a11oy / web /immune.html
betterwithage's picture
deploy(hf): sync szl-holdings/a11oy@main derived COPY set
424636b verified
Raw
History Blame
21.9 kB
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<title>Immune (Hukulla) — fail-closed egress gate · SZL Holdings</title>
<meta name="description" content="Honest operational view of the Immune organ (Quechua role 'Hukulla') — a fail-closed, deny-by-default egress gate. Status, trace, signature, and Khipu-chain evidence are shown only when returned by the live backend. Lambda = Conjecture 1; Khipu = Conjecture 2; trust never 100%."/>
<!-- 0 runtime CDN (doctrine v11): system fonts only — no Google Fonts, no external assets. -->
<style>
:root{
--ground:#0a0a0a; --panel:#0e0e0e; --panel2:#080808; --rail:#0b0b0b;
--gold:#c9b787; --gold-bright:#d6c69a;
--teal:#5fb3a3; --teal-soft:rgba(95,179,163,0.10);
--cream:#f5f5f5; --paragraph:#9a9a9a; --muted:#888; --dim:#555;
--gold-line:rgba(201,183,135,0.15); --gold-soft:rgba(201,183,135,0.04);
--teal-line:rgba(95,179,163,0.22);
--live:#5a8a6e; --err:#b06a5a; --warn:#c9a05f;
--green:#39d98a; --yellow:#f5c451; --red:#ff6a5a; --blue:#5bc8ff;
--mono:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;
--display:ui-sans-serif,system-ui,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;
}
*{box-sizing:border-box;}
html,body{margin:0;padding:0;background:var(--ground);color:var(--cream);font-family:var(--display);-webkit-font-smoothing:antialiased;}
.mono{font-family:var(--mono);}
a{color:inherit;text-decoration:none;}
.topbar{position:sticky;top:0;z-index:60;display:flex;align-items:center;gap:1rem;flex-wrap:wrap;padding:.5rem 1.1rem;background:rgba(10,10,10,.92);backdrop-filter:blur(10px);border-bottom:1px solid var(--gold-line);font-family:var(--mono);font-size:10.5px;letter-spacing:.1em;text-transform:uppercase;color:var(--gold);}
.topbar .sep{color:var(--dim);}
.topbar .live{display:inline-flex;align-items:center;gap:.4rem;color:var(--cream);}
.live-dot{width:6px;height:6px;border-radius:50%;background:var(--warn);box-shadow:0 0 6px var(--warn);animation:pulse 2.2s ease-in-out infinite;}
.live-dot.ready{background:var(--live);box-shadow:0 0 6px var(--live);}
.live-dot.error{background:var(--err);box-shadow:0 0 6px var(--err);animation:none;}
@keyframes pulse{0%,100%{opacity:1;}50%{opacity:.35;}}
.switcher{margin-left:auto;display:flex;align-items:center;gap:.3rem;}
.flag{padding:.22rem .55rem;border-radius:6px;border:1px solid transparent;color:var(--muted);transition:.15s;}
.flag:hover{color:var(--cream);border-color:var(--gold-line);background:var(--gold-soft);}
.flag.active{color:var(--ground);background:var(--gold);border-color:var(--gold);font-weight:600;}
.wrap{max-width:1320px;margin:0 auto;padding:1.6rem 1.4rem 4rem;}
h1{font-size:1.7rem;font-weight:600;margin:.2rem 0 .3rem;letter-spacing:-.01em;}
.badge{display:inline-block;font-family:var(--mono);font-size:10px;letter-spacing:.08em;text-transform:uppercase;color:var(--teal);border:1px solid var(--teal-line);background:var(--teal-soft);padding:.25rem .6rem;border-radius:5px;margin-left:.4rem;vertical-align:middle;}
.lede{color:var(--paragraph);font-size:.95rem;line-height:1.65;max-width:1180px;margin:.6rem 0 1rem;}
.lede b{color:var(--cream);font-weight:600;}
.cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,220px),1fr));gap:.8rem;margin:0 0 1.2rem;}
.card{border:1px solid var(--gold-line);background:var(--panel);border-radius:8px;padding:.85rem 1rem;}
.card .lbl{font-family:var(--mono);font-size:9.5px;letter-spacing:.1em;text-transform:uppercase;color:var(--dim);}
