Add application file

README.md

@@ -1,5 +1,5 @@
 ---
-title: Provenance Verifier — Live Demo
+title: Provenance Verifier
 emoji: ✔
 colorFrom: gray
 colorTo: green
@@ -10,9 +10,9 @@ pinned: false
 license: apache-2.0
 ---
 
-# Provenance Verifier — live demo · FALCONS.AI Model Surgeon
+# Provenance Verifier · FALCONS.AI Model Surgeon
 
-A public, no-account demo where anyone can watch a Model Surgeon package prove
+A public, no-account verifier where anyone can watch a Model Surgeon package prove
 itself. Tap a sample, drop your own `.zip` onto the grid, or point it at a
 Hugging Face repo — the verdict comes straight from the unmodified, audited
 `verify_attestation.py` from
@@ -31,7 +31,7 @@ Product: [surgeon.falcons.ai](https://surgeon.falcons.ai) ·
 | --- | --- |
 | `app.py` | the Gradio page and its three handlers (sample · upload · Hub repo), the cancel control, the five-deep verdict stack with receipts |
 | `engine_wrapper.py` | the verification wrapper — **every function byte-identical to the FastAPI original** (`_run_engine_sync`, `_parse_stdout`, `_normalize_container`, `_junk_entry`, `_zip_declared_size`, `_resolve_and_verify_repo_sync`, `_dsse_subject_names`, `_result`) |
-| `engine/verify_attestation.py` | the pinned engine, verbatim, unchanged |
+| `engine/verify_attestation.py` | the pinned engine, verbatim from Model Surgeon `tools/verify_attestation.py` (V7.13, 2026-09-08: names the legacy predicate id when it meets one) |
 | `static/style.css` | the product stylesheet, unchanged; `static/gradio.css` holds the few overrides that hide Gradio's own wrappers |
 | `samples/` | SAMPLE_A (genuine) · SAMPLE_B (one byte flipped) |
 

app.py

@@ -21,6 +21,51 @@ Standing rules (BUILD SPEC section 1), how each survives the transport:
   4. Missing capability != tampering   -> engine_wrapper (unchanged)
   5. Weights never re-served           -> the verdict stack shows text only;
                                           no file output component exists.
+
+# Verify a Model Surgeon package
+
+Drop in a signed package and this will tell you whether it is intact, what it
+contains, and where it came from. **Free, permanently. No account, no sign-up,
+nothing stored.**
+
+## What it checks
+
+- **Integrity** — whether a single byte has changed since the package was signed.
+- **Lineage** — the chain of operations performed on the model, and by whom.
+  A model pulled, edited and re-pushed keeps its earlier attestation, so the
+  chain holds across multiple hands.
+- **Scope** — attestations name precisely the files they cover, and this reports
+  exactly that. No more, no less.
+
+## What it does not claim
+
+Verification proves that **this file is the file that was signed, and records
+what was done to it.** It does not establish that a model is original, or that
+it is not derived from an open-weight base. That is a different question and
+this tool does not pretend to answer it.
+
+## Why it is free
+
+Because a verification tool you have to buy from the party being verified is
+not verification. The person who needs convincing should never have to trust
+us, hold an account, or pay anything.
+
+The same verifier is open source under Apache-2.0, and **a copy ships inside
+every package** — so verification works offline, in an air-gapped environment,
+and continues to work whether or not we are still here.
+
+- **Source (CLI + spec):** https://github.com/Falcons-ai/surgeon-verify
+- **Where the packages come from:** https://surgeon.falcons.ai/?utm_source=huggingface
+
+## One result worth knowing
+
+During launch testing, this verifier was handed a package signed by a build
+**twenty-five releases earlier**. It honoured the old signature correctly. A
+single byte was then altered — one byte out of roughly fourteen million — and
+the verifier caught the tamper and **named the exact file**.
+
+That is the whole point of the thing.
+                                          
 """
 
 import base64
@@ -75,7 +120,7 @@ _slots = threading.Semaphore(MAX_CONCURRENCY)
 def _busy_result():
     return _result(
         "error", None, "",
-        detail=("The demo is at capacity right now — give it a few seconds and "
+        detail=("The verifier is at capacity right now — give it a few seconds and "
                 "try again. " + LOCAL_CMD),
     )
 
