Zero raw text exfiltration

Know whether a training-data change is safebefore you spend GPU money.

SignalLedger is the local-first MLOps governance layer for training-data changes: risk, readiness, compliance evidence, and no-payload proof before the model trains or ships. It runs as a Dockerized GitHub Action and CLI — no SaaS account, no raw datasets, prompts, embeddings, or weights ever leave your environment.

bash
# Install the source-available alpha (git tag)
python3 -m pip install \
  "ecl-trainer @ git+https://github.com/Intelligent-Context-AI-Inc/signalledger.git@v0.1.0-alpha.4"

# Local-only, no SaaS account required
ecl-trainer scan --changed-only
ecl-trainer verify-log --ledger-path .ecl-trainer/events.jsonl
ecl-trainer passport --ledger-path .ecl-trainer/events.jsonl

Try the alpha in 5 minutes

  1. 1.Add the GitHub Action.
  2. 2.Open a PR that changes training metadata.
  3. 3.Inspect risk-report.md, compliance-passport.md, verification.json, pr-comment.md, and events.jsonl.
  4. 4.Add a payload-like field and watch the no-payload gate fail closed.
Why teams use it

Pain, feature, and outcome — before the deep architecture

Every risky training-data change gets caught, evidenced, and gated without exposing raw payloads.

PainTraining runs fail or regress and teams don't know which data change caused it.
FeatureMetadata-only PR risk report and Atlas-backed structural checks.
OutcomeCatch risky dataset/curriculum changes before expensive training.
PainGovernance evidence is assembled manually after the fact.
FeatureCompliance passport, hash-chain verification, append-only ledger.
OutcomeAudit-ready evidence from every CI run.
PainSecurity teams don't want raw datasets, prompts, embeddings, or weights sent to vendors.
FeatureStrict No-Payload Policy and local-only execution.
OutcomeGovernance without raw payload exposure.
PainModel/catalog metadata is incomplete or inconsistent.
FeatureMLOps Governance Pack and catalog drift snapshot.
OutcomeClear pass, watch, review_recommended, or block readiness signal.
PainDevelopers don't want to adopt another platform.
FeatureDockerized GitHub Action and CLI.
OutcomeFirst useful PR shield in minutes, no SaaS account required.
PainRelease gates are hard to explain.
Featureblock_on_release_risk policy.
OutcomeCI can block only hard release-readiness failures.
Source-available alpha metrics

Engineered for scale. Validated by the community. No SaaS overhead.

3–5Runs
Ablation cycles bypassedPre-seeded Data Atlas gives a Day One curriculum layout.
>50,000/sec
Metadata extraction throughputZero performance friction on active training clusters.
<45sec
Local PR comment latencyDockerized scan runs async inside your CI pipeline.
0.00%
Raw payload leakage toleranceBoundary guard blocks every token and weight from exiting.
1Click
Compliance passport exportAudit-ready artifact in one second vs. weeks of bookkeeping.
The blind spot

The blind spot in modern LLM development.

You spend weeks filtering web data, curating SFT pairs, and configuring synthetic pipelines. You kick off a massive training run. Weeks later, your model's financial reasoning or compliance accuracy drops by 8%.

The bottleneck isn't the code; it's the memory. Traditional tools show you hardware metrics and raw loss curves, but they treat your data like a black box flat file. You are left running expensive, repetitive data ablation cycles or guessing which specific dataset mix, synthetic cluster, or shifting alignment policy caused the regression.

As AI transparency obligations phase in—including California AB 2013 training-data transparency requirements effective January 1, 2026, and EU AI Act obligations applying across 2025–2026 phases—teams need reproducible evidence of training-data lineage and governance.

Core pillars

The missing link between Data Lineage and Model Behavior.

ecl-trainer is the first developer tool that bridges the gap between what your model eats and how it performs. It hooks seamlessly into your training and testing stacks, creating an immutable, append-only memory of your data supply chain.

Strict No-Payload Policy

We never ingest, read, or upload your raw training text or model weights. The SDK hashes and strips everything locally. Default execution is local-only: no SaaS account, API key, dataset upload, raw payload, prompt, embedding, token sequence, model weight, or raw diff is required or transmitted. Optional enterprise/VPC integrations can consume signed local artifacts under customer control.

Pre-Seeded Intelligence (The Data Atlas)

Skip the first 3 to 5 blind ablation runs. The ledger launches pre-seeded with structural metadata footprints derived from millions of dollars of public open-science training trajectories (FineWeb-Edu, Dolma, DCLM), giving you an optimized starting recipe on Day One.

Closed-Loop Attribution

We link data history directly to your downstream evaluation framework scores (Braintrust, Galileo, custom suites). The ledger automatically isolates which dataset properties correlate with capability improvements or regressions.

Current tools vs ECL

A local, metadata-only pre-flight shield before training starts.

A single GitHub PR produces a training-data risk report, compliance passport, hash-chain verification, PR comment body, and append-only ledger — locally. No SaaS account. No dataset upload. No raw payload in the audit trail.