.card .big{font-size:1.5rem;font-weight:600;margin:.35rem 0 .15rem;color:var(--teal);}
.card .sub{font-family:var(--mono);font-size:10.5px;color:var(--muted);}
.grid2{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:1rem;}
.grid2>*{min-width:0;}
.panel{border:1px solid var(--gold-line);background:var(--panel);border-radius:10px;padding:1rem 1.1rem;margin-bottom:1rem;}
.panel h2{font-size:1.05rem;font-weight:600;margin:0 0 .2rem;display:flex;align-items:center;justify-content:space-between;}
.panel h2 .meta{font-family:var(--mono);font-size:10px;color:var(--dim);text-transform:uppercase;letter-spacing:.06em;}
.kv{font-family:var(--mono);font-size:12px;color:var(--paragraph);line-height:1.9;margin-top:.5rem;}
.kv .k{color:var(--dim);display:inline-block;min-width:150px;}
.kv .v{color:var(--cream);}
.pill{display:inline-block;font-family:var(--mono);font-size:10px;letter-spacing:.06em;text-transform:uppercase;padding:.18rem .5rem;border-radius:5px;border:1px solid var(--gold-line);}
.pill.green{color:var(--green);border-color:rgba(57,217,138,.4);background:rgba(57,217,138,.08);}
.pill.yellow{color:var(--yellow);border-color:rgba(245,196,81,.4);background:rgba(245,196,81,.08);}
.pill.red{color:var(--red);border-color:rgba(255,106,90,.4);background:rgba(255,106,90,.08);}
.pill.dim{color:var(--muted);}
.simnote{border:1px solid var(--warn);background:rgba(201,160,95,.06);border-radius:8px;padding:.7rem .9rem;margin-top:.8rem;font-family:var(--mono);font-size:11px;color:#d8c39a;line-height:1.65;}
table{width:100%;border-collapse:collapse;font-family:var(--mono);font-size:11.5px;margin-top:.5rem;}
.table-scroll{max-width:100%;overflow-x:auto;overscroll-behavior-inline:contain;-webkit-overflow-scrolling:touch;}
.table-scroll table{min-width:680px;}
th,td{text-align:left;padding:.34rem .5rem;border-bottom:1px solid var(--gold-soft);color:var(--paragraph);vertical-align:top;}
th{color:var(--dim);text-transform:uppercase;letter-spacing:.06em;font-size:9.5px;}
td.deny{color:var(--red);}td.allow{color:var(--green);}
textarea,input{width:100%;background:var(--panel2);border:1px solid var(--gold-line);border-radius:7px;color:var(--cream);font-family:var(--mono);font-size:12.5px;padding:.6rem .7rem;resize:vertical;}
textarea:focus,input:focus{outline:none;border-color:var(--teal-line);}
button.run{margin-top:.6rem;padding:.55rem 1.1rem;border-radius:7px;border:1px solid var(--teal-line);background:var(--teal-soft);color:var(--teal);font-family:var(--mono);font-size:12px;letter-spacing:.06em;text-transform:uppercase;cursor:pointer;transition:.15s;}
button.run:hover{background:rgba(95,179,163,.18);color:var(--cream);}
button.run:focus-visible,.preset:focus-visible,.flag:focus-visible{outline:2px solid var(--teal);outline-offset:2px;}
.preset{display:inline-block;margin:.3rem .3rem 0 0;padding:.2rem .5rem;border-radius:5px;border:1px solid var(--gold-line);color:var(--muted);font-family:var(--mono);font-size:10.5px;cursor:pointer;}
.preset:hover{color:var(--cream);border-color:var(--teal-line);}
.verdict-box{margin-top:.8rem;border:1px solid var(--gold-line);border-radius:8px;padding:.85rem 1rem;background:var(--panel2);font-family:var(--mono);font-size:12px;line-height:1.8;}
.verdict-box.deny{border-color:rgba(255,106,90,.5);}
.verdict-box.allow{border-color:rgba(57,217,138,.5);}
.sig{display:inline-block;margin:.15rem .3rem .15rem 0;padding:.12rem .45rem;border-radius:4px;border:1px solid rgba(255,106,90,.4);background:rgba(255,106,90,.08);color:var(--red);font-size:10.5px;}
.digest{color:var(--gold);word-break:break-all;}
code{font-family:var(--mono);color:var(--teal);}
