Annex VII §4.3 · access in its offline form
Point-of-sale age estimator · runs 1 to 2 conformity evidence, in full
The plan, the commitments, the attestations and the isolation evidence, with no route to the data itself.
Read the exit reportRuns attested2
Passed1 of 2
Ledger43 entries
VerifiedYes
§05Written
Results by group
2 runs attested. Every metric with its interval, every threshold drawn against the limit the signed plan fixed, every group.
RunOutcomeIsolationTests
1Failhpc_centreaccuracy_by_group failminors_accepted_by_group faildecision_logging pass
2Passhpc_centreaccuracy_by_group passminors_accepted_by_group passdecision_logging pass
Run 1Fail
- Started
- 2026-09-28T07:22:36Z
- Ended
- 2026-09-28T07:22:45Z
- Plan digest
- sha256:553db7105fe427a45926948c8b3289c85875622121f88948e252a6fa6ba9634f
- Backend
- slurm
- Accelerator
- cpu-only (mock provider)
- Container runtime
- simulated: processes in Linux namespaces, no Apptainer, SIF, --containall, as the project account, in a network namespace with loopback only
- Temperature · seeds
- 0 · [20261101]
- Prompt digest
- sha256:85eb5be75cd348a1bf7a37ee962be628c66e9ffb76c004fbcc7692bfe0d73063
- Response schema
- sha256:4238b3e3d680a8ed0e8057d42fc1a1efac560cfbe39f00baec6a641c03948697
- Stream
- decoy fraction 0.1, metadata stripped True, repeat fraction 0.05, shuffle seed 20261101, shuffled True
- Relay log
- sha256:d65b09c5d7e1b366d208df7bd4df6c221f5776d21b11d8a48f8ed74b3cceb6d5
- Decision log
- sha256:2869fad18cbe5f9b4a721700a76da6997d2ebddc1a286ce3711416d579a42440
accuracy_by_groupFail
- Items evaluated
- 300
- Dataset
- lab-heldout-v1
- Commitment
- sha256:5d43d03b9dad51c17c667cbb8cfe371e54f1d398dc2e0d43c786bcf2b3b6733a
- mae
- 2.658 · n 300 · 95% CI 2.377–2.948 · bootstrap(2000,seed=0)
- Baseline · mae
- 15.375 · n 300 · 95% CI 13.806–16.959 · bootstrap(2000,seed=0)
ThresholdObserved against the limitValueState
mae.max_per_groupskin_tone_band=V-VI6.116≤ 4.0Breached
mae by age_band
GroupValue, and its intervalValuen · interval
14_172.236n 77 · 1.699–2.814
18_242.667n 21 · 1.529–3.919
25_392.904n 45 · 2.207–3.649
40_plus2.821n 89 · 2.328–3.358
under_142.754n 68 · 2.185–3.393
mae by sex
GroupValue, and its intervalValuen · interval
f2.709n 150 · 2.314–3.107
m2.606n 150 · 2.22–3.01
mae by skin_tone_band
GroupValue, and its intervalValuen · interval
I-II0.936n 100 · 0.822–1.056
III-IV0.921n 100 · 0.797–1.042
V-VI6.116n 100 · 5.999–6.242
minors_accepted_by_groupFail
- Items evaluated
- 300
- Dataset
- lab-heldout-v1
- Commitment
- sha256:5d43d03b9dad51c17c667cbb8cfe371e54f1d398dc2e0d43c786bcf2b3b6733a
- false_adult_rate
- 0.2 · n 145 · 95% CI 0.143–0.272 · wilson
- Notes
- skin_tone_band: I-II vs V-VI differ by 0.6591 (p=3.3e-11 < 0.017 after bonferroni); skin_tone_band: III-IV vs V-VI differ by 0.6591 (p=5.6e-13 < 0.017 after bonferroni)
ThresholdObserved against the limitValueState
max_per_groupskin_tone_band=V-VI0.659≤ 0.01Breached
max_gap_between_groupsskin_tone_band: I-II vs V-VI0.659≤ 0.005Breached
false_adult_rate by sex
GroupValue, and its intervalValuen · interval
f0.195n 77 · 0.122–0.297
m0.206n 68 · 0.127–0.316
false_adult_rate by skin_tone_band
GroupValue, and its intervalValuen · interval
I-II0.0n 45 · 0.0–0.079
III-IV0.0n 56 · 0.0–0.064
V-VI0.659n 44 · 0.511–0.781
