Scrub internal codenames from user-visible API responses: generic a11oy capability names in mesh/state, warhacker launch/index, observability trace; eval-arena domain=logistics; vertical-pack id=voyage. Signed-off-by: Stephen P. Lutar Jr. <stephenlutar2@gmail.com>

a11oy_warhacker_obs.py

@@ -51,7 +51,34 @@ from fastapi.responses import JSONResponse
 
 DOCTRINE = "v11"
 LAMBDA_STATUS = "Conjecture 1 (NOT a theorem — LOCKED)"
-SLSA_NOTE = "SLSA L2 build-provenance on the 5 organ images (cosign .att), not the bundle. No L3/FedRAMP/Iron Bank/CMMC."
+SLSA_NOTE = "SLSA L2 build-provenance on the container image (cosign .att), not the bundle. No L3/FedRAMP/Iron Bank/CMMC."
+
+import re as _re_scrub
+_BANNED_RE = _re_scrub.compile(r"(?i)\b(killinchu|sentra|amaru|rosie|vessels|drones?)\b")
+_CAP_FOR_NAME = {
+    "killinchu": "Operator", "sentra": "Policy / Safety", "amaru": "Reasoning",
+    "rosie": "Receipts", "vessels": "Receipts", "drone": "autonomous unit", "drones": "autonomous units",
+}
+
+
+def _scrub_str(s: str) -> str:
+    s = _re_scrub.sub(r"https?://szlholdings-[a-z0-9-]+\.hf\.space[^\s\"']*", "(in-image)", s)
+    s = _re_scrub.sub(r"/api/(killinchu|sentra|amaru|rosie|vessels)/", "/api/a11oy/", s)
+    return _BANNED_RE.sub(lambda m: _CAP_FOR_NAME.get(m.group(0).lower(), "capability"), s)
+
+
+def _scrub_obj(o: Any) -> Any:
+    """Recursively strip internal codenames + *.hf.space URLs from any object that
+    will be serialized to the browser. The console renders backend JSON verbatim."""
+    if isinstance(o, str):
+        return _scrub_str(o)
+    if isinstance(o, list):
+        return [_scrub_obj(x) for x in o]
+    if isinstance(o, tuple):
+        return [_scrub_obj(x) for x in o]
+    if isinstance(o, dict):
+        return {(_scrub_str(k) if isinstance(k, str) else k): _scrub_obj(v) for k, v in o.items()}
+    return o
 
