Socair derivation record

A signed record that the airlock rebuilt a safetensors file from a pickle checkpoint without running the pickle, tensor by tensor, bound to the input’s attested bytes.

Shape

Envelope: An in-toto Statement v1 (https://in-toto.io/Statement/v1) in a DSSE envelope with payload type application/vnd.in-toto+json, signed with Ed25519. It verifies offline: no transparency log or certificate authority is involved.
Subject: One subject: the output, the safetensors file, by name and SHA-256. The input is named in the predicate by its hash and the attestation that let it be converted.

Predicate

converter: The program and its rules: socair airlock convert, the Socair version, the conversion rules (socair-convert/1), and the pickle grammar whose model the tensors were read from (socair-wo/1).
input: The checkpoint converted: name, SHA-256, format, how its byte order was established, and its verified attestation by document id and hash, signer key id, promotion state, check set version, the Pickle opcode scan row (PASS), and the rows it left NOT_TESTED.
output: The safetensors file: name, SHA-256 (the subject’s), format, and size.
converted_at: When the conversion ran (RFC 3339).
tensors: Every input tensor by name: its dtype in the output and in the input, shape, the input record and byte offset its bytes came from, size, the SHA-256 of those bytes, where they sit in the output, and, for an exact alias written once, the tensor that holds them.
metadata: The output’s __metadata__.
not_carried: What the output does not carry from the input: tensor types and flags such as Parameter and requires_grad, a state dict’s _metadata, memory sharing, and storage bytes no tensor views.
does_not_authorize: Fixed wording: the record binds the output’s bytes to the input’s attested bytes and does not attest the output.

Sign and verify

socair airlock convert model.pt \
  --attestation model.dsse.json --key operator.key

What the signature means

socair airlock convert is in 0.1.0-rc.4 and later.
Conversion runs only on a checkpoint whose attestation verifies against the store’s trusted keys, has no FAIL or LEAD on any row, and PASSed the Pickle opcode scan, and whose bytes, hashed again as they are copied, are the attested subject. The tensors are read from Socair’s typed model of the pickle, never by unpickling it.
The record is signed with a key in the store’s trust policy and verifies against the store’s own keys. Socair has no separate verify command for it yet.
Each tensor’s SHA-256 is over bytes that are the same in the input record and in the output, so anyone holding the input can check them without Socair.
A record is not an approval. The output is a new artifact: it is scanned, signed, and promoted on its own attestation, and nothing about the conversion authorizes it.

Where it is defined

Converting a checkpoint, and the derivation record

The other signed documents: Socair attestation, Socair acceptance, Socair reference feed, Socair inventory snapshot, Socair OCI binding.