Sovereign Model Alias Layer with Cryptographic Provenance Binding of Human-Readable Model Identifiers to Weight Artefacts, Training Corpus, and Fine-Tuning Recipe Under a Post-Quantum Signature.

Binds friendly model names to signed weight + corpus + recipe + runtime hashes, offline-verifiable from the operator public key alone. 35 claims.

A signed alias-resolution layer interposed between the inference client and the runtime, in which each model alias is bound by a post-quantum signed alias manifest to a content-addressed weight-artefact hash, a Merkle-root hash of the training corpus, a hash of the fine-tuning recipe, a hash of the runtime configuration, the operator key that authorised the binding, an issuance timestamp and an expiry. Every inference invocation produces an audit record carrying the alias, the manifest hash, and the manifest signature, so the output-to-alias-to-weight-to-corpus chain is verifiable offline by a holder of the operator public key alone. Defended against existing model registries (HuggingFace Hub, MLflow Model Registry, OpenAI API model versioning, NVIDIA NGC, Cohere/Anthropic/Vertex versioning) which version model artefacts without binding alias to corpus and fine-tuning recipe and without per-inference attribution, against SBOM standards (SPDX, CycloneDX, in-toto) which describe software composition but not alias resolution at inference time, against C2PA which describes media provenance not model provenance, and against Sigstore/cosign which sign container artefacts not alias resolution. Filed 25 June 2026 as GB2615042.5.