarter. Operating margin narrowed to 18.5 percent as the company absorbed higher logistics costs, and management lowered full-year guidance, citing currency headwinds and softer demand in Europe.
+
+A cold front will move across the region overnight, bringing a sharp drop in temperature and gusty northwest winds of forty to fifty kilometres per hour. Rain will turn to snow above six hundred metres, with accumulations of five to ten centimetres expected on higher ground by morning. Travellers should allow extra time and check conditions before crossing the pass.
+
+The photosynthetic reaction begins when a photon strikes a chlorophyll molecule in the thylakoid membrane, exciting an electron that is passed along a transport chain. The energy released pumps protons across the membrane, and the resulting gradient drives the synthesis of ATP. Meanwhile the splitting of water molecules releases oxygen as a by-product, which diffuses out of the leaf through the stomata.
+
+To reset the device, hold the power button for ten seconds until the indicator light flashes amber. Release the button, wait for the light to turn solid white, and then press it twice in quick succession. The device will restart with factory settings; note that any stored profiles will be erased, so export your configuration from the companion app before you begin.
+
+A train leaves the station travelling east at eighty kilometres per hour. Half an hour later a second train leaves the same station on a parallel track travelling east at one hundred and ten kilometres per hour. How long after its departure will the second train draw level with the first, and how far from the station will both trains be at that moment?
+
+The tenant shall keep the premises in good order and shall not make structural alterations without the prior written consent of the landlord. The landlord shall be responsible for repairs to the roof, exterior walls and main services, save where damage results from the negligence of the tenant, in which case the reasonable cost of repair may be recovered from the deposit.
+
+The old lighthouse keeper climbed the spiral stairs for the last time that evening, counting each step as he had for thirty-one years. The lamp no longer needed him; the new system switched itself on at dusk and reported its own faults to a computer on the mainland. He stood on the gallery in the fading light, watching the beam sweep over the water, and found he could not decide whether to feel replaced or released.
+
+Interest rates influence the economy through several channels. When the central bank raises its policy rate, borrowing becomes more expensive for households and firms, which tends to cool investment and consumption. The exchange rate typically strengthens, making imports cheaper and exports dearer. With a lag of a year or more, these effects feed through to slower growth in prices and wages.
+
+The recipe for a good bug report is short: state what you did, what you expected, and what happened instead. Include the exact error text, the version of the software, and the smallest sequence of steps that reproduces the problem. A report that says the application crashed after clicking save on an empty form is worth ten that say the program does not work properly.
+
+Between 1804 and 1806 the expedition travelled up the Missouri River, crossed the continental divide on horseback, and descended the Columbia to the Pacific, mapping the country and recording hundreds of plants and animals unknown to science. The journals kept along the way, with their mixture of careful observation and phonetic spelling, remain one of the most vivid records of the American interior before settlement.
+
+SELECT customer_id, COUNT(*) AS orders, SUM(total) AS revenue
+FROM orders
+WHERE placed_at >= DATE '2025-01-01'
+GROUP BY customer_id
+HAVING COUNT(*) >= 3
+ORDER BY revenue DESC
+LIMIT 50;
+
+The violin section carries the opening theme, a rising figure in D minor that the cellos answer two bars later in inversion. The development fragments this material, passing it between woodwind and strings over a restless pedal point, and when the recapitulation finally arrives the theme returns in the major, transformed from a question into something like an answer.
+
+Volcanic islands form as a tectonic plate moves slowly over a stationary hotspot in the mantle. Magma rises through the crust and erupts on the sea floor, building a mountain that eventually breaks the surface. As the plate carries the island away from the hotspot the volcano goes extinct and erosion takes over, while a new island begins to grow behind it, producing a chain whose ages increase with distance.
+
+Dear Ms Alvarez, thank you for your message of 14 March concerning the delayed shipment. We have located the consignment at the customs depot and expect it to be released within three working days. As a gesture of goodwill we will refund the express delivery charge to your original payment method. Please accept our apologies for the inconvenience, and do not hesitate to contact me directly with any further questions.
+
+The film's first hour is its best, a patient portrait of a family business failing in slow motion, shot in long takes that let the silences do the arguing. The final act loses its nerve, reaching for a reconciliation the characters have not earned, but the performances hold it together, and the closing image of the empty shop at dawn lingers longer than the script deserves.
+
+A hash table stores key-value pairs in an array of buckets. To insert a pair, the key is hashed to an index and the pair is placed in the corresponding bucket; collisions are handled by chaining or by probing for the next free slot. With a good hash function and a load factor kept below about three quarters, insertion and lookup take constant time on average, though the worst case remains linear.
