Hugging Face's logo

Spaces:
SZLHOLDINGS
/
a11oy
Running

App Files Community
12
a11oy
File size: 17,414 Bytes
3e27dff
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
e97df21
3e27dff
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<title>Immune (Hukulla) — fail-closed egress gate · SZL Holdings</title>
<meta name="description" content="Live, honest view of the Immune organ (Quechua role 'Hukulla') — a fail-closed, deny-by-default egress gate. Real threat-signature scan + 1 MB size guard + Lambda-gate floor, every verdict signed into the shared Khipu chain. Lean backing: ImmuneNeymanPearsonOpt + FrontierWelfordVariance. Lambda = Conjecture 1; Khipu = Conjecture 2; trust never 100%."/>
<!-- 0 runtime CDN (doctrine v11): system fonts only — no Google Fonts, no external assets. -->
<style>
:root{
  --ground:#0a0a0a; --panel:#0e0e0e; --panel2:#080808; --rail:#0b0b0b;
  --gold:#c9b787; --gold-bright:#d6c69a;
  --teal:#5fb3a3; --teal-soft:rgba(95,179,163,0.10);
  --cream:#f5f5f5; --paragraph:#9a9a9a; --muted:#888; --dim:#555;
  --gold-line:rgba(201,183,135,0.15); --gold-soft:rgba(201,183,135,0.04);
  --teal-line:rgba(95,179,163,0.22);
  --live:#5a8a6e; --err:#b06a5a; --warn:#c9a05f;
  --green:#39d98a; --yellow:#f5c451; --red:#ff6a5a; --blue:#5bc8ff;
  --mono:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;
  --display:ui-sans-serif,system-ui,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;
}
*{box-sizing:border-box;}
html,body{margin:0;padding:0;background:var(--ground);color:var(--cream);font-family:var(--display);-webkit-font-smoothing:antialiased;}
.mono{font-family:var(--mono);}
a{color:inherit;text-decoration:none;}
.topbar{position:sticky;top:0;z-index:60;display:flex;align-items:center;gap:1rem;flex-wrap:wrap;padding:.5rem 1.1rem;background:rgba(10,10,10,.92);backdrop-filter:blur(10px);border-bottom:1px solid var(--gold-line);font-family:var(--mono);font-size:10.5px;letter-spacing:.1em;text-transform:uppercase;color:var(--gold);}
.topbar .sep{color:var(--dim);}
.topbar .live{display:inline-flex;align-items:center;gap:.4rem;color:var(--cream);}
.live-dot{width:6px;height:6px;border-radius:50%;background:var(--live);box-shadow:0 0 6px var(--live);animation:pulse 2.2s ease-in-out infinite;}
@keyframes pulse{0%,100%{opacity:1;}50%{opacity:.35;}}
.switcher{margin-left:auto;display:flex;align-items:center;gap:.3rem;}
.flag{padding:.22rem .55rem;border-radius:6px;border:1px solid transparent;color:var(--muted);transition:.15s;}
.flag:hover{color:var(--cream);border-color:var(--gold-line);background:var(--gold-soft);}
.flag.active{color:var(--ground);background:var(--gold);border-color:var(--gold);font-weight:600;}
.wrap{max-width:1320px;margin:0 auto;padding:1.6rem 1.4rem 4rem;}
h1{font-size:1.7rem;font-weight:600;margin:.2rem 0 .3rem;letter-spacing:-.01em;}
.badge{display:inline-block;font-family:var(--mono);font-size:10px;letter-spacing:.08em;text-transform:uppercase;color:var(--teal);border:1px solid var(--teal-line);background:var(--teal-soft);padding:.25rem .6rem;border-radius:5px;margin-left:.4rem;vertical-align:middle;}
.lede{color:var(--paragraph);font-size:.95rem;line-height:1.65;max-width:1180px;margin:.6rem 0 1rem;}
.lede b{color:var(--cream);font-weight:600;}
.cards{display:grid;grid-template-columns:repeat(4,1fr);gap:.8rem;margin:0 0 1.2rem;}
.card{border:1px solid var(--gold-line);background:var(--panel);border-radius:8px;padding:.85rem 1rem;}
.card .lbl{font-family:var(--mono);font-size:9.5px;letter-spacing:.1em;text-transform:uppercase;color:var(--dim);}
.card .big{font-size:1.5rem;font-weight:600;margin:.35rem 0 .15rem;color:var(--teal);}
.card .sub{font-family:var(--mono);font-size:10.5px;color:var(--muted);}
.grid2{display:grid;grid-template-columns:1fr 1fr;gap:1rem;}
