File size: 21,896 Bytes
3e27dff
 
 
 
 
 
424636b
3e27dff
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
424636b
 
 
3e27dff
 
 
 
 
 
 
 
 
 
424636b
3e27dff
 
 
 
424636b
 
3e27dff
 
 
 
 
 
 
 
 
 
 
 
 
424636b
 
3e27dff
 
 
 
 
 
 
424636b
3e27dff
 
 
 
 
 
 
 
 
424636b
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3e27dff
 
 
 
 
424636b
3e27dff
 
 
 
 
 
 
 
 
 
424636b
3e27dff
 
424636b
 
 
 
3e27dff
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
424636b
3e27dff
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
424636b
3e27dff
 
 
 
 
 
 
 
 
424636b
3e27dff
 
 
 
424636b
3e27dff
 
 
 
 
 
 
 
 
 
 
424636b
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
e97df21
424636b
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3e27dff
 
424636b
3e27dff
424636b
 
 
 
 
 
 
 
3e27dff
424636b
3e27dff
424636b
3e27dff
 
424636b
 
3e27dff
424636b
 
 
 
 
 
 
 
 
 
3e27dff
 
 
424636b
3e27dff
424636b
 
3e27dff
 
 
 
 
 
424636b
3e27dff
424636b
 
 
3e27dff
 
 
 
 
 
 
 
 
 
 
 
 
 
424636b
 
 
 
 
 
 
3e27dff
424636b
 
 
 
 
 
 
 
 
 
 
 
