deploy(hf): sync szl-holdings/a11oy@9dc70869694f72ba3fb4e632f86f96118ccb39ae derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy 9dc70869694f72ba3fb4e632f86f96118ccb39ae.
Files: 1371 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Dockerfile

@@ -657,6 +657,7 @@ COPY verticals/terra ./verticals/terra
 COPY verticals/aegis ./verticals/aegis
 COPY verticals/puriq-markets ./verticals/puriq-markets
 COPY verticals/counsel ./verticals/counsel
+COPY verticals/vessels ./verticals/vessels
 
 # git_sha wireup (FORGE-INSTRUCTION-gitsha-quiet-window): surface the deployed commit
 # … (full rationale: docs/DOCKERFILE_NOTES.md §96)

verticals/vessels/evals/VESSELS-E-ABSTAIN.json

@@ -0,0 +1,99 @@
+{
+  "case_id": "vessels-stale-list",
+  "eval_id": "VESSELS-E-ABSTAIN",
+  "expected_reason_codes": [
+    "STALE_OR_UNAVAILABLE_SOURCE"
+  ],
+  "expected_state": "ABSTAINED",
+  "payload": {
+    "allowed_actions": [
+      "read and normalize",
+      "create case",
+      "draft sanctions case",
+      "rank counterparty match",
+      "draft ticket or change record",
+      "verify postcondition"
+    ],
+    "case_id": "vessels-stale-list",
+    "chain_index": 3,
+    "chain_len": 8,
+    "contradictions": [],
+    "evidence": [
+      {
+        "citation": "OFAC SDN",
+        "claim": "Named counterparty match present.",
+        "class": "OFFICIAL",
+        "id": "ev-sdn",
+        "source_id": "ofac",
+        "weight": 0.8
+      },
+      {
+        "citation": "AIS cache",
+        "claim": "Position cache is STALE. Licensed live AIS is CLOSED.",
+        "class": "OFFICIAL",
+        "id": "ev-ais",
+        "source_id": "ais",
+        "weight": 0.8
+      }
+    ],
+    "graph": {
+      "edges": [
+        {"from": "f1", "rel": "informs", "to": "policy"},
+        {"from": "f7", "rel": "informs", "to": "policy"},
+        {"from": "policy", "rel": "requires", "to": "authority"},
+        {"from": "authority", "rel": "signs", "to": "receipt"},
+        {"from": "ofac", "rel": "describes", "to": "entity"},
+        {"from": "ais", "rel": "describes", "to": "entity"},
+        {"from": "ofac", "rel": "asserts", "to": "ev-sdn"},
+        {"from": "ev-sdn", "rel": "about", "to": "entity"},
+        {"from": "ais", "rel": "asserts", "to": "ev-ais"},
+        {"from": "ev-ais", "rel": "about", "to": "entity"},
+        {"from": "ev-ais", "rel": "weights", "to": "f7"}
+      ],
+      "nodes": [
+        {"id": "entity", "kind": "entity", "label": "AURORA WAVE"},
+        {"id": "policy", "kind": "policy", "label": "Policy DENY"},
+        {"id": "authority", "kind": "authority", "label": "Human authority"},
+        {"id": "receipt", "kind": "receipt", "label": "Receipt"},
+        {"id": "f1", "kind": "formula", "label": "F1 identity"},
+        {"id": "f7", "kind": "formula", "label": "F7 freshness"},
+        {"id": "ofac", "kind": "source", "label": "OFAC SDN"},
+        {"id": "ais", "kind": "source", "label": "AIS cache"},
+        {"id": "ev-sdn", "kind": "evidence", "label": "OFAC SDN"},
+        {"id": "ev-ais", "kind": "evidence", "label": "AIS cache"}
+      ]
+    },
+    "prior_approval": false,
+    "prohibited_actions": [
+      "licensed AIS query",
+      "autonomous intercept",
+      "credential collection or disclosure",
+      "cross-tenant access",
+      "model-selected privilege",
+      "silent risk acceptance"
+    ],
+    "proposed_action": "draft sanctions case",
+    "sources": [
+      {
+        "captured_at": "2026-08-29T14:00:00-04:00",
+        "class": "public_or_standard",
+        "freshness": "LIVE",
+        "id": "ofac",
+        "name": "OFAC SDN",
+        "revision": "packet8-demo",
+        "rights": "ADMITTED"
+      },
+      {
+        "captured_at": "2026-08-29T14:00:00-04:00",
+        "class": "public_or_standard",
+        "freshness": "STALE",
+        "id": "ais",
+        "name": "AIS cache",
+        "revision": "packet8-demo",
+        "rights": "ADMITTED"
+      }
+    ],
+    "used_fuel": 2,
+    "vertical_id": "vessels"
+  }
+}