What changed in the PR?
Now:Git diff, code owners, manual review
ECL:Metadata-only changed-file scanner, no raw diff capture
Are secrets present?
Now:Secret scanners
ECL:Secret scanners plus No-Payload validation before reports and ledger append
Is training metadata risky?
Now:Manual dataset-card review
ECL:Atlas-backed risk flags from hashes, tags, lineage IDs, benchmark aliases, and distributions
Can compliance review the run?
Now:Hand-written notes
ECL:Local compliance passport generated from the ledger
Can the artifact be verified later?
Now:Static CI artifact
ECL:Hash-chained append-only ledger plus verification.json
Does the vendor need data access?
Now:Often yes for hosted tooling
ECL:No SaaS account and no upload required
Before ECL

A training-data PR looked like a diff and a reviewer checklist. Risk lived in someone's head, and proof was a hand-written note stapled to a static CI artifact.

After ECL

The PR becomes a local, cryptographically verifiable training-data risk event. One CI run produces the risk report, compliance passport, verification file, PR comment, supply-chain evidence, and append-only ledger. Reviewers get an actionable signal before GPUs spin up; security teams get proof that no raw payload crossed into the vendor path.

The engine

Multi-Industry Sovereignty with Cross-Domain Intelligence.

The ecl-trainer architecture splits the difference between localized domain specificity and universal machine learning mechanics. It runs a dual-layer intelligence substrate that secures your pipeline.

The Global Core Ledger

Always On

Tracks universal token-level failure mechanics, loss-spike signatures, structural deduplication markers, and lineage feedback-loop metrics aggregated across 20 distinct industries. If a structural failure vector is discovered in a high-entropy medical corpus, ECL surfaces the cross-domain structural risk signal for your financial model.

Flexible Domain Toggles

User-Controlled

Activate or deactivate industry-specific compliance layers at will. Launching with Domain #1: Financial Services, the system instantly configures your workspace to validate against:

  • SEC EDGAR & XBRL structural taxonomy boundaries.
  • FINRA regulatory compliance documentation requirements.
  • Federal Reserve 2026 Stress Test macro-scenario structural metadata mapping.
How it works

Shift compliance and data safety left. Automatically.

We wanted the PR experience to feel boring in the best possible way: open a GitHub pull request, and get a training-data risk report without creating a SaaS account, uploading a dataset, or exposing a single raw payload line. So we put the whole thing in Docker. The container builds directly from your repo, embeds a high-performance local DuckDB seed index, runs the data plane scanner inside the checked-out workspace, and emits only local artifacts.

Git Commit / Dataset Push
GitHub Action (Docker)
Local Policy & Risk Check
PR Comment Shield

1Run the CLI on changed files

No polished init flow required. The public alpha runs local-only from the CLI or GitHub Action, scanning changed metadata and writing local evidence.

bash
# Local-only, no SaaS account required
ecl-trainer scan --changed-only
ecl-trainer verify-log --ledger-path .ecl-trainer/events.jsonl
ecl-trainer passport --ledger-path .ecl-trainer/events.jsonl

2Zero-SaaS Local Execution

The scanner runs completely local-only inside your CI pipeline. It doesn't execute untrusted repository code. It handles real-world CI wrinkles out of the box—like Git safe.directory host/container ownership conflicts—using automated boundary overrides.

It generates raw, machine-verifiable artifacts directly inside your local workspace:

tree
.ecl-trainer/
├── events.jsonl
└── reports/
    ├── risk-report.md
    ├── compliance-passport.md
    ├── verification.json
    ├── pr-comment.md
    ├── mlops-governance-pack.md
    ├── mlops-governance-pack.json
    ├── catalog-drift-snapshot.json
    └── manifest.json
Public proof-point snippets

What the SDK records (and what it leaves behind).

These are sanitized examples showing the shape of the local artifacts — without exposing private Atlas rows or raw training data. No dataset rows. No raw diffs. No prompts. No embeddings. No model weights. Just metadata, hashes, policy assertions, and enough evidence for a reviewer to make an executive decision.

markdown
### Local Evidence
- SaaS account:        not required
- Dataset upload:      not performed
- Payload policy:      passed
- Ledger verification: valid
- Supply-chain evidence: generated

### Intelligent Context Atlas
- Oracle status:     completed
- Active seeded domain: financial_services
- Atlas source records: 65
- Atlas registered domains: 20
Quickstart

Add the GitHub PR shield to your repo in 5 minutes.

No SaaS account. No dataset upload. No raw payload. Just a Dockerized GitHub Action that writes local evidence and compliance metrics into every PR.

1Add the workflow

.github/workflows/ecl-trainer.yml

yaml
name: ECL Trainer PR Shield

on:
  pull_request:
    paths:
      - "configs/**"
      - "data/**"
      - "datasets/**"
      - "schemas/**"
      - "training/**"
      - "finetune/**"
      - "recipes/**"
      - "model_card.md"
      - "dataset_card.md"
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write
  issues: write

jobs:
  ecl-trainer:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - uses: Intelligent-Context-AI-Inc/signalledger/.github/actions/ecl-trainer-scan@v0.1.0-alpha.4
        with:
          project_namespace: ${{ github.repository }}
          ledger_path: .ecl-trainer/events.jsonl
          risk_policy: block_on_payload_violation
          domain_selection_mode: explicit
          enabled_domains: financial_services
          changed_only: "true"
          post_pr_comment: "true"

2Choose your policy mode

report_onlyAlways report metadata changes, never interrupt pipeline runs.
warnFlag structural anomalies, contamination risks, or lineage feedback-loop patterns without halting execution.
block_on_high_riskFail the PR check if data mixtures match known failure models or loss-spike signatures.
block_on_payload_violationDrop the build if the outbound validator catches raw text or unhashed embeddings crossing the boundary.

