Kernel

# pip install "kernels>=0.17.2" torch
# This loads and executes remote Python code; review the source first.
from kernels import get_kernel

# v1 is the stable API channel, republished from GitHub by hf-kernel-publish.
kv = get_kernel("SZLHOLDINGS/szl-block-kv", version=1, trust_remote_code=True)
print(kv.selfcheck())
print(kv.selfcheck_invariant())

Doctrine

Doctrine v11. Λ = Conjecture 1 OPEN (advisory; uniqueness unproven, not proven trust). GitHub is the source; the Hub is a separately observed publication target.

Invariant-keyed blocks

A paged-KV block addressed by its token content alone is reusable by any request that presents the same tokens. That is arithmetically sound and governance-unsound: a block computed while a permissive invariant bundle was in force can be served to a request running under a stricter one, and nothing in the cache layer can see the difference.

InvariantKeyedBlockTable makes the governance regime part of the address:

block_key = SHA3-256( "szl.block-kv.invariant-key" || canonical(token_ids) || bundle_id )

Same tokens under a different bundle produce a different key, so the lookup misses and the block is recomputed under the regime that asked for it. There is no code path that returns a block keyed to another bundle.

from szl_block_kv import InvariantBundle, InvariantKeyedBlockTable, ReceiptChain

permissive = InvariantBundle(doctrine="v11", policy_class="default-permissive",
                            receipts_required=True, verifier_budget=0)
strict = permissive.derive(policy_class="default-strict", verifier_budget=3)

chain = ReceiptChain()
table = InvariantKeyedBlockTable(num_blocks=1024, chain=chain)
run = [15496, 11, 995, 13]

table.lookup(run, permissive)      # (None, "miss_cold")
physical = table.admit(run, permissive)
table.lookup(run, permissive)      # (physical, "hit")
table.lookup(run, strict)          # (None, "miss_cross_regime")  <- containment
chain.verify()                     # (True, 4, -1)

A cross-regime miss is reported distinctly from a cold miss, because the two mean different things operationally: a cold miss is capacity or novelty, a cross-regime miss is governance doing its job. table.audit() asserts structurally that no physical block serves two regimes, and every lookup, admission, rejection, and eviction is appended to the same SHA3-256 receipt chain as paged_attn.

Self-check: from szl_block_kv import selfcheck_invariant; selfcheck_invariant()

Local source tree

Put torch-ext/ on PYTHONPATH, then:

from szl_block_kv import PagedCache, paged_attn, reshape_and_cache, selfcheck
print(selfcheck())

Source and Hub release scope

Loading with trust_remote_code=True executes Python from the Kernel Hub repository; SZLHOLDINGS is not a trusted kernel publisher. The narrowest form is trust_remote_code=["SZLHOLDINGS/szl-block-kv"]. version=1 resolves the v1 branch. CPU hosts load build/torch-cpu and other hosts load build/torch-universal; both carry identical bytes built from one GitHub commit.

The Kernel Hub repository is written only by this repository's hf-kernel-publish workflow. It builds both variants from torch-ext/szl_block_kv at a reviewed commit on main, updates main and v1 by fast-forward only, then loads them anonymously through get_kernel and fails unless the served bytes equal the GitHub source. SZL_KERNEL_SOURCE.json in the Kernel Hub repository names the GitHub commit each build came from. The model-type twin SZLHOLDINGS/szl-block-kv carries no loadable build; it points here, and its commits are not kernel revisions.

To pin an exact build for production, resolve v1 to a Kernel Hub commit, record it in your lockfile, and pass it as revision=<that commit> in place of version=1:

from huggingface_hub import HfApi

refs = HfApi().list_repo_refs("SZLHOLDINGS/szl-block-kv", repo_type="kernel")
pin = next(b.target_commit for b in refs.branches if b.name == "v1")

Publication does not widen the qualification scope. The source-bound CPU release record reports 92 synthetic conformance tests passed on CPU for GitHub source 217e3b24017cd5fadb2525a7b5207f7c89a46413 (Kernel Hub revision 54a19796ee2c4f761c9482f77dd1f989a773e17f, kernels 0.16.1). It establishes no independent replay, GPU/Triton qualification, speed, or energy claim.

Evidence record

REPORTED — Cross-regime containment. The 14 tests in the pinned test source cover canonical bundle ids, domain separation against boundary confusion, hit vs cold miss vs cross-regime miss, refusal to rebind a physical block across regimes, no physical block serving two regimes (4 regimes x 3 runs), auditability across FIFO eviction, and receipt-chain depth. This describes test source, not a fresh run result. What-NOT: not a proof about attention arithmetic. (no receipt linked).

REPORTED — Reuse fidelity under one regime. The pinned test source defines test_reuse_under_the_same_regime_is_numerically_exact, which asserts that a served hit is torch.equal to recompute, and that both match noncausal contiguous-KV SDPA within atol/rtol 1e-5 on float32. This describes test source, not a fresh run result. (no receipt linked).

REPORTED — Noncausal paged gather correctness. The pinned test source asserts that paged attention over shuffled pages and over partial context lengths matches contiguous-KV SDPA with is_causal=False within atol/rtol 1e-5 on float32. This describes test source, not a fresh run result, and does not establish causal attention. (no receipt linked).

REPORTED — CPU get_kernel load from the Kernel Hub (kernels 0.16.1, build/torch-universal and build/torch-cpu, selfcheck ok) and a local pytest run, recorded 2026-08-29 against source commit 7cf99cca in BENCH.laptop-blackwell.json and OPERATIONAL.json. Those plates remain in Kernel Hub history (for example revision 54a19796ee2c4f761c9482f77dd1f989a773e17f) but are no longer served, because they describe an older source and a floating main-branch load path. No receipt for them is committed in this repository. (no receipt linked).

REPORTED — The first-class Kernel Hub revision 54a19796ee2c4f761c9482f77dd1f989a773e17f is source-bound to GitHub 217e3b24017cd5fadb2525a7b5207f7c89a46413. Its CPU-only synthetic qualification record reports 92 tests passed, 0 failed, and 0 skipped. Independent replay, GPU, Triton, speed, and energy are not established by this record. Receipt.

UNAVAILABLE — GPU Triton page kernel. It is not in v0; no cubin and no timed GPU run exist. (no receipt linked).

UNAVAILABLE — Eviction quality. v0 eviction is FIFO; no eviction-quality or hit-rate claim is made. (no receipt linked).

UNAVAILABLE — Cost of keying. The hit-rate cost of narrowing the keyspace by bundle is not measured here. Measure it on your own traffic before promotion. (no receipt linked).

UNAVAILABLE — Speed-up, tokens/s, and energy measurements for this CPU-only release. (no receipt linked).

Labels follow the SZL claim language. A claim is only as strong as the receipt it links.

Source and provenance

Rendering this card does not establish Hub publication. Verify any Hub copy against its source revision, publication evidence, and exact Hub revision.