decision_loggingPass
- Items evaluated
- 315
- log_coverage
- 1.0 · n 315 · matched relay request ids
- unmatched_request_ids
- 0.0 · n 315 · count
ThresholdObserved against the limitValueState
min_log_coverageoverall1.0≥ 1.0Held
max_unmatched_request_idsoverall0.0≤ 0.0Held
Run 2Pass
- Started
- 2026-09-28T07:22:51Z
- Ended
- 2026-09-28T07:23:00Z
- Plan digest
- sha256:d5ac2f71a0b45291e99be29be1d91e451527fa0f67d85e9c702b7ac3105a3f9e
- Backend
- slurm
- Accelerator
- cpu-only (mock provider)
- Container runtime
- simulated: processes in Linux namespaces, no Apptainer, SIF, --containall, as the project account, in a network namespace with loopback only
- Temperature · seeds
- 0 · [20261101]
- Prompt digest
- sha256:85eb5be75cd348a1bf7a37ee962be628c66e9ffb76c004fbcc7692bfe0d73063
- Response schema
- sha256:4238b3e3d680a8ed0e8057d42fc1a1efac560cfbe39f00baec6a641c03948697
- Stream
- decoy fraction 0.1, metadata stripped True, repeat fraction 0.05, shuffle seed 20261101, shuffled True
- Relay log
- sha256:ff689cb0e9c0afd93c2cee00e7b2a41a0df445f761e2082dfa3c71abf5d7f03f
- Decision log
- sha256:359bfe5cfd592329f85f6898ec6375ef9cb5cf888d2503f5048714c431e61677
accuracy_by_groupPass
- Items evaluated
- 300
- Dataset
- lab-heldout-v1
- Commitment
- sha256:5d43d03b9dad51c17c667cbb8cfe371e54f1d398dc2e0d43c786bcf2b3b6733a
- mae
- 0.922 · n 300 · 95% CI 0.854–0.99 · bootstrap(2000,seed=0)
- Baseline · mae
- 15.375 · n 300 · 95% CI 13.806–16.959 · bootstrap(2000,seed=0)
ThresholdObserved against the limitValueState
mae.max_per_groupage_band=25_391.007≤ 4.0Held
mae by age_band
GroupValue, and its intervalValuen · interval
14_170.81n 77 · 0.688–0.936
18_240.667n 21 · 0.429–0.929
25_391.007n 45 · 0.833–1.167
40_plus1.006n 89 · 0.88–1.128
under_140.96n 68 · 0.816–1.103
mae by sex
GroupValue, and its intervalValuen · interval
f0.936n 150 · 0.844–1.032
m0.907n 150 · 0.813–1.001
mae by skin_tone_band
GroupValue, and its intervalValuen · interval
I-II0.936n 100 · 0.822–1.056
III-IV0.921n 100 · 0.797–1.042
V-VI0.908n 100 · 0.797–1.019
minors_accepted_by_groupPass
- Items evaluated
- 300
- Dataset
- lab-heldout-v1
- Commitment
- sha256:5d43d03b9dad51c17c667cbb8cfe371e54f1d398dc2e0d43c786bcf2b3b6733a
- false_adult_rate
- 0.0 · n 145 · 95% CI 0.0–0.026 · wilson
ThresholdObserved against the limitValueState
max_per_groupoverall0.0≤ 0.01Held
max_gap_between_groupsoverall0.0≤ 0.005Held
false_adult_rate by sex
GroupValue, and its intervalValuen · interval
f0.0n 77 · 0.0–0.048
m0.0n 68 · 0.0–0.053
false_adult_rate by skin_tone_band
GroupValue, and its intervalValuen · interval
I-II0.0n 45 · 0.0–0.079
III-IV0.0n 56 · 0.0–0.064
V-VI0.0n 44 · 0.0–0.08
decision_loggingPass
- Items evaluated
- 315
- log_coverage
- 1.0 · n 315 · matched relay request ids
- unmatched_request_ids
- 0.0 · n 315 · count
ThresholdObserved against the limitValueState
min_log_coverageoverall1.0≥ 1.0Held
max_unmatched_request_idsoverall0.0≤ 0.0Held
§07Written
Isolation evidence
Run 1
- Type
- Enforcedhpc_centre
- Centre
- simulated-centre (histor, no Slurm, no Apptainer; model in a loopback-only netns)
- Exclusive allocation
- True
- Job record digest
- sha256:ce868b5ea663ff991a99402d13e2216c64c516dd7218905c5c9f85383b6c4375
- Node config digest