3What happens on every PR

flow
Pull request opened
        ↓
Dockerized ECL Trainer scan
        ↓
No-payload validator
        ↓
Local risk report + compliance passport
        ↓
PR comment + GitHub artifact bundle

4No account required

SaaS account not required
Dataset upload not performed
Raw payload blocked before output
Ledger generated locally
Passport generated locally

Try it on a real PR

Copy one workflow into .github/workflows/ecl-trainer.yml, open a PR that changes training metadata, and inspect the local artifacts under .ecl-trainer/reports/. Start in report_only. Graduate to block_on_payload_violation once the team is comfortable with the signal.

No login required for the PR shield No dataset upload No raw text leaves your runner
Interactive first-run demo

See it fail closed before you trust it.

The fastest way to believe the product: clone the demo repo, open two PRs, and watch the same local pipeline pass a metadata-only change and reject a payload-like one — all without a SaaS account, dataset upload, or raw text leaving your runner.

PR #1 — Safe manifest

safe-manifest.json

Metadata-only change passes the No-Payload Policy. ECL posts a report_only PR comment and uploads the local artifacts.

  • Risk report + compliance passport generated
  • Ledger event appended to events.jsonl
  • verification.json confirms a valid hash chain

PR #2 — Payload-like field

bad-manifest.payload-demo.json

A deliberately unsafe key trips the outbound validator. ECL raises PayloadExfiltrationException and fails closed before writing to the ledger.

  • No ledger append — the chain stays clean
  • No raw payload, prompts, or weights recorded
  • PR check blocks with an actionable remediation list
"We opened a PR with only metadata. ECL generated a risk report, compliance passport, PR comment, verification file, and append-only ledger without a SaaS account. Then we opened a second PR with a payload-like metadata field; ECL failed closed before writing to the ledger."
Security review proof

The No-Payload Policy validates every output before it is written.

The Dockerized action runs inside your CI workspace. It reads safe metadata files, validates them against the local Atlas, writes local reports, appends a ledger event, and verifies the hash chain. It never crosses these lines:

Blocked from every artifact

  • Raw training text
  • Prompts & completions
  • Embeddings
  • Token sequences
  • Model weights
  • Raw diffs
  • Dataset rows
  • Secrets

What the action never does

  • Execute repository code
  • Load or inspect raw datasets
  • Send metadata to an ECL SaaS backend
  • Require customer credentials
How we protect IP

Public runtime, private intelligence.

The runtime you install is source-available and runs local-only. The proprietary intelligence that makes the signals sharp stays private.

Public runtime

  • CLI
  • GitHub Action
  • No-Payload validator
  • Local ledger
  • Reports
  • Public / synthetic Atlas scaffolding

Private intelligence

  • Curated Atlas packs
  • Scoring weights
  • Private source update logic
  • Customer overlays
  • Fabric bridge
Commercial paths

Start free locally. Scale into governance.

The local PR shield and learning ledger are available in the source-available alpha. Paid tiers add private Atlas packs, enterprise review workflows, and deployment support.

Source-available alpha

Pre-Flight Shield

Local Dockerized GitHub Action. Metadata-only risk reports and PR comments on every training-data PR.

Source-available alpha

Local Learning Ledger

Append-only, hash-chained ledger with compliance passports and verification.json — all generated locally.

Team

Private Atlas Packs

Curated, domain-specific structural metadata packs (starting with Financial Services) for higher-conviction risk flags.

Team

Fabric Admission Bridge

Gate training-data promotion on ledger signals, wiring ECL verdicts into your data fabric admission controls.

Enterprise

Enterprise Audit Bundle

Regulator-ready passport exports, retention policy, and evidence packaging for the EU AI Act and AB 2013.

Enterprise

Air-gapped VPC Tier

Compiled core ledger engine and full data Atlas in obfuscated local binaries that call home to nowhere.

Build models that remember.Protect your training data supply chain.

The GA alpha path is no-account and local. Drop the GitHub Action into any training repo, deploy the PR shield inside your workflow, and generate compliance-support evidence with zero infrastructure overhead.

No account required No dataset upload No raw text leaves your network

Looking for Enterprise Sovereignty?

For systemic financial entities, central banks, and institutional AI teams requiring total network isolation, defense-grade data sovereignty, or completely offline execution, deploy our Air-gapped Enterprise VPC Tier. It packages our entire multi-industry data atlas and compiled core ledger reasoning engine into highly optimized, obfuscated local binaries that interface with local PostgreSQL/TimescaleDB environments, calling home to absolutely nowhere.

Request Air-gapped VPC Technical Blueprint