Schemen Gate

AI PKI: bind workload identity to the AI resource or operation it may use.

Schemen Gate carries verifier-trusted identity and signed, scoped authority to an AI execution boundary. It supplies the cryptographic contracts and Gates used to admit a model operation, release an encrypted shard or retrieval result, or select a declared activation partition—and retain evidence of the decision.

trusted identity → signed grant → authorized Regime → Gate → execution evidence

For technical evaluation, start with the research evidence map: executable controls, machine-readable experiment results, real-model studies, and their exact claim boundaries. The core library, original CDP experiments, and later Transformer lane study have separate scopes and acceptance criteria.

Hydra (Transformer regime lanes) and the training/adaptation protocols are experimental and not production-ready. Their controlled experiments validate working approaches within stated conditions, not provider deployment readiness. See Hydra's research status and training boundaries. The core package's stability classification does not extend production support to these research surfaces.

A Regime is the execution scope resolved from verified authority. It can select a model capability, attachment, data partition, or declared activation support. A caller-supplied Regime number or mask does not authenticate itself.

One request. A verifiable pause. One authorized call.

The optional credential broker carries authenticated bindings from an agent's exact proposal through owner or delegated approval, a signed callback, and one-use execution. The Gate checks the actual operation before the broker consumes the authorization and acquires a per-call credential.

View the display kit and editable diagrams · Resource-owner adoption guide · Protocol and integration contract

Delegation bindings and the resource enforcement boundary

The broker is separately installed; no Substrate is required. The signed flow and Calendar custody path are locally tested with simulated provider transport. Live Google acceptance awaits account configuration. Native resource-side enforcement is an adoption proposal, not a claim of current Google support. Destruction covers owned per-call custody, not upstream token revocation.

Gate and Runtime

Gate is the open-source enforcement library. Schemen Runtime is a separate, closed-source serving product. Runtime consumes Gate contracts at authenticated inference endpoints and supplies model loading, request enforcement, and governed execution. The two projects have distinct release identities and deployment responsibilities.

Use Gate to embed these controls in your own application. Use the separate Runtime when you need Schemen's closed-source serving implementation; contact Sekos AI for Runtime evaluation. Runtime is not bundled in the Gate wheel, and no companion service is needed to install Gate or run its examples.

Two minutes to working AI PKI

From a clean clone:

git clone https://github.com/sekosai/schemen-gate.git
cd schemen-gate
python3 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install -e '.[lockbox]'
python examples/ai_pki_quickstart.py

Expected output includes:

PASS: certificate -> signed grant -> resolved Regime -> Gate
PASS: wrong trust root denied before Gate
PASS: wrong recipient certificate denied before Gate

The example creates ephemeral local credentials, verifies an independently configured authority root and exact signed grant membership, checks the recipient certificate, unwraps its Regime key, and applies the authenticated mask. It also exercises wrong-root and wrong-recipient denials. It uses an explicit offline-fixture revocation policy; production requirements are in the deployment contract.

For the NumPy-only algebra, run python examples/quickstart.py. For portable credential loading and signing, run python examples/pkcs12_identity.py.

For a reusable PyTorch module and a C++ LibTorch execution API, see PyTorch, C++, and CUDA integration. The primitive uses ATen CPU/CUDA selection and autograd on an already-authorized mask.

Performance

Applying an already-authorized Gate visits each activation coordinate once: for M activation vectors of width d, execution is $\Theta(Md)$. The two dense projections around a gated Transformer FFN require $\Theta(Md_{in}d)$ and $\Theta(Mdd_{out})$ multiply-accumulates. When those widths scale together, the projection work is quadratic in d; the Gate does not add another matrix multiplication. The current fail-closed implementation uses selection, where(mask, hidden, +0), so excluded NaN and infinity become positive zero.

Placement also changes the system boundary. An output-control pipeline that runs full inference, classifies the result, and then withholds or sequesters it has already allowed the governed computation to reach an output. An internal Gate can deny the excluded activation path before the following projection and before an output exists. That can avoid a post-inference containment stage for the same authority decision, although the component timings below do not count those system-level savings. An unfused dense projection also retains its nominal compute cost; folding, extraction, structured sparse execution, or fusion is needed to turn excluded coordinates into projection savings.