 
3e27dff
 
424636b
 
3e27dff
424636b
3e27dff
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<title>Immune (Hukulla) — fail-closed egress gate · SZL Holdings</title>
<meta name="description" content="Honest operational view of the Immune organ (Quechua role 'Hukulla') — a fail-closed, deny-by-default egress gate. Status, trace, signature, and Khipu-chain evidence are shown only when returned by the live backend. Lambda = Conjecture 1; Khipu = Conjecture 2; trust never 100%."/>
<!-- 0 runtime CDN (doctrine v11): system fonts only — no Google Fonts, no external assets. -->
<style>
:root{
  --ground:#0a0a0a; --panel:#0e0e0e; --panel2:#080808; --rail:#0b0b0b;
  --gold:#c9b787; --gold-bright:#d6c69a;
  --teal:#5fb3a3; --teal-soft:rgba(95,179,163,0.10);
  --cream:#f5f5f5; --paragraph:#9a9a9a; --muted:#888; --dim:#555;
  --gold-line:rgba(201,183,135,0.15); --gold-soft:rgba(201,183,135,0.04);
  --teal-line:rgba(95,179,163,0.22);
  --live:#5a8a6e; --err:#b06a5a; --warn:#c9a05f;
  --green:#39d98a; --yellow:#f5c451; --red:#ff6a5a; --blue:#5bc8ff;
  --mono:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;
  --display:ui-sans-serif,system-ui,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;
}
*{box-sizing:border-box;}
html,body{margin:0;padding:0;background:var(--ground);color:var(--cream);font-family:var(--display);-webkit-font-smoothing:antialiased;}
.mono{font-family:var(--mono);}
a{color:inherit;text-decoration:none;}
.topbar{position:sticky;top:0;z-index:60;display:flex;align-items:center;gap:1rem;flex-wrap:wrap;padding:.5rem 1.1rem;background:rgba(10,10,10,.92);backdrop-filter:blur(10px);border-bottom:1px solid var(--gold-line);font-family:var(--mono);font-size:10.5px;letter-spacing:.1em;text-transform:uppercase;color:var(--gold);}
.topbar .sep{color:var(--dim);}
.topbar .live{display:inline-flex;align-items:center;gap:.4rem;color:var(--cream);}
.live-dot{width:6px;height:6px;border-radius:50%;background:var(--warn);box-shadow:0 0 6px var(--warn);animation:pulse 2.2s ease-in-out infinite;}
.live-dot.ready{background:var(--live);box-shadow:0 0 6px var(--live);}
.live-dot.error{background:var(--err);box-shadow:0 0 6px var(--err);animation:none;}
@keyframes pulse{0%,100%{opacity:1;}50%{opacity:.35;}}
.switcher{margin-left:auto;display:flex;align-items:center;gap:.3rem;}
.flag{padding:.22rem .55rem;border-radius:6px;border:1px solid transparent;color:var(--muted);transition:.15s;}
.flag:hover{color:var(--cream);border-color:var(--gold-line);background:var(--gold-soft);}
.flag.active{color:var(--ground);background:var(--gold);border-color:var(--gold);font-weight:600;}
.wrap{max-width:1320px;margin:0 auto;padding:1.6rem 1.4rem 4rem;}
h1{font-size:1.7rem;font-weight:600;margin:.2rem 0 .3rem;letter-spacing:-.01em;}
.badge{display:inline-block;font-family:var(--mono);font-size:10px;letter-spacing:.08em;text-transform:uppercase;color:var(--teal);border:1px solid var(--teal-line);background:var(--teal-soft);padding:.25rem .6rem;border-radius:5px;margin-left:.4rem;vertical-align:middle;}
.lede{color:var(--paragraph);font-size:.95rem;line-height:1.65;max-width:1180px;margin:.6rem 0 1rem;}
.lede b{color:var(--cream);font-weight:600;}
.cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,220px),1fr));gap:.8rem;margin:0 0 1.2rem;}
.card{border:1px solid var(--gold-line);background:var(--panel);border-radius:8px;padding:.85rem 1rem;}
.card .lbl{font-family:var(--mono);font-size:9.5px;letter-spacing:.1em;text-transform:uppercase;color:var(--dim);}
.card .big{font-size:1.5rem;font-weight:600;margin:.35rem 0 .15rem;color:var(--teal);}
.card .sub{font-family:var(--mono);font-size:10.5px;color:var(--muted);}
.grid2{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:1rem;}
.grid2>*{min-width:0;}
.panel{border:1px solid var(--gold-line);background:var(--panel);border-radius:10px;padding:1rem 1.1rem;margin-bottom:1rem;}
.panel h2{font-size:1.05rem;font-weight:600;margin:0 0 .2rem;display:flex;align-items:center;justify-content:space-between;}
.panel h2 .meta{font-family:var(--mono);font-size:10px;color:var(--dim);text-transform:uppercase;letter-spacing:.06em;}
.kv{font-family:var(--mono);font-size:12px;color:var(--paragraph);line-height:1.9;margin-top:.5rem;}
.kv .k{color:var(--dim);display:inline-block;min-width:150px;}
.kv .v{color:var(--cream);}
.pill{display:inline-block;font-family:var(--mono);font-size:10px;letter-spacing:.06em;text-transform:uppercase;padding:.18rem .5rem;border-radius:5px;border:1px solid var(--gold-line);}