- sha256:fac8704bc528a87479c0b8e7bfd7fcc222bf17c64a2375d2fc11adb6e8166b38
- Signature
- eyJwYXlsb2FkIjogImV5SmpaVzUwY21VaU9pSnphVzExYkdGMFpXUXRZMlZ1ZEhKbElDaG9hWE4wYjNJc0lHNXZJRk5zZFhKdExDQnVieUJCY0hCMFlXbHVaWEk3SUcxdlpHVnNJR2x1SUdFZ2JHOXZjR0poWTJzdGIyNXNlU0J1WlhSdWN5a2lMQ0psZUdOc2RYTnBkbVZmWVd4c2IyTmhkR2x2YmlJNmRISjFaU3dpYW05aVgzSmxZMjl5WkY5a2FXZGxjM1FpT2lKemFHRXlOVFk2WTJVNE5qaGlOV1ZoTmpZelptWTVPVEZoT1RrME1ESmtNVE5sTWpJeE5tTTJOR00xTVRaa1pEY3lNVGc1TURWak5XTTVaamcxTXpnellqWmpORE0zTlNJc0ltNXZaR1ZmWTI5dVptbG5YMlJwWjJWemRDSTZJbk5vWVRJMU5qcG1ZV000TnpBMFltTTFNamhoT0RjME56bGpNR0k0WlRkaVptUTNabU5qTWpJeVltWXhOMk0yTkdFeU16YzFaREptWXpFeFlXUmlObVU0TVRZMllqTTRJaXdpYzJsbmJtVmtYMko1SWpvaWMyRnVaR0p2ZUY5dmNHVnlZWFJ2Y2lJc0luUjVjR1VpT2lKb2NHTmZZMlZ1ZEhKbEluMD0iLCAicGF5bG9hZFR5cGUiOiAiYXBwbGljYXRpb24vdm5kLmluLXRvdG8ranNvbiIsICJzaWduYXR1cmVzIjogW3sia2V5aWQiOiAic2FuZGJveC1vcGVyYXRvciIsICJzaWciOiAidTljV0ViMzRmbERjc2YzbDRGQ3luaEZRUGJJSmErelYvWkEzZGNpUnlZem5HYm1rWnJuVm5JbUg0ODcyeG8xTFFvaDA3ZytDazF1RUZCYjBla2d5QVE9PSJ9XX0=
- Signed by
- sandbox_operator
- Model runtime
- Second boundarysimulated: processes in Linux namespaces, no Apptainer, SIF, --containall, as the project account, in a network namespace with loopback only
- Harness signature
- Signed in segment Asha256:29477b367422ee01e5f972da69856c026b8cec0b552192bd3c7481ac7d7556a5
Run 2
- Type
- Enforcedhpc_centre
- Centre
- simulated-centre (histor, no Slurm, no Apptainer; model in a loopback-only netns)
- Exclusive allocation
- True
- Job record digest
- sha256:04e1453f0fb06603f57ed965d5d172690b7d8abda1fb5783d31025408fcdcb22
- Node config digest
- sha256:803c40838a41479d1bdc44272d8df8778094c2618b64291a65b30bb675d59dc9
- Signature
- eyJwYXlsb2FkIjogImV5SmpaVzUwY21VaU9pSnphVzExYkdGMFpXUXRZMlZ1ZEhKbElDaG9hWE4wYjNJc0lHNXZJRk5zZFhKdExDQnVieUJCY0hCMFlXbHVaWEk3SUcxdlpHVnNJR2x1SUdFZ2JHOXZjR0poWTJzdGIyNXNlU0J1WlhSdWN5a2lMQ0psZUdOc2RYTnBkbVZmWVd4c2IyTmhkR2x2YmlJNmRISjFaU3dpYW05aVgzSmxZMjl5WkY5a2FXZGxjM1FpT2lKemFHRXlOVFk2TURSbE1UUTFNMll3Wm1Jd05qWXdNMlkxTjJWa09UWTFaRFZrTVRjeU5qa3dZamRrT0dGaVpHRXhabUkxTnpnelpETXhNREkxTkRBNFptTmtZMkl5TWlJc0ltNXZaR1ZmWTI5dVptbG5YMlJwWjJWemRDSTZJbk5vWVRJMU5qbzRNRE5qTkRBNE16aGhOREUwTnpsa01XSmtZelEwTWpjeVpEaGtaamczTnpnd09UUmpNall4T0dJMk5ESTVNV0UyTldJek1HSmlOamMxWkRVNVpHTTVJaXdpYzJsbmJtVmtYMko1SWpvaWMyRnVaR0p2ZUY5dmNHVnlZWFJ2Y2lJc0luUjVjR1VpT2lKb2NHTmZZMlZ1ZEhKbEluMD0iLCAicGF5bG9hZFR5cGUiOiAiYXBwbGljYXRpb24vdm5kLmluLXRvdG8ranNvbiIsICJzaWduYXR1cmVzIjogW3sia2V5aWQiOiAic2FuZGJveC1vcGVyYXRvciIsICJzaWciOiAiRmVkSVJNcDBlUld3cmhIZW0vVEZEL0hCNURwNDFsdTl3Slg0Ri9MNTBob09RUXkzZ05VSjFwcXhSeXlBZU55SHF6YmNIWGlOeWNNaWFSWVVqTCtFRGc9PSJ9XX0=
- Signed by
- sandbox_operator
- Model runtime
- Second boundarysimulated: processes in Linux namespaces, no Apptainer, SIF, --containall, as the project account, in a network namespace with loopback only
- Harness signature
- Signed in segment Asha256:b957073558ca022a2944f4ef2b7e358044a52cc3c3e3fdb6d752e2341b94607a
§10Written · verified
Verification
The verifier checks the sealed evidence bundle: signatures, the hash chain, run numbers, plan versions, pins, commitments, isolation evidence, thresholds recomputed from the numbers, sample sizes, deletion, timestamps and the bundle digest. Run from here it is the regulator's check before signing off. It does not replace the offline run: anyone holding the bundle can repeat it with histor verify, with no network and no trust in this console.