 # Live organ base URLs. Overridable by env for air-gap / mirror / cluster deploys.
 # Resolution order per organ (first non-empty wins):
@@ -101,34 +128,40 @@ WARHACKER_PROBLEMS: list[dict[str, Any]] = [
     {
         "id": "P1",
         "key": "cannonico",
-        "title": "Cannonico — AI-drone oversight (man-on-the-loop)",
+        "title": "Autonomous-system oversight (human-on-the-loop)",
         "organ": "killinchu",
+        "cap": "Operator",
         "method": "POST",
         "path": "/api/killinchu/v1/cannonico/mission/begin",
-        "request_sample": {"mission": "oversight-demo", "system_type": "uas"},
-        "proves": "Begins a governed oversight mission; killinchu returns a DSSE-signed anchor receipt. "
-                  "Engage decisions are gated; a breach of the autonomy envelope is BREACH-flagged + signed.",
+        "clean_endpoint": "POST /v1/operator/mission/begin",
+        "request_sample": {"mission": "oversight-demo", "system_type": "autonomous-unit"},
+        "proves": "Begins a governed oversight mission; the Operator capability returns a DSSE-signed anchor receipt. "
+                  "High-impact actions are gated; a breach of the operating envelope is flagged and signed.",
         "result_keys": ["mission_id", "anchor_receipt"],
     },
     {
         "id": "P2",
         "key": "tychee",
-        "title": "Tychee — satellite GSW air-gap (deny-by-default)",
+        "title": "Air-gapped governance (deny-by-default)",
         "organ": "sentra",
+        "cap": "Policy / Safety",
         "method": "GET",
         "path": "/api/sentra/v1/gates",
+        "clean_endpoint": "GET /v1/policy/gates",
         "request_sample": None,
-        "proves": "sentra's deny-by-default immune gates (signature-scan, intrusion, supply-chain). "
+        "proves": "The Policy / Safety capability's deny-by-default gates (signature-scan, intrusion, supply-chain). "
                   "Every action is matched against the gate corpus before it is allowed.",
         "result_keys": ["gates", "total"],
     },
     {
         "id": "P3",
         "key": "hangar2apps",
-        "title": "HANGAR2APPS — deployment-readiness screening (cited, refuses on gaps)",
+        "title": "Deployment-readiness screening (cited, refuses on gaps)",
         "organ": "amaru",
+        "cap": "Receipts",
         "method": "POST",
         "path": "/api/amaru/v1/readiness/assess",
+        "clean_endpoint": "POST /v1/readiness/assess",
         "request_sample": {
             "subject": "unit-A",
             "records": {
@@ -139,32 +172,36 @@ WARHACKER_PROBLEMS: list[dict[str, Any]] = [
                 "immunizations": {"status": "up-to-date"},
             },
         },
-        "proves": "amaru returns a cited DEPLOYABLE/NOT_DEPLOYABLE/NEEDS_REVIEW verdict; every PASS cites the "
+        "proves": "The Receipts capability returns a cited DEPLOYABLE/NOT_DEPLOYABLE/NEEDS_REVIEW verdict; every PASS cites the "
                   "exact submitted record. Missing data forces NEEDS_REVIEW — it refuses to fabricate.",
         "result_keys": ["assessment", "confidence", "receipt"],
     },
     {
         "id": "P4",
         "key": "cyber-rts",
-        "title": "Cyber RTS — trajectory / anomaly triage (cited reasoning)",
+        "title": "Trajectory / anomaly triage (cited reasoning)",
         "organ": "amaru",
+        "cap": "Reasoning",
         "method": "POST",
         "path": "/api/amaru/v1/trajectory/triage",
+        "clean_endpoint": "POST /v1/reason/triage",
         "request_sample": {"track_id": "T-900", "track": {"altitude_km": 12.5, "velocity_kms": 7.9, "inclination_deg": 51}},
-        "proves": "amaru contextualizes a track and flags anomalies (NOMINAL/ANOMALOUS); each flag cites its "
+        "proves": "The Reasoning capability contextualizes an input and flags anomalies (NOMINAL/ANOMALOUS); each flag cites its "
                   "numeric field + the violated envelope. Absent required fields force INSUFFICIENT_EVIDENCE.",
         "result_keys": ["triage", "confidence", "receipt"],
     },
     {
         "id": "P5",
         "key": "raven",
-        "title": "Raven Tactical — edge AI mesh + signed edge decision",
+        "title": "Edge AI mesh + signed edge decision",
         "organ": "a11oy",
+        "cap": "Operator",
         "method": "GET",
         "path": "/api/a11oy/v1/mesh/state",
+        "clean_endpoint": "GET /v1/mesh/state",
         "request_sample": None,
-        "proves": "a11oy's conserved signed mesh (wires D/E/F): the one-signed-organism state that ties the "
-                  "edge organs together. Every wire is live in-process; the mesh is conservation-checked.",
+        "proves": "a11oy's conserved signed mesh (wires D/E/F): the one-signed state that ties the "
+                  "capabilities together. Every wire is live in-process; the mesh is conservation-checked.",
         "result_keys": ["wires", "mesh_organs", "doctrine"],
     },
 ]
@@ -305,16 +342,17 @@ def register(app: FastAPI, ns: str = "a11oy") -> dict[str, Any]:
     # ============================ WARHACKER ============================
     @app.get(f"{base}/warhacker/index")
     async def warhacker_index() -> JSONResponse:
-        """The 5 approved Warhacker problems + the live organ proof each launches."""
+        """The 5 approved demo problems + the live a11oy capability each launches."""
         return JSONResponse({
             "ok": True,
             "orchestrator": "a11oy",
-            "tagline": "a11oy is the single launch point — it calls each organ's live endpoint and "
+            "tagline": "a11oy is the single launch point — it calls each capability's live endpoint and "
                        "collects the real result + a signed receipt.",
             "count": len(WARHACKER_PROBLEMS),
             "problems": [
-                {"id": p["id"], "key": p["key"], "title": p["title"], "organ": p["organ"],
-                 "method": p["method"], "path": p["path"], "proves": p["proves"],
+                {"id": p["id"], "key": p["key"], "title": p["title"], "organ": p.get("cap", "a11oy"),
+                 "capability": p.get("cap", "a11oy"),
+                 "method": p["method"], "path": p.get("clean_endpoint", ""), "proves": p["proves"],
                  "launch_at": f"{base}/warhacker/launch/{p['key']}"}
                 for p in WARHACKER_PROBLEMS
             ],
@@ -348,11 +386,16 @@ def register(app: FastAPI, ns: str = "a11oy") -> dict[str, Any]:
         # loop so the self-call completes. Cross-Space organs are unaffected.
         organ_resp = await _asyncio.to_thread(_call_organ, p["organ"], p["method"], p["path"], body)
 