.panel{border:1px solid var(--gold-line);background:var(--panel);border-radius:10px;padding:1rem 1.1rem;margin-bottom:1rem;}
.panel h2{font-size:1.05rem;font-weight:600;margin:0 0 .2rem;display:flex;align-items:center;justify-content:space-between;}
.panel h2 .meta{font-family:var(--mono);font-size:10px;color:var(--dim);text-transform:uppercase;letter-spacing:.06em;}
.kv{font-family:var(--mono);font-size:12px;color:var(--paragraph);line-height:1.9;margin-top:.5rem;}
.kv .k{color:var(--dim);display:inline-block;min-width:150px;}
.kv .v{color:var(--cream);}
.pill{display:inline-block;font-family:var(--mono);font-size:10px;letter-spacing:.06em;text-transform:uppercase;padding:.18rem .5rem;border-radius:5px;border:1px solid var(--gold-line);}
.pill.green{color:var(--green);border-color:rgba(57,217,138,.4);background:rgba(57,217,138,.08);}
.pill.yellow{color:var(--yellow);border-color:rgba(245,196,81,.4);background:rgba(245,196,81,.08);}
.pill.red{color:var(--red);border-color:rgba(255,106,90,.4);background:rgba(255,106,90,.08);}
.pill.dim{color:var(--muted);}
.simnote{border:1px solid var(--warn);background:rgba(201,160,95,.06);border-radius:8px;padding:.7rem .9rem;margin-top:.8rem;font-family:var(--mono);font-size:11px;color:#d8c39a;line-height:1.65;}
table{width:100%;border-collapse:collapse;font-family:var(--mono);font-size:11.5px;margin-top:.5rem;}
th,td{text-align:left;padding:.34rem .5rem;border-bottom:1px solid var(--gold-soft);color:var(--paragraph);vertical-align:top;}
th{color:var(--dim);text-transform:uppercase;letter-spacing:.06em;font-size:9.5px;}
td.deny{color:var(--red);}td.allow{color:var(--green);}
textarea,input{width:100%;background:var(--panel2);border:1px solid var(--gold-line);border-radius:7px;color:var(--cream);font-family:var(--mono);font-size:12.5px;padding:.6rem .7rem;resize:vertical;}
textarea:focus,input:focus{outline:none;border-color:var(--teal-line);}
button.run{margin-top:.6rem;padding:.55rem 1.1rem;border-radius:7px;border:1px solid var(--teal-line);background:var(--teal-soft);color:var(--teal);font-family:var(--mono);font-size:12px;letter-spacing:.06em;text-transform:uppercase;cursor:pointer;transition:.15s;}
button.run:hover{background:rgba(95,179,163,.18);color:var(--cream);}
.preset{display:inline-block;margin:.3rem .3rem 0 0;padding:.2rem .5rem;border-radius:5px;border:1px solid var(--gold-line);color:var(--muted);font-family:var(--mono);font-size:10.5px;cursor:pointer;}
.preset:hover{color:var(--cream);border-color:var(--teal-line);}
.verdict-box{margin-top:.8rem;border:1px solid var(--gold-line);border-radius:8px;padding:.85rem 1rem;background:var(--panel2);font-family:var(--mono);font-size:12px;line-height:1.8;}
.verdict-box.deny{border-color:rgba(255,106,90,.5);}
.verdict-box.allow{border-color:rgba(57,217,138,.5);}
.sig{display:inline-block;margin:.15rem .3rem .15rem 0;padding:.12rem .45rem;border-radius:4px;border:1px solid rgba(255,106,90,.4);background:rgba(255,106,90,.08);color:var(--red);font-size:10.5px;}
.digest{color:var(--gold);word-break:break-all;}
code{font-family:var(--mono);color:var(--teal);}
.footnote{font-family:var(--mono);font-size:10px;color:var(--dim);margin-top:1.6rem;line-height:1.7;}
</style>
</head>
<body>
<div class="topbar">
  <span>SZL HOLDINGS</span><span class="sep">/</span><span>a11oy</span>
  <span class="live"><span class="live-dot"></span><span id="liveTag">IMMUNE · LIVE</span></span>
  <span class="switcher">
    <a class="flag active" href="/immune">Immune</a>
    <a class="flag" href="/energy">Energy</a>
    <a class="flag" href="/fleet-c2">Fleet C2</a>
    <a class="flag" href="/living-anatomy">Living Anatomy</a>
    <a class="flag" href="/code">Code</a>
  </span>
</div>