Verification at ledger seq 43Verified
- Run by
- regulator@authority.example
- At
- 2026-09-28T07:23:04Z
- Bundle
- sha256:32509c274028b5747968f63e2b018123bdc0aa98aafd482f5575e66880235c9c
- Verifier
- 0.1.0
CheckOutcomeDetail
bundle_versionis this a bundle format this verifier knows how to check?Passbundle_version 0.3
bundle_formatis the bundle's format the one its ledger was written for?Passbundle_version 0.3, as the ledger's report_generated (seq 39) records
signing_keyswas every statement checked under a key the ledger recorded or you gave, not one read from public-keys.json alone?Passcontrol-plane (ledger seq 2), harness (ledger seq 11), scorer (ledger seq 22)
signaturesis every attestation the one the ledger recorded, signed by the control plane?Pass2 attestation(s), each the one the ledger recorded for its run, verify under the control plane's key
statement_typesis every signed statement of a type this verifier knows?Pass6 statement(s), each of a known type under https://historlabs.eu/
hash_chainis the ledger hash chain intact, with no gaps?Pass41 entries, chain intact
run_numberswas every run started once, and ended in the ledger, with no unrecorded runs?Passruns [1, 2], contiguous, each started once and ended in the ledger
plan_versionsis every plan version the ledger records present in the bundle?Pass2 version(s) — the plan was amended during the participation
plan_signatureswas the plan signed by each party, through their own identity provider?Warnthe plan was signed with keys the sandbox holds, not through the parties' identity providers: the bundle shows that the sandbox signed it, not who agreed to it
report_signaturewas the exit report signed by the regulator, through their own identity provider?Warnreport sha256:934fbb66424e… is signed through the development IdP, which issues a token for anyone: the signature identifies nobody
artifact_digestsdo the artifacts in every run match the pins of the plan it cites?Pass2 run(s) match the plan's pins
dataset_commitmentswas every dataset used committed before the run that used it?Pass1 committed
isolationis isolation evidence present and does it match the plan's policy?Warnisolation at simulated-centre (histor, no Slurm, no Apptainer; model in a loopback-only netns) (run 1, 2) vouched for by the sandbox operator: the operator's signature over the job record and node configuration its courier observed verifies, and every pinned image has a signed conversion to the SIF that ran. This rests on the sandbox operator's word: the party that runs the sandbox, vouching for its own run. That is weaker than a centre's word, and neither is a network policy anyone can hash or a drop log anyone can read. Run 1's keys were released once, to a key (digest sha256:b727f00df0c5…) held by Slurm job 4201, after that job's measured SIF digests matched the conversions, every probe from the model's namespace was blocked and that namespace held only loopback (ledger seq 21). Run 1's plan pins no encrypted weights, so the model's weights were in its image and passed through the sandbox with it. Run 2's keys were released once, to a key (digest sha256:55d42eaa881d…) held by Slurm job 4202, after that job's measured SIF digests matched the conversions, every probe from the model's namespace was blocked and that namespace held only loopback (ledger seq 35). Run 2's plan pins no encrypted weights, so the model's weights were in its image and passed through the sandbox with it. Root on the compute node could read the model while it ran; what covered that is a contract, the centre's confidentiality undertaking (demo-centre-undertaking), not cryptography.