@@ -228,7 +273,7 @@ def verify_upload(file_path, stack, progress=gr.Progress()):
         received = target.stat().st_size
         if received > MAX_UPLOAD_BYTES:
             res = _result("error", None, "", detail=(
-                "That file is over this demo's " + str(MAX_UPLOAD_MB)
+                "That file is over this verifier's " + str(MAX_UPLOAD_MB)
                 + " MB upload cap. " + LOCAL_CMD))
         elif received == 0:
             res = _result("error", None, "", detail="No file was received. " + LOCAL_CMD)
@@ -241,7 +286,7 @@ def verify_upload(file_path, stack, progress=gr.Progress()):
                         res = _result("error", None, "", detail=(
                             "This archive declares an uncompressed size more than "
                             "twice the " + str(MAX_UPLOAD_MB)
-                            + " MB cap, so the demo won't open it. " + LOCAL_CMD))
+                            + " MB cap, so it won't be opened here. " + LOCAL_CMD))
                 except zipfile.BadZipFile:
                     pass  # let the engine speak for itself
             if res is None:
@@ -304,13 +349,41 @@ MASTHEAD = f"""
     <img src="{LOGO}" alt="FALCONS.AI falcon logo" width="72" height="72">
   </a>
   <div class="masthead-text">
-    <h1>PROVENANCE VERIFIER — LIVE DEMO</h1>
+    <h1>PROVENANCE VERIFIER</h1>
     <p class="byline">by <span class="brand-name">FALCONS.AI</span></p>
     <p class="sub">free for everyone · no account needed · <span class="brand">Model Surgeon</span></p>
   </div>
 </header>"""
 
 FOOTER = """
+<h1>Verify a Model Surgeon package</h1>
+<p>Drop in a signed package and this will tell you whether it is intact, what it contains, and where it came from. <strong>Free, permanently. No account, no sign-up, nothing stored.</strong></p>
+
+<h2>What it checks</h2>
+<ul>
+  <li><strong>Integrity</strong> — whether a single byte has changed since the package was signed.</li>
+  <li><strong>Lineage</strong> — the chain of operations performed on the model, and by whom. A model pulled, edited and re-pushed keeps its earlier attestation, so the chain holds across multiple hands.</li>
+  <li><strong>Scope</strong> — attestations name precisely the files they cover, and this reports exactly that. No more, no less.</li>
+</ul>
+
+<h2>What it does not claim</h2>
+<p>Verification proves that <strong>this file is the file that was signed, and records what was done to it.</strong> It does not establish that a model is original, or that it is not derived from an open-weight base. That is a different question and this tool does not pretend to answer it.</p>
+
+<h2>Why it is free</h2>
+<p>Because a verification tool you have to buy from the party being verified is not verification. The person who needs convincing should never have to trust us, hold an account, or pay anything.</p>
+<p>The same verifier is open source under Apache-2.0, and <strong>a copy ships inside every package</strong> — so verification works offline, in an air-gapped environment, and continues to work whether or not we are still here.</p>
+<ul>
+  <li><strong>Source (CLI + spec):</strong> <a href="https://github.com/Falcons-ai/surgeon-verify">https://github.com/Falcons-ai/surgeon-verify</a></li>
+  <li><strong>Where the packages come from:</strong> <a href="https://surgeon.falcons.ai/?utm_source=huggingface">https://surgeon.falcons.ai/?utm_source=huggingface</a></li>
+</ul>
+
+<h2>One result worth knowing</h2>
+<p>During launch testing, this verifier was handed a package signed by a build <strong>twenty-five releases earlier</strong>. It honoured the old signature correctly. A single byte was then altered — one byte out of roughly fourteen million — and the verifier caught the tamper and <strong>named the exact file</strong>.</p>
+<p>That is the whole point of the thing.</p>
+
+
+
+
 <footer class="footer">
   <nav class="footlinks">
     <a href="https://surgeon.falcons.ai/pricing">Pricing</a> ·
@@ -338,11 +411,11 @@ FORCE_DARK_JS = """
 