.footnote{font-family:var(--mono);font-size:10px;color:var(--dim);margin-top:1.6rem;line-height:1.7;}
@media(max-width:760px){
.topbar{position:static;padding:.55rem .8rem;gap:.55rem;}
.switcher{order:3;width:100%;margin-left:0;flex-wrap:nowrap;overflow-x:auto;overscroll-behavior-inline:contain;padding-bottom:.15rem;}
.flag{flex:0 0 auto;min-height:44px;display:inline-flex;align-items:center;}
.wrap{padding:1.15rem .85rem 3rem;}
h1{font-size:1.4rem;line-height:1.25;}
.badge{display:block;width:max-content;max-width:100%;margin:.55rem 0 0;white-space:normal;}
.grid2{grid-template-columns:minmax(0,1fr);}
.panel{padding:.85rem;}
.panel h2{align-items:flex-start;gap:.5rem;flex-direction:column;}
.kv .k{min-width:130px;}
button.run{min-height:44px;width:100%;}
.preset{min-height:44px;display:inline-flex;align-items:center;}
}
@media(max-width:420px){
.cards{grid-template-columns:minmax(0,1fr);}
.kv>div{display:grid;grid-template-columns:minmax(0,.7fr) minmax(0,1.3fr);gap:.5rem;}
.kv .k{min-width:0;}
.kv .v,.digest{overflow-wrap:anywhere;word-break:break-word;}
}
@media(prefers-reduced-motion:reduce){.live-dot{animation:none;}}
</style>
</head>
<body>
<div class="topbar">
<span>SZL HOLDINGS</span><span class="sep">/</span><span>a11oy</span>
<span class="live"><span class="live-dot" id="liveDot"></span><span id="liveTag" aria-live="polite">IMMUNE · PROBING</span></span>
<span class="switcher">
<a class="flag active" href="/immune">Immune</a>
<a class="flag" href="/energy">Energy</a>
<a class="flag" href="/fleet-c2">Fleet C2</a>
<a class="flag" href="/living-anatomy">Living Anatomy</a>
<a class="flag" href="/code">Code</a>
</span>
</div>
<div class="wrap">
<h1>Immune (Hukulla) — fail-closed egress gate<span class="badge" id="organBadge">deny-by-default · evidence pending</span></h1>
<p class="lede">
The <b>Immune</b> organ (Quechua role <b>Hukulla</b>) is a <b>fail-closed, deny-by-default</b> egress gate.
Submitted actions are sent to the live threat-signature, size, and
<b>&Lambda;-gate</b> inspection path (MIN of supplied trust axes &lt; 0.5 &rarr; deny). When the backend
returns a Khipu receipt, its digest, sequence, signature, chain result, and trace context are shown below.
No receipt or signature state is inferred by this page. Proven Lean backing:
<code>ImmuneNeymanPearsonOpt.lean</code> (Neyman&ndash;Pearson-optimal egress) and
<code>FrontierWelfordVariance.lean</code> (Welford online variance). These back the gate but are
<b>not</b> folded into the locked-8 proven set. &Lambda; = <b>Conjecture&nbsp;1</b> (not a theorem);
Khipu = Conjecture&nbsp;2; trust is never 100%; effectors simulated; no fabricated data.
</p>
<div class="cards">
<div class="card"><div class="lbl">Verdicts (this process)</div><div class="big" id="cVerdicts"></div><div class="sub" id="cVerdictsSub">resets on restart</div></div>
<div class="card"><div class="lbl">Deny rate</div><div class="big" id="cDenyRate"></div><div class="sub" id="cDenySub">deny / total</div></div>
<div class="card"><div class="lbl">Signature corpus</div><div class="big" id="cCorpus"></div><div class="sub" id="cCorpusSub">active signatures</div></div>
<div class="card"><div class="lbl">Khipu chain depth</div><div class="big" id="cChain"></div><div class="sub" id="cChainSub">verified</div></div>
</div>
<div class="grid2">
<div class="panel">
<h2>Inspect an action <span class="meta" id="verdictEp">POST /api/a11oy/v1/immune/verdict</span></h2>
<p class="lede" style="margin:.2rem 0 .6rem;font-size:.86rem;">
Submit an action payload to the live inspection endpoint. Returned receipt and signing evidence is shown without inference.
