docs(card): value-prop headline + conjecture-violet Lambda badge; align SLSA to canonical L1 honest / L2 build-attested / L3 roadmap (cosign verify-attestation); frontmatter preserved

README.md

@@ -20,6 +20,14 @@ ecosystem-stage: "operational"
 <!-- HF Space front-matter is REQUIRED (sdk: docker). Injected by hf-sync
      so the Space builds the Dockerfile. Do not remove. -->
 
+# a11oy
+
+**Governed autonomy with a checkable receipt for every decision.**
+
+[![Λ Conjecture 1](https://img.shields.io/badge/Λ-Conjecture_1_(conditional_Theorem_U)-B79BD6?style=flat-square)](https://github.com/szl-holdings/lutar-lean/blob/main/BOUNTY.md) [![SLSA L1 honest · L2 build-attested · L3 roadmap](https://img.shields.io/badge/SLSA-L1%20honest%20%C2%B7%20L2%20build--attested%20%C2%B7%20L3%20roadmap-c9b787?style=flat-square)](https://slsa.dev/spec/v1.0/levels) [![Doctrine v11 LOCKED](https://img.shields.io/badge/Doctrine-v11_LOCKED-3b82f6?style=flat-square)](https://github.com/szl-holdings/.github/tree/main/doctrine)
+
+---
+
 ## Live
 
 **HF Space (one-click, no login):** [![Open in Spaces](https://img.shields.io/badge/%F0%9F%A4%97%20Open%20in%20Spaces-a11oy-FF9D00?style=flat-square)](https://huggingface.co/spaces/SZLHOLDINGS/a11oy)
@@ -93,11 +101,12 @@ See [`docs/GOVERNED_POST_DETERMINISM.md`](https://github.com/szl-holdings/platfo
 curl -s https://szlholdings-a11oy.hf.space/api/a11oy/v1/honest | jq .kernel_commit
 # => "c7c0ba17"
 
-# 2. Verify the cosign keyless signature + build-provenance attestation on the image.
-#    SLSA L1 honest · L2 build-attested: container provenance via
-#    attest-build-provenance (Sigstore keyless, Fulcio + Rekor). Verify with
-#    `cosign verify-attestation`. SLSA L3 is roadmap — see .compliance/SLSA_LEVEL.md.
-cosign verify ghcr.io/szl-holdings/a11oy:uds-v0.2.0 \
+# 2. Verify the cosign keyless signature + build-provenance attestation on the
+#    published image (SLSA L1 honest · L2 build-attested: container provenance via
+#    attest-build-provenance, Sigstore keyless, Rekor-anchored). SLSA L3 is roadmap —
+#    see .compliance/SLSA_LEVEL.md.
+cosign verify-attestation ghcr.io/szl-holdings/a11oy:uds-v0.2.0 \
+  --type slsaprovenance \
   --certificate-identity-regexp="^https://github.com/szl-holdings/" \
   --certificate-oidc-issuer="https://token.actions.githubusercontent.com"
 # Public Rekor entry for the image signature: log index 1710578865
@@ -150,7 +159,7 @@ docker run --rm -p 7860:7860 ghcr.io/szl-holdings/a11oy:uds-v0.2.0
 |---|---|
 | Live HF Space (HTTP 200) | ✅ |
 | SLSA **L1 honest · L2 build-attested** | ✅ — cosign keyless-signed image + container build-provenance attestation (attest-build-provenance, Sigstore keyless), verifiable via `cosign verify-attestation`; Rekor [1710578865](https://search.sigstore.dev/?logIndex=1710578865). See [.compliance/SLSA_LEVEL.md](.compliance/SLSA_LEVEL.md). |
-| SLSA **L3** | 🛣️ **Roadmap** — hardened/isolated builder + non-falsifiable provenance. **Not claimed as achieved today.** |
+| SLSA **L3** | 🛣️ **Roadmap** — verified provenance under isolated builders + hermetic builds. **Not claimed today.** |
 | cosign keyless signed | ✅ |
 | UDS bundle (`szl-uds-bundle:uds-v0.2.0`) | ✅ Real, deployable mesh bundle (cosign-signed, Rekor-anchored). |
 | DSSE Khipu receipts | ✅ — ECDSA P-256-SHA256 |
@@ -163,8 +172,6 @@ docker run --rm -p 7860:7860 ghcr.io/szl-holdings/a11oy:uds-v0.2.0
 
 ---
 
-> Not affiliated with Defense Unicorns. SZL mark USPTO Serial 99831122. No production ATO claimed.
-
 <sub>Doctrine v11 LOCKED · 749/14/163 · kernel `c7c0ba17` · SLSA L1 honest · L2 build-attested (container provenance, Sigstore keyless) · L3 / FedRAMP / Iron Bank / CMMC / ATO roadmap · 5 locked-proven + experimental CI-green tier · Λ = Conjecture 1 · Apache-2.0 · DOI [10.5281/zenodo.20434276](https://doi.org/10.5281/zenodo.20434276)</sub>
 
 Signed-off-by: Stephen P. Lutar Jr. <stephenlutar2@gmail.com>