---

title: A11oy Factory emoji: ⚖️ colorFrom: yellow colorTo: gray sdk: docker app_port: 7860 pinned: false license: apache-2.0 suggested_hardware: cpu-basic short_description: Governed AI distribution with verifiable proof.

A11oy Factory

A11oy Factory is the governed distribution layer for open-source AI software. It compiles exact upstream artifacts, target constraints, policy, evidence, and dependency relationships into a deterministic distribution bundle.

This is not another model host, container wrapper, or second flagship. It is the trusted factory between frameworks/models and the CPU, CUDA, XPU, ROCm, Arm, cloud, edge, and future A11oy/KHIPU hardware that runs them.

Factory Core v1 — LIVE

The core now performs real, fail-closed work:

• validates catalog and target-profile contracts;
• resolves dependency closure deterministically and detects cycles;
• enforces immutable source pins, source-host allowlists, license policy, evidence requirements, target compatibility, size limits, and network policy;
• emits a content-addressed lock and non-executing build plan;
• emits an SPDX 2.3 SBOM;
• emits an in-toto Statement with SLSA v1 provenance;
• emits an A11oy hash-chained receipt and SHA-256 manifest;
• re-resolves and verifies the whole bundle;
• can explicitly materialize digest-pinned artifacts with streamed SHA-256, byte-count enforcement, atomic rename, and no execution.

The compiler is LIVE. A generated bundle states runtime_certified: false until hardware execution, current vulnerability evidence, compatibility testing, and a real cryptographic signer are attached. Unknown input or missing proof fails closed.

python -m a11oy_factory distro validate \
  --catalog factory/catalog.json \
  --profile factory/profiles/vllm-cpu-amd64.json

python -m a11oy_factory distro bundle \
  --catalog factory/catalog.json \
  --profile factory/profiles/vllm-cpu-amd64.json \
  --out-dir dist/vllm-cpu-amd64

python -m a11oy_factory distro verify \
  --catalog factory/catalog.json \
  --profile factory/profiles/vllm-cpu-amd64.json \
  --lock dist/vllm-cpu-amd64/factory.lock.json \
  --sbom dist/vllm-cpu-amd64/factory.spdx.json \
  --provenance dist/vllm-cpu-amd64/factory.provenance.json

The initial checked-in catalog is a real upstream release snapshot:

Candidate profiles preserve vulnerability state as UNVERIFIED; integrity proof is not misrepresented as a vulnerability scan or runtime certificate. See factory/README.md.

Surfaces

Decision Cell Compiler

The existing Decision Cell Compiler remains fail closed. Lyte is the one admitted structural cell. N1–N27 are named theatres and do not become runtime LIVE because the distribution compiler can describe them.

python -m a11oy_factory compile --cell lyte
python -m a11oy_factory compile --cell N1
python -m a11oy_factory roadmap
python -m a11oy_factory act --cell N22 --payload '{"agent":"counsel"}'
python -m a11oy_factory search --q vllm

Proof boundary

Formulas never grant authority. Metadata integrity is not runtime safety. UNSIGNED-honest is not Cosign, Fulcio, Rekor, or an ATO.

Source quality gate

The always-on pull-request gate installs exactly package-lock.json with npm ci, runs npm test, starts the real local Vite server, checks the live /__app-env contract with npm run check:auth, and then typechecks the application and executes its production build. A stale lockfile is a hard failure; CI never falls back to a mutable install.

npm test is the clean-clone contract. It runs the checked-in, autonomous Node and TypeScript suites that do not depend on the app-builder authoring environment, including the auth-invariant and environment-wrapper units. The Python gate separately runs the provider-publisher and Factory suites. npm run test:template deliberately exposes the broader template suite. That suite expects generated public/__grok assets, .grok/skills/og documentation, the shipped .grok/app-env.json, and symlink privileges. It is therefore an authoring-environment check, not a clean-clone success claim; its failures must be repaired or reported, never relabeled as a passing CI gate.

Hugging Face publication boundary

Merging main does not publish the Space. Publication is an explicit workflow_dispatch operation in hf-sync.yml and requires the exact lowercase 40-character SHA of the current main commit. The workflow checks out that commit, fetches current origin/main, and fails closed unless all three SHAs agree. The publisher repeats the Git HEAD/current-main comparison immediately before upload, embeds the SHA in the Hugging Face commit message, and generates a deterministic provenance record that the rebuilt runtime must expose from /healthz. Deployment verification fails until that runtime SHA and a final current-main readback agree. Provider commits are compare-and-swapped against the observed prior Space revision and delete stale files so publication is an exact mirror rather than an accumulating overlay.

The workflow reads only the uniquely named HF_FACTORY_PRODUCTION_TOKEN secret from the hugging-face-production GitHub environment. That environment must exist, restrict deployment to main, and require an explicit operator review; a missing or unprotected environment is a release blocker. In a solo build, that review is an operator authorization and is not mislabeled independent approval. A successful source PR or merge is not deployment proof; the workflow separately verifies the resulting Space and uploads the runtime evidence artifact. A blocked verification writes a sanitized failure receipt, and the workflow retains that receipt even though the verification step exits nonzero.