run_logsdo the run logs in the bundle match the digests their attestations carry?Pass8 logs match their digests
harness_statementsdid the harness sign what it measured, and does the attestation agree?Pass2 run(s): the harness signed its measurements and the attestation agrees; 2 scored off the centre, from the driver's signed observations, which the scorer's statement agrees with
thresholdsdoes every stated outcome follow from the numbers reported with it?Passrecomputed and consistent
sample_sizeswere any thresholds passed on samples too small to mean anything?Passevery scored group met the plan's minimum
deletionwere keys destroyed after exit?Passkeys destroyed after exit: ['data/demo-001/lab-heldout-v1', 'signing/demo-001/harness', 'signing/demo-001/scorer', 'work/demo-001/run-1', 'work/demo-001/run-2']
completenessdoes the ledger end as a participation that has ended does?Passexit, keys destroyed, the report and the regulator's signature over it, and the report's bundle digest matches this bundle up to seq 38
timestampsare the timestamps valid, ordered, and external?Warnevery timestamp was issued by the sandbox operator's own development authority, not by a third party. The ordering is self-consistent and anchors nothing: an operator able to rebuild this ledger could reissue these timestamps with it.
tsa_revocationwas the timestamp authority's certificate unrevoked when it stamped?Warnno RFC 3161 timestamp in this ledger, so no authority certificate whose revocation could be checked: development timestamps carry none
personal_datadoes the manifest say what personal data the bundle holds?Passas the manifest says, the bundle holds personal data: staff identifiers (7, in ledger.jsonl, plan.json, plans/); idp id tokens (1, in ledger.jsonl), and no test-subject data (none of the files the export writes can carry it)
i18n_cataloguesis the catalogue each translated rendering of the report was made with in the bundle, as the ledger records it?Passthe report was rendered in English only: no catalogue to carry
report_renderingsis the exit report rendered in every language the plan names, each rendering named by hash in the authentic report?Passthe plan names no languages: one report, in English
anchorswere the trust anchors given from outside the bundle?Warnthe plan digest, the sandbox id, the timestamp authority's root, the identity providers' keys, the network policy digest, the harness image digest, the statement signing keys, the audience the parties' IdP logins were for, the ledger head came from the bundle itself: the checks against them show that the bundle agrees with itself, not that it is the one you signed. An operator who rebuilt it could have replaced them all consistently. Pass them from outside, with --anchors or the --expect-* options.