Optionally include <code>axes</code> (a JSON array of trust scores) to exercise the &Lambda;-gate floor.
</p>
<div>
<span class="preset" data-p='{"action":{"cmd":"rm -rf /"}}'>rm -rf /</span>
<span class="preset" data-p='{"action":{"q":"DROP TABLE users; --"}}'>DROP TABLE</span>
<span class="preset" data-p='{"action":{"html":"&lt;script&gt;alert(1)&lt;/script&gt;"}}'>&lt;script&gt; XSS</span>
<span class="preset" data-p='{"action":{"path":"../../etc/passwd"}}'>path traversal</span>
<span class="preset" data-p='{"action":{"cmd":"echo hello"}}'>echo hello (clean)</span>
<span class="preset" data-p='{"action":{"cmd":"read_file"},"axes":[0.9,0.3,0.8]}'>low &Lambda; axis</span>
</div>
<textarea id="actionInput" rows="6" style="margin-top:.5rem;">{"action":{"cmd":"rm -rf /"}}</textarea>
<button class="run" id="runBtn">Inspect &rarr; verdict</button>
<div id="verdictOut"></div>
</div>
<div class="panel">
<h2>Live status <span class="meta" id="statusEp">GET /api/a11oy/v1/immune/status</span></h2>
<div class="kv" id="statusKv" aria-live="polite"><span class="k">status</span><span class="v">PROBING</span></div>
<div class="simnote" id="honestyNote">
Λ = Conjecture 1 (NOT a theorem). Khipu = Conjecture 2. Trust never 100%. Effectors simulated.
Decision feed is in-memory (resets on restart) — empty means IDLE, never faked.
</div>
</div>
</div>
<div class="panel">
<h2>Gates <span class="meta" id="gatesEp">GET /api/a11oy/v1/immune/gates</span></h2>
<div class="table-scroll" role="region" aria-label="Immune gates" tabindex="0"><table id="gatesTable"><thead><tr><th>id</th><th>name</th><th>label</th><th>category</th><th>sample → expected</th></tr></thead><tbody><tr><td class="mono" colspan="5">loading…</td></tr></tbody></table></div>
</div>
<div class="panel">
<h2>Decision feed <span class="meta" id="feedEp">GET /api/a11oy/v1/immune/feed</span></h2>
<div class="table-scroll" role="region" aria-label="Immune decision feed" tabindex="0"><table id="feedTable"><thead><tr><th>time</th><th>decision</th><th>signals</th><th>Λ</th><th>receipt</th></tr></thead><tbody><tr><td class="mono" colspan="5">loading…</td></tr></tbody></table></div>
</div>
<div class="footnote" id="leanFoot">
Proven Lean backing: Lutar/Wave11/ImmuneNeymanPearsonOpt.lean · Lutar/Innovations/round11/FrontierWelfordVariance.lean.
Locked-proven set = EXACTLY 8 {F1,F4,F7,F11,F12,F18,F19,F22} @ kernel c7c0ba17 — the immune Lean backing is cited, NOT folded in.
SLSA L1/L2/L3-roadmap · 0 runtime CDN. This page reads only the live /api/a11oy/v1/immune/* endpoints.