verticals/vessels/evals/VESSELS-E-AWAIT-01.json

@@ -0,0 +1,102 @@
+{
+  "case_id": "vessels-aurora-wave",
+  "eval_id": "VESSELS-E-AWAIT-01",
+  "expected_reason_codes": [
+    "HUMAN_APPROVAL_REQUIRED"
+  ],
+  "expected_state": "AWAITING_APPROVAL",
+  "payload": {
+    "allowed_actions": [
+      "read and normalize",
+      "create case",
+      "draft sanctions case",
+      "rank counterparty match",
+      "draft ticket or change record",
+      "verify postcondition"
+    ],
+    "case_id": "vessels-aurora-wave",
+    "chain_index": 3,
+    "chain_len": 8,
+    "contradictions": [],
+    "evidence": [
+      {
+        "citation": "OFAC SDN demo",
+        "claim": "Named counterparty matches a public SDN row.",
+        "class": "OFFICIAL",
+        "id": "ev-sdn",
+        "source_id": "ofac",
+        "weight": 0.9
+      },
+      {
+        "citation": "Public vessel identity",
+        "claim": "AURORA WAVE IMO sample admitted as SAMPLE.",
+        "class": "OFFICIAL",
+        "id": "ev-imo",
+        "source_id": "imo",
+        "weight": 0.6
+      }
+    ],
+    "graph": {
+      "edges": [
+        {"from": "f1", "rel": "informs", "to": "policy"},
+        {"from": "f4", "rel": "informs", "to": "policy"},
+        {"from": "f7", "rel": "informs", "to": "policy"},
+        {"from": "policy", "rel": "requires", "to": "authority"},
+        {"from": "authority", "rel": "signs", "to": "receipt"},
+        {"from": "ofac", "rel": "describes", "to": "entity"},
+        {"from": "imo", "rel": "describes", "to": "entity"},
+        {"from": "ofac", "rel": "asserts", "to": "ev-sdn"},
+        {"from": "ev-sdn", "rel": "about", "to": "entity"},
+        {"from": "ev-sdn", "rel": "weights", "to": "f4"},
+        {"from": "imo", "rel": "asserts", "to": "ev-imo"},
+        {"from": "ev-imo", "rel": "about", "to": "entity"},
+        {"from": "ev-imo", "rel": "weights", "to": "f4"}
+      ],
+      "nodes": [
+        {"id": "entity", "kind": "entity", "label": "AURORA WAVE"},
+        {"id": "policy", "kind": "policy", "label": "Policy DENY"},
+        {"id": "authority", "kind": "authority", "label": "Human authority"},
+        {"id": "receipt", "kind": "receipt", "label": "Receipt"},
+        {"id": "f1", "kind": "formula", "label": "F1 identity"},
+        {"id": "f4", "kind": "formula", "label": "F4 aggregate"},
+        {"id": "f7", "kind": "formula", "label": "F7 freshness"},
+        {"id": "ofac", "kind": "source", "label": "OFAC SDN"},
+        {"id": "imo", "kind": "source", "label": "Public vessel identity"},
+        {"id": "ev-sdn", "kind": "evidence", "label": "OFAC SDN demo"},
+        {"id": "ev-imo", "kind": "evidence", "label": "Public vessel identity"}
+      ]
+    },
+    "prior_approval": false,
+    "prohibited_actions": [
+      "licensed AIS query",
+      "autonomous intercept",
+      "credential collection or disclosure",
+      "cross-tenant access",
+      "model-selected privilege",
+      "silent risk acceptance"
+    ],
+    "proposed_action": "draft sanctions case",
+    "sources": [
+      {
+        "captured_at": "2026-08-29T14:00:00-04:00",
+        "class": "public_or_standard",
+        "freshness": "LIVE",
+        "id": "ofac",
+        "name": "OFAC SDN",
+        "revision": "packet8-demo",
+        "rights": "ADMITTED"
+      },
+      {
+        "captured_at": "2026-08-29T14:00:00-04:00",
+        "class": "public_or_standard",
+        "freshness": "LIVE",
+        "id": "imo",
+        "name": "Public vessel identity",
+        "revision": "packet8-demo",
+        "rights": "ADMITTED"
+      }
+    ],
+    "used_fuel": 2,
+    "vertical_id": "vessels"
+  }
+}