.pill.green{color:var(--green);border-color:rgba(57,217,138,.4);background:rgba(57,217,138,.08);}
.pill.yellow{color:var(--yellow);border-color:rgba(245,196,81,.4);background:rgba(245,196,81,.08);}
.pill.red{color:var(--red);border-color:rgba(255,106,90,.4);background:rgba(255,106,90,.08);}
.pill.dim{color:var(--muted);}
.simnote{border:1px solid var(--warn);background:rgba(201,160,95,.06);border-radius:8px;padding:.7rem .9rem;margin-top:.8rem;font-family:var(--mono);font-size:11px;color:#d8c39a;line-height:1.65;}
table{width:100%;border-collapse:collapse;font-family:var(--mono);font-size:11.5px;margin-top:.5rem;}
.table-scroll{max-width:100%;overflow-x:auto;overscroll-behavior-inline:contain;-webkit-overflow-scrolling:touch;}
.table-scroll table{min-width:680px;}
th,td{text-align:left;padding:.34rem .5rem;border-bottom:1px solid var(--gold-soft);color:var(--paragraph);vertical-align:top;}
th{color:var(--dim);text-transform:uppercase;letter-spacing:.06em;font-size:9.5px;}
td.deny{color:var(--red);}td.allow{color:var(--green);}
textarea,input{width:100%;background:var(--panel2);border:1px solid var(--gold-line);border-radius:7px;color:var(--cream);font-family:var(--mono);font-size:12.5px;padding:.6rem .7rem;resize:vertical;}
textarea:focus,input:focus{outline:none;border-color:var(--teal-line);}
button.run{margin-top:.6rem;padding:.55rem 1.1rem;border-radius:7px;border:1px solid var(--teal-line);background:var(--teal-soft);color:var(--teal);font-family:var(--mono);font-size:12px;letter-spacing:.06em;text-transform:uppercase;cursor:pointer;transition:.15s;}
button.run:hover{background:rgba(95,179,163,.18);color:var(--cream);}
button.run:focus-visible,.preset:focus-visible,.flag:focus-visible{outline:2px solid var(--teal);outline-offset:2px;}
.preset{display:inline-block;margin:.3rem .3rem 0 0;padding:.2rem .5rem;border-radius:5px;border:1px solid var(--gold-line);color:var(--muted);font-family:var(--mono);font-size:10.5px;cursor:pointer;}
.preset:hover{color:var(--cream);border-color:var(--teal-line);}
.verdict-box{margin-top:.8rem;border:1px solid var(--gold-line);border-radius:8px;padding:.85rem 1rem;background:var(--panel2);font-family:var(--mono);font-size:12px;line-height:1.8;}
.verdict-box.deny{border-color:rgba(255,106,90,.5);}
.verdict-box.allow{border-color:rgba(57,217,138,.5);}
.sig{display:inline-block;margin:.15rem .3rem .15rem 0;padding:.12rem .45rem;border-radius:4px;border:1px solid rgba(255,106,90,.4);background:rgba(255,106,90,.08);color:var(--red);font-size:10.5px;}
.digest{color:var(--gold);word-break:break-all;}
code{font-family:var(--mono);color:var(--teal);}
.footnote{font-family:var(--mono);font-size:10px;color:var(--dim);margin-top:1.6rem;line-height:1.7;}
@media(max-width:760px){
  .topbar{position:static;padding:.55rem .8rem;gap:.55rem;}
  .switcher{order:3;width:100%;margin-left:0;flex-wrap:nowrap;overflow-x:auto;overscroll-behavior-inline:contain;padding-bottom:.15rem;}
  .flag{flex:0 0 auto;min-height:44px;display:inline-flex;align-items:center;}
  .wrap{padding:1.15rem .85rem 3rem;}
  h1{font-size:1.4rem;line-height:1.25;}
  .badge{display:block;width:max-content;max-width:100%;margin:.55rem 0 0;white-space:normal;}
  .grid2{grid-template-columns:minmax(0,1fr);}
  .panel{padding:.85rem;}
  .panel h2{align-items:flex-start;gap:.5rem;flex-direction:column;}
  .kv .k{min-width:130px;}
  button.run{min-height:44px;width:100%;}
  .preset{min-height:44px;display:inline-flex;align-items:center;}
}
@media(max-width:420px){
  .cards{grid-template-columns:minmax(0,1fr);}
  .kv>div{display:grid;grid-template-columns:minmax(0,.7fr) minmax(0,1.3fr);gap:.5rem;}
  .kv .k{min-width:0;}
  .kv .v,.digest{overflow-wrap:anywhere;word-break:break-word;}
}
@media(prefers-reduced-motion:reduce){.live-dot{animation:none;}}
</style>
</head>
<body>
<div class="topbar">
  <span>SZL HOLDINGS</span><span class="sep">/</span><span>a11oy</span>
  <span class="live"><span class="live-dot" id="liveDot"></span><span id="liveTag" aria-live="polite">IMMUNE · PROBING</span></span>
  <span class="switcher">
    <a class="flag active" href="/immune">Immune</a>
    <a class="flag" href="/energy">Energy</a>
    <a class="flag" href="/fleet-c2">Fleet C2</a>
    <a class="flag" href="/living-anatomy">Living Anatomy</a>
    <a class="flag" href="/code">Code</a>
  </span>
</div>