</div>
</div>
<script>
const BASE = "/api/a11oy/v1/immune";
async function requestJSON(u,opt){
try{
const r=await fetch(u,opt);
const text=await r.text();
let data=null;
if(text){
try{data=JSON.parse(text);}
catch(e){return {ok:false,status:r.status,error:"invalid JSON response",data:null};}
}
if(!r.ok){
const detail=data&&(data.detail||data.error||data.message);
return {ok:false,status:r.status,error:detail||("HTTP "+r.status),data:data};
}
return {ok:true,status:r.status,error:null,data:data};
}catch(e){
return {ok:false,status:null,error:(e&&e.message)||String(e),data:null};
}
}
function esc(s){return String(s).replace(/[&<>"']/g,function(c){return({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]||c);});}
function evidenceValue(v){
if(typeof v==="string")return v;
try{return JSON.stringify(v);}catch(e){return String(v);}
}
function present(v){return v!==undefined&&v!==null&&v!=="";}
function row(label,value,cls){
if(!present(value))return "";
return '<div><span class="k">'+esc(label)+'</span><span class="v '+(cls||'')+'">'+esc(evidenceValue(value))+'</span></div>';
}
function connectionState(state,reachable){
const normalized=present(state)?String(state).trim().toUpperCase():"UNKNOWN";
const ready=reachable&&["LIVE","REAL","READY","OPERATIONAL","MEASURED"].includes(normalized);
const dot=document.getElementById("liveDot");
dot.className="live-dot"+(ready?" ready":reachable?"":" error");
document.getElementById("liveTag").textContent="IMMUNE · "+(reachable?normalized:"UNAVAILABLE");
document.getElementById("organBadge").textContent=ready?"deny-by-default · backend reported "+normalized.toLowerCase():"deny-by-default · evidence "+(reachable?normalized.toLowerCase():"unavailable");
return {normalized,ready};
}
function requestFailure(result){
const status=result.status==null?"network error":"HTTP "+result.status;
return status+(present(result.error)?" · "+result.error:result.ok?" · required evidence unavailable":"");
}
async function loadStatus(){
const result = await requestJSON(BASE + "/status");
const kv = document.getElementById("statusKv");
if(!result.ok||!result.data){
connectionState(null,false);
kv.innerHTML=row("status","UNAVAILABLE")+row("evidence",requestFailure(result));
return;
}
const s=result.data;
const state=connectionState(s.status,true);
document.getElementById("cVerdicts").textContent = (s.verdicts_this_process ?? "—");
document.getElementById("cDenyRate").textContent = (s.deny_rate==null?"—":(Math.round(s.deny_rate*1000)/10)+"%");
document.getElementById("cDenySub").textContent = (s.deny ?? "—")+" deny / "+(s.allow ?? "—")+" allow";
document.getElementById("cCorpus").textContent = (s.signature_corpus_size ?? "—");
document.getElementById("cCorpusSub").textContent = (s.threats_corpus_total ?? "—")+" STIX/MITRE in corpus";
const k = s.khipu||{};
document.getElementById("cChain").textContent = (k.chain_depth ?? "—");
document.getElementById("cChainSub").textContent = (typeof k.chain_verified==="boolean"?(k.chain_verified?"chain verified":"chain not verified"):"verification unavailable");
const observed=s.observed_at||s.observedAt||s.timestamp;
kv.innerHTML =
row("organ",s.organ)+
row("role",s.role)+
row("Λ-gate floor",s.lambda_gate_floor)+
row("size guard",present(s.size_guard_bytes)?s.size_guard_bytes+" bytes":null)+
row("signatures",Array.isArray(s.signatures)?s.signatures.join(", "):s.signatures)+
row("last receipt",s.last_receipt_digest,"digest")+
row("khipu head",k.head_digest,"digest")+
row("chain verified",typeof k.chain_verified==="boolean"?String(k.chain_verified):null)+
row("observed at",observed)+
'<div><span class="k">status</span><span class="pill '+(state.ready?'green':'yellow')+'">'+esc(state.normalized)+'</span></div>';
}
async function loadGates(){
const result = await requestJSON(BASE + "/gates");
const tb = document.querySelector("#gatesTable tbody");
