What it does
SignalLedger sits in front of a training run the way a linter sits in front of a build. It scans changed dataset files and their descriptors for structural risk — missing licenses, absent provenance, benchmark contamination signals, broken lineage — and fails the check before compute is committed.
It operates under a no-payload policy: the scan reasons over structure, hashes, and metadata rather than shipping raw training content anywhere. Results are chained by hash so a passing scan can be re-verified later.
The natural home for it is CI, running with --changed-only so each pull request is judged on what it actually touched.
Who it’s for
ML and data platform teams who need an auditable gate on training-data changes.
What you need
- ·Python 3.11 or newer
- ·A virtual environment
- ·Runs local-only; no service account
Quick start
# install & run$ python3 -m venv .venv && source .venv/bin/activate$ pip install "ecl-trainer @ git+https://github.com/Intelligent-Context-AI-Inc/signalledger.git@v0.1.0-alpha.5"$ ecl-trainer scan --changed-only
Requires Python 3.11+. Install via pip as shown above — that's the supported path.
Step by step
- 01
Create an isolated environment
Keep the scanner out of your global Python install so CI and local runs match.
$ python3 -m venv .venv && source .venv/bin/activate - 02
Install the scanner
Install the pinned alpha directly from the repository. The command name is ecl-trainer.
$ pip install "ecl-trainer @ git+https://github.com/Intelligent-Context-AI-Inc/signalledger.git@v0.1.0-alpha.5" - 03
Scan only what changed
In CI, --changed-only keeps the scan proportional to the pull request instead of the whole corpus.
$ ecl-trainer scan --changed-only - 04
Work the remediation checklist
A pass with open checklist items is still a pass, but the items are the backlog: license descriptors, provenance descriptors, and lineage risk flags.
What you’ll see
## ECL Pre-Flight Shield- Scan status: `pass`- No-payload policy: `passed`- Risk flags: `0`- Hash chain: `valid`- Mode: `local-only` ### Remediation Checklist- Review missing license descriptors.- Review provenance descriptors.- Review benchmark and lineage risk flags.
If something goes wrong
pip cannot resolve the package.
The install must include the full git+https URL and the version tag exactly as shown; the bare name is not published to PyPI.
The scan reports zero changed files.
--changed-only compares against git history. Run it inside the repository with the base branch fetched.
Related