+
+The glacier has retreated more than two kilometres since the first photographs were taken in 1911. Researchers who drilled the ice last summer found meltwater flowing at the base far earlier in the season than models predicted, lubricating the glacier's slide toward the fjord. If the current rate holds, the tongue will detach from its terminal moraine within a decade, accelerating the loss further.
+
+She learned the trade from her grandmother, who could tell by the smell of the vat when the indigo was ready. The cloth goes in green, and only when it meets the air does the blue arrive, deepening with each dip. Seven dips for work clothes, twelve for a wedding cloth. The chemistry is simple, she says, but the judgement is not, and the judgement is the part that takes ten years.
+
+The probe entered orbit after a seven-month cruise, firing its main engine for twenty-three minutes to shed enough velocity for capture. Over the following weeks, controllers will lower the orbit using repeated passes through the upper atmosphere, a technique that saves fuel at the cost of patience. The first high-resolution images of the southern highlands are expected in early spring.
+
+In chess, the endgame with king and pawn against king is the foundation on which everything else rests. The stronger side wins if the king can reach one of the key squares in front of the pawn; otherwise the defender draws by taking the opposition. A player who understands this single position, deeply rather than by rote, already understands more about the game than most who have memorised twenty openings.
+
+The market opened lower after the overnight announcement, with the index down two percent in the first hour before recovering half the loss by midday. Trading volume was the heaviest in six weeks. Analysts were divided on whether the sell-off marked the start of a broader correction or a one-day reaction to news that had, in the words of one strategist, been priced in everywhere except the headlines.
+
+Fermentation begins within hours of the harvest. Wild yeasts on the grape skins start converting sugar to alcohol, and the winemaker's first decision is whether to let them continue or to add a cultured strain with a more predictable temperament. Temperature is the other lever: cool and slow preserves the delicate aromatics, warm and fast extracts colour and tannin. Every choice closes some doors and opens others.
+
+The immune system distinguishes self from non-self through a training process that takes place largely in the thymus. Developing T cells that bind too strongly to the body's own proteins are eliminated, while those that ignore them entirely are useless and die of neglect. The survivors walk a narrow line, reactive enough to recognise invaders, restrained enough to leave the body's own tissues alone.
+
+Turn right at the old mill and follow the gravel road for about three kilometres until you reach a wooden bridge. Cross it, and the trailhead is on your left, marked with a blue sign. The path climbs steadily through beech forest for the first hour, then levels out along the ridge. Allow four hours for the round trip and carry water; the spring at the halfway point is dry by midsummer.
+
+The printing press did not create the desire to read; it industrialised it. Within fifty years of Gutenberg, presses operated in more than two hundred European towns, and the price of a book fell by a factor of twenty. What had been the possession of monasteries and princes became the furniture of merchants' houses, and the arguments that followed, religious and political alike, were arguments among readers.
+
+Loss of pressure in the forward cabin triggered the automatic descent, and the aircraft levelled at three thousand metres as designed. The crew worked through the checklist, declared an emergency, and diverted to the alternate field, landing forty minutes later without injury. The investigation traced the fault to a door seal that had been replaced two weeks earlier with a part from a different supplier.
+
+For the winter solstice the village bakes a flat bread marked with a wheel of eight spokes, one for each of the year's festivals. The dough is enriched with honey and saffron, and the first loaf out of the oven is broken and shared on the doorstep, a piece for each person present and one crumbled on the threshold for the year itself. The custom survived two empires and a revolution, mostly because it is delicious.
+
+The function of the kidney is filtration, but the organ works by a strategy of extravagant waste followed by careful reclamation. Each day the glomeruli filter some 180 litres of fluid from the blood, and the tubules reabsorb more than 99 percent of it, adjusting the recovery of water, salt and glucose to the body's needs. What remains, about a litre and a half, is excreted as urine.
+
+Ticket 4821: after the latest deployment, the export button on the invoices page returns a 500 error for accounts with more than one thousand line items. Reproduced on staging with the demo account. The stack trace points to a timeout in the PDF renderer. Suggested fix: paginate the export or move rendering to the background queue and email the file when ready. Priority: high, affects three enterprise customers.
+
+The desert looks empty at noon and crowded at dawn. Tracks in the sand record the night's business: the sidewinding trail of a viper, the neat stitching of a beetle, the sudden sweep where an owl's wing erased a rodent's story mid-sentence. By the time the heat rises the actors are underground, and the stage holds only their signatures, waiting for the wind to wipe it clean for the next performance.
+
+Add the flour gradually while mixing on low speed, then increase to medium and knead for eight minutes until the dough pulls cleanly from the sides of the bowl. It should feel soft but not sticky; adjust with a spoonful of flour or water as needed. Cover and let it rise until doubled, about ninety minutes in a warm kitchen, then fold it gently over itself twice and shape it on a floured board.