if(!result.ok||!result.data||!Array.isArray(result.data.gates)){tb.innerHTML='<tr><td class="mono" colspan="5">'+esc(requestFailure(result))+'</td></tr>';return;}
const g=result.data;
tb.innerHTML = g.gates.map(x=>
'<tr><td class="mono">'+esc(x.id)+'</td><td>'+esc(x.name)+'</td><td>'+esc(x.label)+'</td><td>'+esc(x.category)+'</td>'+
'<td><code>'+esc(String(x.sampleInput).slice(0,46))+'</code> → <b>'+esc(x.expectedDecision)+'</b></td></tr>').join("");
}
async function loadFeed(){
const result = await requestJSON(BASE + "/feed?limit=20");
const tb = document.querySelector("#feedTable tbody");
if(!result.ok||!result.data||!Array.isArray(result.data.verdicts)){tb.innerHTML='<tr><td class="mono" colspan="5">'+esc(requestFailure(result))+'</td></tr>';return;}
const f=result.data;
if(!f.verdicts.length){tb.innerHTML='<tr><td class="mono" colspan="5">IDLE — no verdicts buffered (resets on restart)</td></tr>';return;}
tb.innerHTML = f.verdicts.map(v=>
'<tr><td>'+esc((v.timestamp||"").slice(11,19))+'</td>'+
'<td class="'+esc(v.decision)+'">'+esc(v.decision)+'</td>'+
'<td>'+esc((v.signals||[]).join(", ")||"—")+'</td>'+
'<td>'+esc(v.lambda_value)+'</td>'+
'<td class="digest">'+esc(v.receipt_hash||"")+'</td></tr>').join("");
}
async function runVerdict(){
const out = document.getElementById("verdictOut");
let body;
try{ body = JSON.parse(document.getElementById("actionInput").value); }
catch(e){ out.innerHTML='<div class="verdict-box deny">Invalid JSON: '+esc(e.message)+'</div>'; return; }
out.innerHTML='<div class="verdict-box">inspecting…</div>';
const result = await requestJSON(BASE + "/verdict", {method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(body)});
if(!result.ok||!result.data){ out.innerHTML='<div class="verdict-box deny">'+esc(requestFailure(result))+'</div>'; return; }
const v=result.data;
const decision=String(v.decision||"UNKNOWN").toLowerCase();
const cls = decision==="deny"?"deny":decision==="allow"?"allow":"";
const pill = decision==="deny"?'<span class="pill red">DENY</span>':decision==="allow"?'<span class="pill green">ALLOW</span>':'<span class="pill yellow">UNKNOWN</span>';
const sigs = Array.isArray(v.signals)?(v.signals.map(s=>'<span class="sig">'+esc(s)+'</span>').join("")||'<span class="pill dim">no signals returned</span>'):'<span class="pill dim">signals unavailable</span>';
const rec = v.khipu_receipt||{};
const observed=v.observed_at||v.observedAt||v.timestamp||rec.observed_at||rec.timestamp;
const lambdaEvidence=present(v.lambda_value)?' &nbsp; <span style="color:var(--dim)">Λ='+esc(v.lambda_value)+(present(v.lambda_floor)?' (floor '+esc(v.lambda_floor)+')':'')+'</span>':'';
const reasonEvidence=present(v.reason)?'<div style="margin:.4rem 0;color:var(--paragraph)">'+esc(v.reason)+'</div>':'';
const policyEvidence=row("fail closed",v.fail_closed)+row("doctrine",v.doctrine);
const receiptEvidence=
row("verdict hash",v.receipt_hash,"digest")+
row("receipt digest",rec.digest,"digest")+
row("receipt sequence",rec.seq)+
row("receipt type",rec.receipt_type)+
row("signature",rec.signature,"digest")+
row("chain verified",typeof rec.chain_verified==="boolean"?String(rec.chain_verified):null)+
row("traceparent",v.traceparent,"digest")+
row("observed at",observed);
out.innerHTML =
'<div class="verdict-box '+cls+'">'+
'<div>decision '+pill+lambdaEvidence+'</div>'+
reasonEvidence+
'<div style="margin:.3rem 0;">signals: '+sigs+'</div>'+
'<div class="kv">'+receiptEvidence+policyEvidence+'</div>'+
'</div>';
loadStatus(); loadFeed();
}
document.querySelectorAll(".preset").forEach(p=>p.addEventListener("click",()=>{
document.getElementById("actionInput").value = p.getAttribute("data-p");
}));
document.getElementById("runBtn").addEventListener("click",runVerdict);
async function loadAll(){ await Promise.all([loadStatus(),loadGates(),loadFeed()]); }
loadAll();
setInterval(loadStatus, 8000);
</script>
</body>
</html>