bundle_digestdoes the bundle match the digest in its own manifest?Passsha256:32509c274028b5747968f63e2b018123bdc0aa98aafd482f5575e66880235c9c
plan_signatures: the plan was signed with keys the sandbox holds, not through the parties' identity providers: the bundle shows that the sandbox signed it, not who agreed to it
report_signature: report sha256:934fbb66424e… is signed through the development IdP, which issues a token for anyone: the signature identifies nobody
isolation: isolation at simulated-centre (histor, no Slurm, no Apptainer; model in a loopback-only netns) (run 1, 2) vouched for by the sandbox operator: the operator's signature over the job record and node configuration its courier observed verifies, and every pinned image has a signed conversion to the SIF that ran. This rests on the sandbox operator's word: the party that runs the sandbox, vouching for its own run. That is weaker than a centre's word, and neither is a network policy anyone can hash or a drop log anyone can read. Run 1's keys were released once, to a key (digest sha256:b727f00df0c5…) held by Slurm job 4201, after that job's measured SIF digests matched the conversions, every probe from the model's namespace was blocked and that namespace held only loopback (ledger seq 21). Run 1's plan pins no encrypted weights, so the model's weights were in its image and passed through the sandbox with it. Run 2's keys were released once, to a key (digest sha256:55d42eaa881d…) held by Slurm job 4202, after that job's measured SIF digests matched the conversions, every probe from the model's namespace was blocked and that namespace held only loopback (ledger seq 35). Run 2's plan pins no encrypted weights, so the model's weights were in its image and passed through the sandbox with it. Root on the compute node could read the model while it ran; what covered that is a contract, the centre's confidentiality undertaking (demo-centre-undertaking), not cryptography.
timestamps: every timestamp was issued by the sandbox operator's own development authority, not by a third party. The ordering is self-consistent and anchors nothing: an operator able to rebuild this ledger could reissue these timestamps with it.
tsa_revocation: no RFC 3161 timestamp in this ledger, so no authority certificate whose revocation could be checked: development timestamps carry none
anchors: the plan digest, the sandbox id, the timestamp authority's root, the identity providers' keys, the network policy digest, the harness image digest, the statement signing keys, the audience the parties' IdP logins were for, the ledger head came from the bundle itself: the checks against them show that the bundle agrees with itself, not that it is the one you signed. An operator who rebuilt it could have replaced them all consistently. Pass them from outside, with --anchors or the --expect-* options.
Download the evidence bundle and check it yourself: uv run histor verify <bundle>. It needs no network, no data and no trust in the sandbox operator.
Download the evidence bundle (.tar.gz)Download the verifier's output (.json)
Ledger · latest 8, newest first43 entries
SeqRecorded (UTC)EntryWho actedWhat it says
432026-09-28
07:23:04.203Zbundle_verifiedregulator@authority.exampleRegulatorbundle verified
07:23:04.203Zbundle_verifiedregulator@authority.exampleRegulatorbundle verified
422026-09-28
07:23:04.165Zgate_decisionregulator@authority.exampleRegulatorVerify bundle allowed
07:23:04.165Zgate_decisionregulator@authority.exampleRegulatorVerify bundle allowed
412026-09-28
07:23:04.086Zreport_signatureregulator@authority.exampleRegulatorreport signature
07:23:04.086Zreport_signatureregulator@authority.exampleRegulatorreport signature
402026-09-28
07:23:04.084Zgate_decisionregulator@authority.exampleRegulatorSign report allowed
07:23:04.084Zgate_decisionregulator@authority.exampleRegulatorSign report allowed
392026-09-28
07:23:04.077Zreport_generatedregulator@authority.exampleRegulatorExit report generated
07:23:04.077Zreport_generatedregulator@authority.exampleRegulatorExit report generated
382026-09-28
07:23:03.997Zkeys_destroyedKey brokerSystem · no person actedData keys destroyed
07:23:03.997Zkeys_destroyedKey brokerSystem · no person actedData keys destroyed
372026-09-28
07:23:03.991Zgate_decisionregulator@authority.exampleRegulatorExit allowed
07:23:03.991Zgate_decisionregulator@authority.exampleRegulatorExit allowed
362026-09-28
07:23:03.987Zrun_attestationHarnessSystem · no person actedRun 2 attested — pass
07:23:03.987Zrun_attestationHarnessSystem · no person actedRun 2 attested — pass
All 43 entries, filterable, in the audit log