verticals/vessels/evals/VESSELS-E-DENY-AIS.json

@@ -0,0 +1,77 @@
+{
+  "case_id": "vessels-licensed-ais",
+  "eval_id": "VESSELS-E-DENY-AIS",
+  "expected_reason_codes": [
+    "PROHIBITED_ACTION"
+  ],
+  "expected_state": "DENIED",
+  "payload": {
+    "allowed_actions": [
+      "read and normalize",
+      "create case",
+      "draft sanctions case",
+      "rank counterparty match",
+      "draft ticket or change record",
+      "verify postcondition"
+    ],
+    "case_id": "vessels-licensed-ais",
+    "chain_index": 3,
+    "chain_len": 8,
+    "contradictions": [],
+    "evidence": [
+      {
+        "citation": "OFAC SDN demo",
+        "claim": "Named counterparty matches a public SDN row.",
+        "class": "OFFICIAL",
+        "id": "ev-sdn",
+        "source_id": "ofac",
+        "weight": 0.9
+      }
+    ],
+    "graph": {
+      "edges": [
+        {"from": "f1", "rel": "informs", "to": "policy"},
+        {"from": "f4", "rel": "informs", "to": "policy"},
+        {"from": "policy", "rel": "requires", "to": "authority"},
+        {"from": "authority", "rel": "signs", "to": "receipt"},
+        {"from": "ofac", "rel": "describes", "to": "entity"},
+        {"from": "ofac", "rel": "asserts", "to": "ev-sdn"},
+        {"from": "ev-sdn", "rel": "about", "to": "entity"},
+        {"from": "ev-sdn", "rel": "weights", "to": "f4"}
+      ],
+      "nodes": [
+        {"id": "entity", "kind": "entity", "label": "AURORA WAVE"},
+        {"id": "policy", "kind": "policy", "label": "Policy DENY"},
+        {"id": "authority", "kind": "authority", "label": "Human authority"},
+        {"id": "receipt", "kind": "receipt", "label": "Receipt"},
+        {"id": "f1", "kind": "formula", "label": "F1 identity"},
+        {"id": "f4", "kind": "formula", "label": "F4 aggregate"},
+        {"id": "ofac", "kind": "source", "label": "OFAC SDN"},
+        {"id": "ev-sdn", "kind": "evidence", "label": "OFAC SDN demo"}
+      ]
+    },
+    "prior_approval": false,
+    "prohibited_actions": [
+      "licensed AIS query",
+      "autonomous intercept",
+      "credential collection or disclosure",
+      "cross-tenant access",
+      "model-selected privilege",
+      "silent risk acceptance"
+    ],
+    "proposed_action": "licensed AIS query",
+    "sources": [
+      {
+        "captured_at": "2026-08-29T14:00:00-04:00",
+        "class": "public_or_standard",
+        "freshness": "LIVE",
+        "id": "ofac",
+        "name": "OFAC SDN",
+        "revision": "packet8-demo",
+        "rights": "ADMITTED"
+      }
+    ],
+    "used_fuel": 1,
+    "vertical_id": "vessels"
+  }
+}