 def build():
     samples = _samples()
-    with gr.Blocks(title="Provenance Verifier — live demo · FALCONS.AI Model Surgeon",
+    with gr.Blocks(title="Provenance Verifier · FALCONS.AI Model Surgeon",
                    css=CSS, js=FORCE_DARK_JS, analytics_enabled=False,
                    delete_cache=(60, 60),                 # Gradio's cache: sweep every minute, nothing older than a minute
                    theme=gr.themes.Base(font=gr.themes.GoogleFont("IBM Plex Mono"),
-                                        font_mono=gr.themes.GoogleFont("IBM Plex Mono"))) as demo:
+                                        font_mono=gr.themes.GoogleFont("IBM Plex Mono"))) as ui:
         stack = gr.State([])
         gr.HTML(MASTHEAD)
 
@@ -395,8 +468,8 @@ if __name__ == "__main__":
     # hand-rolled server (a second uvicorn fought the runtime for the port).
     # SPEC 1.3 holds: Gradio starts uvicorn at log_level="warning", so no
     # access log is written; this module never logs user input.
-    demo.queue(default_concurrency_limit=MAX_CONCURRENCY)
-    demo.launch(
+    ui.queue(default_concurrency_limit=MAX_CONCURRENCY)
+    ui.launch(
         server_name=os.environ.get("GRADIO_SERVER_NAME", "0.0.0.0"),
         server_port=int(os.environ.get("GRADIO_SERVER_PORT", os.environ.get("PORT", "7860"))),
         max_file_size=f"{MAX_UPLOAD_MB}mb",       # the streamed upload cap (SPEC 4.2)

engine/verify_attestation.py

@@ -1,4 +1,16 @@
 #!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) 2026 FALCONS.AI. Licensed under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at
+#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations.
+# This file — the free verifier — is the open-source component of Model
+# Surgeon (T3-a, operator-ruled Apache-2.0, 2026-08-31). The product itself
+# is proprietary; see LICENSE-verifier and NOTICE in the package.
 """
 FALCONS.AI Model Surgeon — FREE attestation verifier.
 
@@ -10,12 +22,13 @@ Checks, in order:
   1. the package carries a lineage.intoto.jsonl attestation;
   2. every subject artifact's SHA-256 matches the signed digest;
   3. the DSSE HMAC signature verifies under the given key
-     (--key or FALCONSAI_HMAC_KEY; defaults to the public demo key).
+     (--key or FALCONSAI_HMAC_KEY; defaults to the public key).
 
 Exit codes: 0 VERIFIED · 1 TAMPERED/INCOMPLETE · 2 not a Surgeon package.
 Verification is free by design: signed creation is the paid act, universal
 verification is what makes the signature worth anything.
 """
+VERIFIER_VERSION = "2"   # D-4 (V6.98): chain-aware
 import argparse
 import base64
 import hashlib
@@ -43,13 +56,18 @@ def main():
         print(f"✖ cannot open {a.package}: {e}")
         sys.exit(2)
     names = z.namelist()
+    # v6.51 container fix (UPSTREAM_NOTE): some Windows tools zip with
+    # backslash separators — normalize member names so those packages
+    # verify instead of reading "not a Surgeon package".
+    canon = {n.replace("\\", "/"): n for n in names}
+    names = list(canon)
     prefix = ""
     roots = {n.split("/", 1)[0] for n in names if n.strip("/")}
     if len(roots) == 1 and all("/" in n for n in names if n.strip("/")):
         prefix = next(iter(roots)) + "/"   # Explorer-style re-zip: descend
 