<div class="wrap">
  <h1>Immune (Hukulla) — fail-closed egress gate<span class="badge" id="organBadge">deny-by-default · evidence pending</span></h1>
  <p class="lede">
    The <b>Immune</b> organ (Quechua role <b>Hukulla</b>) is a <b>fail-closed, deny-by-default</b> egress gate.
    Submitted actions are sent to the live threat-signature, size, and
    <b>&Lambda;-gate</b> inspection path (MIN of supplied trust axes &lt; 0.5 &rarr; deny). When the backend
    returns a Khipu receipt, its digest, sequence, signature, chain result, and trace context are shown below.
    No receipt or signature state is inferred by this page. Proven Lean backing:
    <code>ImmuneNeymanPearsonOpt.lean</code> (Neyman&ndash;Pearson-optimal egress) and
    <code>FrontierWelfordVariance.lean</code> (Welford online variance). These back the gate but are
    <b>not</b> folded into the locked-8 proven set. &Lambda; = <b>Conjecture&nbsp;1</b> (not a theorem);
    Khipu = Conjecture&nbsp;2; trust is never 100%; effectors simulated; no fabricated data.
  </p>

  <div class="cards">
    <div class="card"><div class="lbl">Verdicts (this process)</div><div class="big" id="cVerdicts">—</div><div class="sub" id="cVerdictsSub">resets on restart</div></div>
    <div class="card"><div class="lbl">Deny rate</div><div class="big" id="cDenyRate">—</div><div class="sub" id="cDenySub">deny / total</div></div>
    <div class="card"><div class="lbl">Signature corpus</div><div class="big" id="cCorpus">—</div><div class="sub" id="cCorpusSub">active signatures</div></div>
    <div class="card"><div class="lbl">Khipu chain depth</div><div class="big" id="cChain">—</div><div class="sub" id="cChainSub">verified</div></div>
  </div>

  <div class="grid2">
    <div class="panel">
      <h2>Inspect an action <span class="meta" id="verdictEp">POST /api/a11oy/v1/immune/verdict</span></h2>
      <p class="lede" style="margin:.2rem 0 .6rem;font-size:.86rem;">
        Submit an action payload to the live inspection endpoint. Returned receipt and signing evidence is shown without inference.
        Optionally include <code>axes</code> (a JSON array of trust scores) to exercise the &Lambda;-gate floor.
      </p>
      <div>
        <span class="preset" data-p='{"action":{"cmd":"rm -rf /"}}'>rm -rf /</span>
        <span class="preset" data-p='{"action":{"q":"DROP TABLE users; --"}}'>DROP TABLE</span>
        <span class="preset" data-p='{"action":{"html":"&lt;script&gt;alert(1)&lt;/script&gt;"}}'>&lt;script&gt; XSS</span>
        <span class="preset" data-p='{"action":{"path":"../../etc/passwd"}}'>path traversal</span>
        <span class="preset" data-p='{"action":{"cmd":"echo hello"}}'>echo hello (clean)</span>
        <span class="preset" data-p='{"action":{"cmd":"read_file"},"axes":[0.9,0.3,0.8]}'>low &Lambda; axis</span>
      </div>
      <textarea id="actionInput" rows="6" style="margin-top:.5rem;">{"action":{"cmd":"rm -rf /"}}</textarea>
      <button class="run" id="runBtn">Inspect &rarr; verdict</button>
      <div id="verdictOut"></div>
    </div>

    <div class="panel">
      <h2>Live status <span class="meta" id="statusEp">GET /api/a11oy/v1/immune/status</span></h2>
      <div class="kv" id="statusKv" aria-live="polite"><span class="k">status</span><span class="v">PROBING</span></div>
      <div class="simnote" id="honestyNote">
        Λ = Conjecture 1 (NOT a theorem). Khipu = Conjecture 2. Trust never 100%. Effectors simulated.
        Decision feed is in-memory (resets on restart) — empty means IDLE, never faked.
      </div>
    </div>
  </div>

  <div class="panel">
    <h2>Gates <span class="meta" id="gatesEp">GET /api/a11oy/v1/immune/gates</span></h2>
    <div class="table-scroll" role="region" aria-label="Immune gates" tabindex="0"><table id="gatesTable"><thead><tr><th>id</th><th>name</th><th>label</th><th>category</th><th>sample → expected</th></tr></thead><tbody><tr><td class="mono" colspan="5">loading…</td></tr></tbody></table></div>
  </div>

  <div class="panel">
    <h2>Decision feed <span class="meta" id="feedEp">GET /api/a11oy/v1/immune/feed</span></h2>
    <div class="table-scroll" role="region" aria-label="Immune decision feed" tabindex="0"><table id="feedTable"><thead><tr><th>time</th><th>decision</th><th>signals</th><th>Λ</th><th>receipt</th></tr></thead><tbody><tr><td class="mono" colspan="5">loading…</td></tr></tbody></table></div>
  </div>

  <div class="footnote" id="leanFoot">
    Proven Lean backing: Lutar/Wave11/ImmuneNeymanPearsonOpt.lean · Lutar/Innovations/round11/FrontierWelfordVariance.lean.
    Locked-proven set = EXACTLY 8 {F1,F4,F7,F11,F12,F18,F19,F22} @ kernel c7c0ba17 — the immune Lean backing is cited, NOT folded in.
    SLSA L1/L2/L3-roadmap · 0 runtime CDN. This page reads only the live /api/a11oy/v1/immune/* endpoints.
  </div>
</div>