verticals/vessels/policy_bundle.json

@@ -0,0 +1,47 @@
+{
+  "allowed_actions": [
+    "read and normalize",
+    "create case",
+    "draft sanctions case",
+    "rank counterparty match",
+    "draft ticket or change record",
+    "verify postcondition"
+  ],
+  "candidate_policy_mode": "LOG_ONLY",
+  "default_effect": "DENY",
+  "formula_grants_authority": false,
+  "market_signal_grants_authority": false,
+  "model_grants_authority": false,
+  "licensed_ais_admitted": false,
+  "prohibited_actions": [
+    "licensed AIS query",
+    "autonomous intercept",
+    "credential collection or disclosure",
+    "cross-tenant access",
+    "model-selected privilege",
+    "silent risk acceptance"
+  ],
+  "promotion": [
+    "shadow evaluation",
+    "counterfactual replay",
+    "false-allow and false-deny review",
+    "approved exact policy revision",
+    "protected source promotion",
+    "runtime readback"
+  ],
+  "required_context": [
+    "authenticated principal and workload identity",
+    "tenant and resource authorization",
+    "purpose and action class",
+    "source, rights and freshness",
+    "exact vertical, policy, data and model revisions",
+    "short-lived capability and expiry",
+    "idempotency key",
+    "required human approval",
+    "postcondition",
+    "compensation or rollback",
+    "decision receipt"
+  ],
+  "schema": "szl.vertical-policy-bundle/v8",
+  "vertical_id": "vessels"
+}

verticals/vessels/vertical_manifest.json

@@ -0,0 +1,95 @@
+{
+  "allowed_actions": [
+    "read and normalize",
+    "create case",
+    "draft sanctions case",
+    "rank counterparty match",
+    "draft ticket or change record",
+    "verify postcondition"
+  ],
+  "buyer": "Maritime operators, trade-compliance officers, and sanctions desks who need a fail-closed case, not a live AIS feed they do not hold a license for.",
+  "canonical_source": {
+    "core": "szl-holdings/a11oy/verticals/vessels",
+    "data_contracts": "szl-holdings/szl-lake/verticals/vessels",
+    "modules": [
+      "szl-holdings/a11oy"
+    ]
+  },
+  "decision_chain": [
+    "vessel and owner identity",
+    "public sanctions list",
+    "AIS license gate",
+    "match and blast radius",
+    "human approval",
+    "bounded draft action",
+    "receipt"
+  ],
+  "display_name": "Vessels Assurance",
+  "evaluations": [
+    "IMO/vessel/owner/counterparty entity resolution",
+    "sanctions match precision and analyst disposition",
+    "AIS gap/spoofing false positive and false negative rate",
+    "licensed AIS true-positive rate",
+    "stale/missing/contradictory source behavior",
+    "approval bypass and idempotency"
+  ],
+  "formula_bindings": [
+    "F1",
+    "F4",
+    "F7",
+    "F11",
+    "F18",
+    "F19",
+    "LAMBDA"
+  ],
+  "leaders": [
+    {
+      "name": "OFAC SDN",
+      "pattern": "named sanctions list, not a quality score",
+      "url": "https://ofac.treasury.gov/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists"
+    }
+  ],
+  "pilot": {
+    "phases": [
+      "read-only public lists",
+      "case prioritization",
+      "draft sanctions case",
+      "approval"
+    ],
+    "scope": "public OFAC SDN plus frozen demonstration vessels. Licensed AIS remains CLOSED without a live key."
+  },
+  "portfolio_role": "PARALLEL_ENTERPRISE_PROOF",
+  "position": 5,
+  "private_connectors": [
+    "licensed AIS",
+    "owner registry",
+    "internal trade book"
+  ],
+  "prohibited_actions": [
+    "licensed AIS query",
+    "autonomous intercept",
+    "credential collection or disclosure",
+    "cross-tenant access",
+    "model-selected privilege",
+    "silent risk acceptance"
+  ],
+  "public_connectors": [
+    "OFAC SDN",
+    "public vessel identity samples"
+  ],
+  "schema": "szl.focus-vertical/v8",
+  "space": {
+    "id": "none",
+    "initial_mode": "public/synthetic maritime demonstration. Hub Space not required.",
+    "source_visible": false,
+    "visibility": "product-vanity"
+  },
+  "success_metrics": [
+    "time from public list hit to evidence-complete case",
+    "licensed AIS remain CLOSED without a key",
+    "false priority rate",
+    "approval latency"
+  ],
+  "vertical_id": "vessels",
+  "wedge": "Sanctions-to-Case Decision Assurance. Licensed AIS stays CLOSED."
+}