<div class="wrap">
  <h1>Immune (Hukulla) — fail-closed egress gate<span class="badge" id="organBadge">deny-by-default · real inspection · Khipu-signed</span></h1>
  <p class="lede">
    The <b>Immune</b> organ (Quechua role <b>Hukulla</b>) is a <b>fail-closed, deny-by-default</b> egress gate.
    Every action is inspected against a real threat-signature corpus, a 1&nbsp;MB size guard and a
    <b>&Lambda;-gate floor</b> (MIN of supplied trust axes &lt; 0.5 &rarr; deny). Each verdict is signed into the
    <b>shared Khipu chain</b> (<code>SZL.Immune.Verdict.v1</code>). Proven Lean backing:
    <code>ImmuneNeymanPearsonOpt.lean</code> (Neyman&ndash;Pearson-optimal egress) and
    <code>FrontierWelfordVariance.lean</code> (Welford online variance). These back the gate but are
    <b>not</b> folded into the locked-8 proven set. &Lambda; = <b>Conjecture&nbsp;1</b> (not a theorem);
    Khipu = Conjecture&nbsp;2; trust is never 100%; effectors simulated; no fabricated data.
  </p>

  <div class="cards">
    <div class="card"><div class="lbl">Verdicts (this process)</div><div class="big" id="cVerdicts">—</div><div class="sub" id="cVerdictsSub">resets on restart</div></div>
    <div class="card"><div class="lbl">Deny rate</div><div class="big" id="cDenyRate">—</div><div class="sub" id="cDenySub">deny / total</div></div>
    <div class="card"><div class="lbl">Signature corpus</div><div class="big" id="cCorpus">—</div><div class="sub" id="cCorpusSub">active signatures</div></div>
    <div class="card"><div class="lbl">Khipu chain depth</div><div class="big" id="cChain">—</div><div class="sub" id="cChainSub">verified</div></div>
  </div>

  <div class="grid2">
    <div class="panel">
      <h2>Inspect an action <span class="meta" id="verdictEp">POST /api/a11oy/v1/immune/verdict</span></h2>
      <p class="lede" style="margin:.2rem 0 .6rem;font-size:.86rem;">
        Submit a real action payload. The gate runs the live inspection and signs a Khipu receipt.
        Optionally include <code>axes</code> (a JSON array of trust scores) to exercise the &Lambda;-gate floor.
      </p>
      <div>
        <span class="preset" data-p='{"action":{"cmd":"rm -rf /"}}'>rm -rf /</span>
        <span class="preset" data-p='{"action":{"q":"DROP TABLE users; --"}}'>DROP TABLE</span>
        <span class="preset" data-p='{"action":{"html":"&lt;script&gt;alert(1)&lt;/script&gt;"}}'>&lt;script&gt; XSS</span>
        <span class="preset" data-p='{"action":{"path":"../../etc/passwd"}}'>path traversal</span>
        <span class="preset" data-p='{"action":{"cmd":"echo hello"}}'>echo hello (clean)</span>
        <span class="preset" data-p='{"action":{"cmd":"read_file"},"axes":[0.9,0.3,0.8]}'>low &Lambda; axis</span>
      </div>
      <textarea id="actionInput" rows="6" style="margin-top:.5rem;">{"action":{"cmd":"rm -rf /"}}</textarea>
      <button class="run" id="runBtn">Inspect &rarr; verdict</button>
      <div id="verdictOut"></div>
    </div>