<script>
const BASE = "/api/a11oy/v1/immune";
async function requestJSON(u,opt){
  try{
    const r=await fetch(u,opt);
    const text=await r.text();
    let data=null;
    if(text){
      try{data=JSON.parse(text);}
      catch(e){return {ok:false,status:r.status,error:"invalid JSON response",data:null};}
    }
    if(!r.ok){
      const detail=data&&(data.detail||data.error||data.message);
      return {ok:false,status:r.status,error:detail||("HTTP "+r.status),data:data};
    }
    return {ok:true,status:r.status,error:null,data:data};
  }catch(e){
    return {ok:false,status:null,error:(e&&e.message)||String(e),data:null};
  }
}
function esc(s){return String(s).replace(/[&<>"']/g,function(c){return({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]||c);});}
function evidenceValue(v){
  if(typeof v==="string")return v;
  try{return JSON.stringify(v);}catch(e){return String(v);}
}
function present(v){return v!==undefined&&v!==null&&v!=="";}
function row(label,value,cls){
  if(!present(value))return "";
  return '<div><span class="k">'+esc(label)+'</span><span class="v '+(cls||'')+'">'+esc(evidenceValue(value))+'</span></div>';
}
function connectionState(state,reachable){
  const normalized=present(state)?String(state).trim().toUpperCase():"UNKNOWN";
  const ready=reachable&&["LIVE","REAL","READY","OPERATIONAL","MEASURED"].includes(normalized);
  const dot=document.getElementById("liveDot");
  dot.className="live-dot"+(ready?" ready":reachable?"":" error");
  document.getElementById("liveTag").textContent="IMMUNE · "+(reachable?normalized:"UNAVAILABLE");
  document.getElementById("organBadge").textContent=ready?"deny-by-default · backend reported "+normalized.toLowerCase():"deny-by-default · evidence "+(reachable?normalized.toLowerCase():"unavailable");
  return {normalized,ready};
}
function requestFailure(result){
  const status=result.status==null?"network error":"HTTP "+result.status;
  return status+(present(result.error)?" · "+result.error:result.ok?" · required evidence unavailable":"");
}

async function loadStatus(){
  const result = await requestJSON(BASE + "/status");
  const kv = document.getElementById("statusKv");
  if(!result.ok||!result.data){
    connectionState(null,false);
    kv.innerHTML=row("status","UNAVAILABLE")+row("evidence",requestFailure(result));
    return;
  }
  const s=result.data;
  const state=connectionState(s.status,true);
  document.getElementById("cVerdicts").textContent = (s.verdicts_this_process ?? "—");
  document.getElementById("cDenyRate").textContent = (s.deny_rate==null?"—":(Math.round(s.deny_rate*1000)/10)+"%");
  document.getElementById("cDenySub").textContent = (s.deny ?? "—")+" deny / "+(s.allow ?? "—")+" allow";
  document.getElementById("cCorpus").textContent = (s.signature_corpus_size ?? "—");
  document.getElementById("cCorpusSub").textContent = (s.threats_corpus_total ?? "—")+" STIX/MITRE in corpus";
  const k = s.khipu||{};
  document.getElementById("cChain").textContent = (k.chain_depth ?? "—");
  document.getElementById("cChainSub").textContent = (typeof k.chain_verified==="boolean"?(k.chain_verified?"chain verified":"chain not verified"):"verification unavailable");
  const observed=s.observed_at||s.observedAt||s.timestamp;
  kv.innerHTML =
    row("organ",s.organ)+
    row("role",s.role)+
    row("Λ-gate floor",s.lambda_gate_floor)+
    row("size guard",present(s.size_guard_bytes)?s.size_guard_bytes+" bytes":null)+
    row("signatures",Array.isArray(s.signatures)?s.signatures.join(", "):s.signatures)+
    row("last receipt",s.last_receipt_digest,"digest")+
    row("khipu head",k.head_digest,"digest")+
    row("chain verified",typeof k.chain_verified==="boolean"?String(k.chain_verified):null)+
    row("observed at",observed)+
    '<div><span class="k">status</span><span class="pill '+(state.ready?'green':'yellow')+'">'+esc(state.normalized)+'</span></div>';
}

async function loadGates(){
  const result = await requestJSON(BASE + "/gates");
  const tb = document.querySelector("#gatesTable tbody");
  if(!result.ok||!result.data||!Array.isArray(result.data.gates)){tb.innerHTML='<tr><td class="mono" colspan="5">'+esc(requestFailure(result))+'</td></tr>';return;}
  const g=result.data;
  tb.innerHTML = g.gates.map(x=>
    '<tr><td class="mono">'+esc(x.id)+'</td><td>'+esc(x.name)+'</td><td>'+esc(x.label)+'</td><td>'+esc(x.category)+'</td>'+
    '<td><code>'+esc(String(x.sampleInput).slice(0,46))+'</code> → <b>'+esc(x.expectedDecision)+'</b></td></tr>').join("");
}