A checked-in single-threaded NumPy component run measured the public GateMask.apply API against one reused float64 square projection on the same arm64 CPU:

Width d	Gate median	Square projection median	Gate / projection
768	1.50 us	7.17 us	20.95%
4,096	3.17 us	1.415 ms	0.224%
12,288	7.76 us	11.806 ms	0.066%

The 768-dimensional result is a useful warning: operation-count ratios do not predict latency for small calls, where Python, dispatch, allocation, and memory traffic matter. These numbers cover forward-only NumPy execution after authorization; they are not PyTorch, C++, CUDA, backward-pass, PKI, or end-to-end inference measurements. See the performance evidence and boundaries for the exact command, machine-readable receipt, model-level results, historical claims, and experimental Hydra measurements.

See the authority change

Open the live digit-model demo. Select the digit-7 input and recognize it before and after granting capability 7. The same pixels become recognizable when the granted detector may execute; the shared detector rows stay unchanged.

The demo also exposes malformed-authority cases and signed evidence with model call counts. Its anonymous public-caller case demonstrates deliberate public access. Each record identifies the deployed Gate source commit: compare that identity with the release you are evaluating. The demo is a bounded co-trained MNIST fixture, not evidence of complete model privacy.

Follow the demo walkthrough.

Choose a starting point

Your task	Gate surface	Start here
Authorize an existing model or protected operation	Scoped capabilities and exact-operation gates	API guide, operator boundary
Release encrypted model shards	Signed lockboxes and recipient-specific grants	Executable shard fixture
Release context or vectors	Cargo manifests, material-bound receipts, and gated retrieval	Cargo contract, API guide
Store a provider credential and broker permitted HTTP calls	Optional, separately installed credential broker	Broker service
Gate a NumPy or PyTorch activation	Immutable GateMask	First Gate, API reference
Train with declared private support	Gate placement, frozen shared state, and aligned updates	Training and model boundaries

The core activation operation is deliberately small:

gated = authorized_gate_mask.apply(hidden)

Excluded coordinates become positive zero even for NaN/Inf input. Active values are preserved. Its value depends on the authority that selects the mask, its placement, and the state governed by it. Applying a mask after ordinary training does not retroactively create tenant-private knowledge.

Identity and security boundary

The authority path connects external AuthN (verify identity against an independent root), boundary AuthZ (verify the exact signed scope), and downstream Regime AuthN (carry the resolved execution identity to subsequent Gates that verify the same bindings).

• The verifier owns trust. Gate has no built-in CA store or preferred issuer. The operator supplies approved root fingerprints; a credential or bundle cannot nominate its own root as trusted.
• The operator controls revocation egress. Gate does not ship a network fetcher. This describes the library's certificate-revocation path; the separately installed credential broker has its own explicit HTTP-provider boundary. Production revocation checks require an operator-supplied fetcher that enforces DNS, redirect, TLS, timeout, and response-size policy; see the identity guide.
• The contract names the scope. Bind the subject, model, operation, Regime, lifetime, policy context, and release identity. A grant must be an exact member of its authority-signed lockbox.
• Denial precedes protected execution. The embedding application must close alternate routes to the same resource and provide the required durable replay and usage controls.
• Key custody is explicit. Pkcs12KeyProvider loads the signing key into process memory. Hardware-backed custody requires an appropriate native KeyProvider and separate platform evidence.
• Public access is an authority choice. GateMask.public(n_dims) represents an all-ones policy. Trusted policy must select it; the mask alone does not authenticate that choice. See public-for-all policy.

The security claims map distinguishes local Lean theorems, standard cryptographic assumptions, observed implementation behavior, and deployment obligations. Local activation zeros and modeled aligned updates do not establish complete-model privacy, statistical independence, host integrity, or universal bypass closure.

Before real traffic, follow the production deployment contract and exercise its denials at the actual serving boundary. The X.509 profile defines supported certificate semantics; the claim-to-test matrix locates executable evidence.

Install version 1.0.3

Version 1.0.3 is the production-ready release candidate for the documented library boundary. The source quickstart above is available now. Package-index publication and downloadable release artifacts are separate release steps; verify their availability and provenance before installing by package name.