    <div class="panel">
      <h2>Live status <span class="meta" id="statusEp">GET /api/a11oy/v1/immune/status</span></h2>
      <div class="kv" id="statusKv"><span class="k">loading…</span></div>
      <div class="simnote" id="honestyNote">
        Λ = Conjecture 1 (NOT a theorem). Khipu = Conjecture 2. Trust never 100%. Effectors simulated.
        Decision feed is in-memory (resets on restart) — empty means IDLE, never faked.
      </div>
    </div>
  </div>

  <div class="panel">
    <h2>Gates <span class="meta" id="gatesEp">GET /api/a11oy/v1/immune/gates</span></h2>
    <table id="gatesTable"><thead><tr><th>id</th><th>name</th><th>label</th><th>category</th><th>sample → expected</th></tr></thead><tbody><tr><td class="mono" colspan="5">loading…</td></tr></tbody></table>
  </div>

  <div class="panel">
    <h2>Decision feed <span class="meta" id="feedEp">GET /api/a11oy/v1/immune/feed</span></h2>
    <table id="feedTable"><thead><tr><th>time</th><th>decision</th><th>signals</th><th>Λ</th><th>receipt</th></tr></thead><tbody><tr><td class="mono" colspan="5">loading…</td></tr></tbody></table>
  </div>

  <div class="footnote" id="leanFoot">
    Proven Lean backing: Lutar/Wave11/ImmuneNeymanPearsonOpt.lean · Lutar/Innovations/round11/FrontierWelfordVariance.lean.
    Locked-proven set = EXACTLY 8 {F1,F4,F7,F11,F12,F18,F19,F22} @ kernel c7c0ba17 — the immune Lean backing is cited, NOT folded in.
    SLSA L1/L2/L3-roadmap · 0 runtime CDN. This page reads only the live /api/a11oy/v1/immune/* endpoints.
  </div>
</div>

<script>
const BASE = "/api/a11oy/v1/immune";
async function getJSON(u,opt){try{const r=await fetch(u,opt);if(!r.ok)return null;return await r.json();}catch(e){return null;}}
function esc(s){return String(s).replace(/[&<>"']/g,function(c){return({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]||c);});}

async function loadStatus(){
  const s = await getJSON(BASE + "/status");
  const kv = document.getElementById("statusKv");
  if(!s){kv.innerHTML='<span class="k">status</span><span class="v">unreachable — retrying</span>';return;}
  document.getElementById("cVerdicts").textContent = (s.verdicts_this_process ?? 0);
  document.getElementById("cDenyRate").textContent = (s.deny_rate==null?"—":(Math.round(s.deny_rate*1000)/10)+"%");
  document.getElementById("cDenySub").textContent = (s.deny ?? 0)+" deny / "+(s.allow ?? 0)+" allow";
  document.getElementById("cCorpus").textContent = (s.signature_corpus_size ?? "—");
  document.getElementById("cCorpusSub").textContent = (s.threats_corpus_total ?? 0)+" STIX/MITRE in corpus";
  const k = s.khipu||{};
  document.getElementById("cChain").textContent = (k.chain_depth ?? "—");
  document.getElementById("cChainSub").textContent = (k.chain_verified? "chain verified":"unverified");
  kv.innerHTML =
    '<div><span class="k">organ</span><span class="v">'+esc(s.organ||"Immune (Hukulla)")+'</span></div>'+
    '<div><span class="k">role</span><span class="v">'+esc(s.role||"")+'</span></div>'+
    '<div><span class="k">Λ-gate floor</span><span class="v">'+esc(s.lambda_gate_floor)+'</span></div>'+
    '<div><span class="k">size guard</span><span class="v">'+esc(s.size_guard_bytes)+' bytes</span></div>'+
    '<div><span class="k">signatures</span><span class="v">'+esc((s.signatures||[]).join(", "))+'</span></div>'+
    '<div><span class="k">last receipt</span><span class="v digest">'+esc(s.last_receipt_digest||"(none yet)")+'</span></div>'+
    '<div><span class="k">khipu head</span><span class="v digest">'+esc((k.head_digest||"").slice(0,32))+'…</span></div>'+
    '<div><span class="k">status</span><span class="pill green">'+esc(s.status||"REAL")+'</span></div>';
}