async function loadFeed(){
  const result = await requestJSON(BASE + "/feed?limit=20");
  const tb = document.querySelector("#feedTable tbody");
  if(!result.ok||!result.data||!Array.isArray(result.data.verdicts)){tb.innerHTML='<tr><td class="mono" colspan="5">'+esc(requestFailure(result))+'</td></tr>';return;}
  const f=result.data;
  if(!f.verdicts.length){tb.innerHTML='<tr><td class="mono" colspan="5">IDLE — no verdicts buffered (resets on restart)</td></tr>';return;}
  tb.innerHTML = f.verdicts.map(v=>
    '<tr><td>'+esc((v.timestamp||"").slice(11,19))+'</td>'+
    '<td class="'+esc(v.decision)+'">'+esc(v.decision)+'</td>'+
    '<td>'+esc((v.signals||[]).join(", ")||"—")+'</td>'+
    '<td>'+esc(v.lambda_value)+'</td>'+
    '<td class="digest">'+esc(v.receipt_hash||"")+'</td></tr>').join("");
}

async function runVerdict(){
  const out = document.getElementById("verdictOut");
  let body;
  try{ body = JSON.parse(document.getElementById("actionInput").value); }
  catch(e){ out.innerHTML='<div class="verdict-box deny">Invalid JSON: '+esc(e.message)+'</div>'; return; }
  out.innerHTML='<div class="verdict-box">inspecting…</div>';
  const result = await requestJSON(BASE + "/verdict", {method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(body)});
  if(!result.ok||!result.data){ out.innerHTML='<div class="verdict-box deny">'+esc(requestFailure(result))+'</div>'; return; }
  const v=result.data;
  const decision=String(v.decision||"UNKNOWN").toLowerCase();
  const cls = decision==="deny"?"deny":decision==="allow"?"allow":"";
  const pill = decision==="deny"?'<span class="pill red">DENY</span>':decision==="allow"?'<span class="pill green">ALLOW</span>':'<span class="pill yellow">UNKNOWN</span>';
  const sigs = Array.isArray(v.signals)?(v.signals.map(s=>'<span class="sig">'+esc(s)+'</span>').join("")||'<span class="pill dim">no signals returned</span>'):'<span class="pill dim">signals unavailable</span>';
  const rec = v.khipu_receipt||{};
  const observed=v.observed_at||v.observedAt||v.timestamp||rec.observed_at||rec.timestamp;
  const lambdaEvidence=present(v.lambda_value)?' &nbsp; <span style="color:var(--dim)">Λ='+esc(v.lambda_value)+(present(v.lambda_floor)?' (floor '+esc(v.lambda_floor)+')':'')+'</span>':'';
  const reasonEvidence=present(v.reason)?'<div style="margin:.4rem 0;color:var(--paragraph)">'+esc(v.reason)+'</div>':'';
  const policyEvidence=row("fail closed",v.fail_closed)+row("doctrine",v.doctrine);
  const receiptEvidence=
    row("verdict hash",v.receipt_hash,"digest")+
    row("receipt digest",rec.digest,"digest")+
    row("receipt sequence",rec.seq)+
    row("receipt type",rec.receipt_type)+
    row("signature",rec.signature,"digest")+
    row("chain verified",typeof rec.chain_verified==="boolean"?String(rec.chain_verified):null)+
    row("traceparent",v.traceparent,"digest")+
    row("observed at",observed);
  out.innerHTML =
    '<div class="verdict-box '+cls+'">'+
      '<div>decision '+pill+lambdaEvidence+'</div>'+
      reasonEvidence+
      '<div style="margin:.3rem 0;">signals: '+sigs+'</div>'+
      '<div class="kv">'+receiptEvidence+policyEvidence+'</div>'+
    '</div>';
  loadStatus(); loadFeed();
}

document.querySelectorAll(".preset").forEach(p=>p.addEventListener("click",()=>{
  document.getElementById("actionInput").value = p.getAttribute("data-p");
}));
document.getElementById("runBtn").addEventListener("click",runVerdict);

async function loadAll(){ await Promise.all([loadStatus(),loadGates(),loadFeed()]); }
loadAll();
setInterval(loadStatus, 8000);
</script>
</body>
</html>