     def _zread(nm):
-        return z.read(prefix + nm)
+        return z.read(canon.get(prefix + nm, prefix + nm))
     try:
         att = json.loads(_zread("lineage.intoto.jsonl"))
     except KeyError:
@@ -62,6 +80,7 @@ def main():
     # key, so verification needs no secret and forgery needs the private
     # key. Free verification, restored properly.
     env_missing = False
+    sig_uncheckable = False
     sig_entry = (att.get("signatures") or [{}])[0] or {}
     scheme = sig_entry.get("scheme") or "hmac"
     if scheme == "ed25519" and sig_entry.get("publicKey"):
@@ -91,11 +110,17 @@ def main():
               "key could have produced this package")
     else:
         have = None
+        sig_uncheckable = True
         print("signature   : legacy shared-key package; supply --key or "
               "FALCONSAI_HMAC_KEY to check it (digests still verified)")
-    sig_ok = hmac.compare_digest(want, have)
+    sig_ok = have is not None and hmac.compare_digest(want, have)
     stmt = json.loads(payload)
-    print(f"attestation : {stmt.get('predicateType')}")
+    print(f"verifier    : {VERIFIER_VERSION}")
+    pt = stmt.get("predicateType")
+    if pt == "https://falcons.ai/model-surgeon/lineage/v1":       # packages written before V7.13: the legacy id (same schema)
+        print(f"attestation : https://surgeon.falcons.ai/lineage/v1 (predicate type; this package carries the legacy id {pt})")
+    else:
+        print(f"attestation : {pt}")
     print(f"tool        : {(stmt.get('predicate') or {}).get('tool')}")
     all_ok = True
     for sub in stmt.get("subject", []):
@@ -114,12 +139,46 @@ def main():
         if not ok:
             print(f"      signed  {digest}\n      actual  {actual}")
     print(f"signature   : {'✔ valid under this key' if sig_ok else '✖ does NOT verify under this key'}")
+    # D-4 (V6.98, VERIFIER 2): the lineage CHAIN. A prior attestation, when the
+    # package carries one, is checked for payload integrity and — when it was
+    # signed by THIS package's key — for signature. A prior that cannot be
+    # verified here is reported AMBER; it never makes this package TAMPERED.
+    chain = (stmt.get("predicate") or {}).get("chain")
+    if chain:
+        depth = chain.get("depth")
+        pr = chain.get("prior")
+        if not pr:
+            print(f"chain       : depth {depth} · no prior attestation reachable at load")
+        else:
+            try:
+                p_env = pr.get("envelope") or {}
+                p_payload = base64.b64decode(p_env.get("payload", ""))
+                p_digest = hashlib.sha256(p_payload).hexdigest()
+                p_sig = (p_env.get("signatures") or [{}])[0]
+                intact = p_digest == pr.get("digest")
+                same_key = bool(sig_entry.get("publicKey")) and p_sig.get("keyid") == sig_entry.get("keyid")
+                p_ok = None
+                if intact and same_key and p_sig.get("scheme") == "ed25519" and p_sig.get("sig"):
+                    try:
+                        from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey as _PK
+                        _PK.from_public_bytes(bytes.fromhex(sig_entry["publicKey"])).verify(
+                            bytes.fromhex(p_sig["sig"]), p_payload)
+                        p_ok = True
+                    except Exception:
+                        p_ok = False
+                state = ("prior VERIFIED (same publisher key)" if p_ok else
+                         "prior INVALID under this key — AMBER" if p_ok is False else
+                         "prior intact · signed by another key — not verified here (AMBER)" if intact else
+                         "prior payload does not match its recorded digest — AMBER")
+                print(f"chain       : depth {depth} · {state} · prior keyid {str(p_sig.get('keyid') or '?')[:20]} · {len(pr.get('operations') or [])} earlier operation(s)")
+            except Exception as e:
+                print(f"chain       : depth {depth} · prior present but unreadable ({e}) — AMBER")
     merges = (stmt.get("predicate") or {}).get("merges") or []
     if merges:
         print(f"merges      : {len(merges)} recorded "
               f"({', '.join(sorted({m.get('method','lerp') for m in merges}))})")
     verdict = "VERIFIED" if sig_ok and all_ok and stmt.get("subject") \
-        else "INCOMPLETE" if (env_missing and all_ok) \
+        else "INCOMPLETE" if ((env_missing or sig_uncheckable) and all_ok) \
         else "TAMPERED" if stmt.get("subject") else "INCOMPLETE"
     print(f"\nVERDICT: {verdict}")
     sys.exit(0 if verdict == "VERIFIED" else 1)