async function loadGates(){
  const g = await getJSON(BASE + "/gates");
  const tb = document.querySelector("#gatesTable tbody");
  if(!g || !g.gates){tb.innerHTML='<tr><td class="mono" colspan="5">unreachable</td></tr>';return;}
  tb.innerHTML = g.gates.map(x=>
    '<tr><td class="mono">'+esc(x.id)+'</td><td>'+esc(x.name)+'</td><td>'+esc(x.label)+'</td><td>'+esc(x.category)+'</td>'+
    '<td><code>'+esc(String(x.sampleInput).slice(0,46))+'</code> → <b>'+esc(x.expectedDecision)+'</b></td></tr>').join("");
}

async function loadFeed(){
  const f = await getJSON(BASE + "/feed?limit=20");
  const tb = document.querySelector("#feedTable tbody");
  if(!f || !f.verdicts || !f.verdicts.length){tb.innerHTML='<tr><td class="mono" colspan="5">IDLE — no verdicts buffered (resets on restart)</td></tr>';return;}
  tb.innerHTML = f.verdicts.map(v=>
    '<tr><td>'+esc((v.timestamp||"").slice(11,19))+'</td>'+
    '<td class="'+esc(v.decision)+'">'+esc(v.decision)+'</td>'+
    '<td>'+esc((v.signals||[]).join(", ")||"—")+'</td>'+
    '<td>'+esc(v.lambda_value)+'</td>'+
    '<td class="digest">'+esc(v.receipt_hash||"")+'</td></tr>').join("");
}

async function runVerdict(){
  const out = document.getElementById("verdictOut");
  let body;
  try{ body = JSON.parse(document.getElementById("actionInput").value); }
  catch(e){ out.innerHTML='<div class="verdict-box deny">Invalid JSON: '+esc(e.message)+'</div>'; return; }
  out.innerHTML='<div class="verdict-box">inspecting…</div>';
  const v = await getJSON(BASE + "/verdict", {method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(body)});
  if(!v){ out.innerHTML='<div class="verdict-box deny">endpoint unreachable — retry</div>'; return; }
  const cls = v.decision==="deny"?"deny":"allow";
  const pill = v.decision==="deny"?'<span class="pill red">DENY</span>':'<span class="pill green">ALLOW</span>';
  const sigs = (v.signals||[]).map(s=>'<span class="sig">'+esc(s)+'</span>').join("") || '<span class="pill dim">no signal</span>';
  const rec = v.khipu_receipt||{};
  out.innerHTML =
    '<div class="verdict-box '+cls+'">'+
      '<div>decision '+pill+' &nbsp; <span style="color:var(--dim)">Λ='+esc(v.lambda_value)+' (floor '+esc(v.lambda_floor)+')</span></div>'+
      '<div style="margin:.4rem 0;color:var(--paragraph)">'+esc(v.reason)+'</div>'+
      '<div style="margin:.3rem 0;">signals: '+sigs+'</div>'+
      '<div><span style="color:var(--dim)">verdict hash</span> <span class="digest">'+esc(v.receipt_hash)+'</span></div>'+
      '<div><span style="color:var(--dim)">Khipu receipt</span> <span class="digest">'+esc(rec.digest||"")+'</span> '+
        '<span style="color:var(--dim)">seq '+esc(rec.seq)+' · '+esc(rec.receipt_type||"SZL.Immune.Verdict.v1")+'</span></div>'+
      '<div style="color:var(--dim);margin-top:.3rem">fail-closed='+esc(v.fail_closed)+' · doctrine '+esc(v.doctrine)+'</div>'+
    '</div>';
  loadStatus(); loadFeed();
}

document.querySelectorAll(".preset").forEach(p=>p.addEventListener("click",()=>{
  document.getElementById("actionInput").value = p.getAttribute("data-p");
}));
document.getElementById("runBtn").addEventListener("click",runVerdict);

async function loadAll(){ await Promise.all([loadStatus(),loadGates(),loadFeed()]); }
loadAll();
setInterval(loadStatus, 8000);
</script>
</body>
</html>