The core requires Python 3.10 or newer and NumPy. Signed grants use the lockbox extra; other optional capabilities include crypto, torch, onnx, rag, and spiffe. See the dependency map.

For a reviewed wheel such as schemen_gate-1.0.3-py3-none-any.whl, follow the installation and verification guide. It covers the locked build, exact source identity, archive verification, and GitHub artifact attestations. Match the complete source commit as well as the version number.

The wheel contains the Gate library. The source distribution also includes operational documentation, examples, tests, and release tools. Papers, proofs, and research receipts remain in this Git repository at the corresponding revision. Historical receipts retain the versions under which they were made.

The optional credential broker is a separate Python 3.11+ package in this repository. It is excluded from the Gate wheel and source distribution, and adds no dependencies or server entry point to a core installation. It provides encrypted credential custody and connection/route authorization, plus an optional one-off Calendar path that binds exact-call Gate AAD, consumes authority once, and destroys per-call credential custody. Install the service and its Gate extra explicitly for that path.

Training is a lifecycle choice

Choose the protocol that matches the state you intend to govern:

• Co-training with per-sample masks permits updates to a shared encoder.
• Strict private FFN training requires a frozen shared backbone, correctly placed activation Gates, and support-aligned updates including optimizer moments and weight decay.
• Private adapters or experts preserve per-Regime capacity at additional storage cost.

The training guide retains the runnable patterns, dimension rules, public-adaptation caveats, and attention/residual/cache boundaries. GateMask.apply does not install model hooks or supply a masked optimizer.

Papers and evidence

The research bundle contains the papers, Lean sources, experiment code, launchers, and retained receipts. Begin with:

• Binary Activation core paper and source.
• Transformer boundary paper and source.
• Full manuscript and source.
• Multi-Tenant LoRA: Attention Is All You Bleed (May 2026 manuscript), with its publication record.
• Schemen-gated Transformer regime-lane paper and its results, failures, and corrections.

The proof and experiment claims apply to their named constructions. A proof of the local Gate algebra is not a proof of arbitrary Python execution or a particular deployment. The regime-lane study is a separate bounded empirical result: it does not amend the claims of the original CDP manuscript or establish universal or production-grade Transformer isolation.

Run a remote example

The optional Modal CPU canary runs the certificate-to-Gate example and its denials against an exact tracked source export:

./scripts/modal.sh setup
./scripts/modal.sh canary

Modal handles signup and credentials through its own flow. This canary checks remote packaging and execution; it does not establish production bypass closure. See examples for setup and the separate, explicitly confirmed persistent-deployment command. GPU research runs have their own recertification procedure.

Development

python3 -m venv .venv
source .venv/bin/activate
python -m pip install -e '.[crypto,lockbox,onnx,rag,spiffe,torch,dev]'
python -m pytest -q
python scripts/bootstrap_build_env.py
python scripts/release_check.py

The release check covers lint, formatting, strict typing, tests, research validation, Lean, tracked-source builds, archive verification, and clean-wheel quickstarts. The deterministic suite does not download an embedding model. The optional real-encoder test and bootstrap-history rules are documented in CONTRIBUTING.md and the installation guide.

Documentation and support

Topic	Documentation
Request flow and product boundary	Architecture, operator responsibilities
APIs and compatibility	Usage guide, 1.x stability contract
Security and maintenance	Security policy, engineering controls, fail-closed defaults
Release custody	Provenance, attestations
Direction and contribution	Roadmap, contributing, adoption guide

Report suspected vulnerabilities through SECURITY.md. For integration inquiries, contact Sekos AI.

License and patent notice

The Gate library, examples, tests, build and deployment scripts, and Lean proof source use Apache License 2.0. Authored papers, explanatory research prose, figures, and designated results use CC BY 4.0 under the research path map.

A U.S. provisional patent application was filed before release for subject matter related to portions of Schemen Gate. This notice adds no separate restriction. Apache-2.0's patent license and termination terms apply within their defined scope; CC BY 4.0 does not grant patent rights. See the licensing policy for the adopted terms and scope.