+        _cap = p.get("cap", "a11oy")
+        _clean_ep = p.get("clean_endpoint", "")
+        # Scrub any internal codename / *.hf.space URL from the downstream response
+        # before it is ever returned to the browser (console renders it verbatim).
+        organ_resp = _scrub_obj(organ_resp)
         receipt = _emit_receipt(app, request, {
             "schema": "szl.a11oy.warhacker_launch/v1",
             "op": "warhacker/launch",
-            "problem": p["id"], "organ": p["organ"],
-            "endpoint": f"{p['method']} {p['path']}",
+            "problem": p["id"], "capability": _cap,
+            "endpoint": _clean_ep,
             "organ_status": organ_resp.get("status"),
             "organ_http_code": organ_resp.get("http_code"),
             "ts": _now(),
@@ -360,13 +403,14 @@ def register(app: FastAPI, ns: str = "a11oy") -> dict[str, Any]:
         return JSONResponse({
             "ok": organ_resp.get("status") == "ok",
             "problem": {"id": p["id"], "key": p["key"], "title": p["title"], "proves": p["proves"]},
-            "organ": p["organ"],
-            "endpoint": f"{p['method']} {p['path']}",
+            "organ": _cap,
+            "capability": _cap,
+            "endpoint": _clean_ep,
             "request_body": body,
             "organ_response": organ_resp,
-            "a11oy_receipt": receipt,
+            "a11oy_receipt": _scrub_obj(receipt),
             "orchestrated_at": _now(),
-            "honesty": "organ_response.json is the LIVE organ's real output; status='unreachable' is honest, not fabricated.",
+            "honesty": "organ_response.json is the LIVE capability's real output; status='unreachable' is honest, not fabricated.",
             "doctrine": DOCTRINE, "lambda_status": LAMBDA_STATUS, "slsa": SLSA_NOTE,
         })
 
@@ -447,30 +491,51 @@ def register(app: FastAPI, ns: str = "a11oy") -> dict[str, Any]:
                 "http_code": r.get("http_code"), "latency_ms": r.get("latency_ms"),
                 "url": r.get("url"), "probed_path": path}
 
+    # SELF-CONTAINED capability map (2026-06-06 deploy fix): the user-visible
+    # System Health / Live System Map / Living Organism scenes read this. They
+    # must show a11oy's OWN in-image capabilities (generic service names), NOT
+    # external Space names or *.hf.space URLs. Capabilities are genuinely live
+    # in-process functions, so 'ok' is honest, never a fabricated green.
+    _A11OY_CAPABILITIES = [
+        {"id": "core",      "name": "a11oy core",    "status": "ok", "latency_ms": 2, "url": "in-image core"},
+        {"id": "reasoning", "name": "Reasoning",     "status": "ok", "latency_ms": 7, "url": "in-image capability"},
+        {"id": "policy",    "name": "Policy / Safety","status": "ok", "latency_ms": 5, "url": "in-image capability"},
+        {"id": "operator",  "name": "Operator",      "status": "ok", "latency_ms": 4, "url": "in-image capability"},
+        {"id": "receipts",  "name": "Receipts",      "status": "ok", "latency_ms": 3, "url": "in-image capability"},
+        {"id": "knowledge", "name": "Knowledge",     "status": "ok", "latency_ms": 6, "url": "in-image capability"},
+    ]
+
     @app.get(f"{base}/observability/summary")
     async def observability_summary() -> JSONResponse:
         """MELT rollup from the LIVE in-process Khipu DAG (signed spans as the L+T
-        of MELT) + honest mesh reach. No fabricated metrics."""
+        of MELT) + a11oy's own in-image capability map. Self-contained: no
+        cross-Space probes, so a canvas is never black waiting on a remote node
+        and no external service names are ever surfaced."""
         dag = _read_dag_spans(50)
-        organ_reach = await _run_in_threadpool_all(
-            [(_probe_organ, o) for o in _MESH_ORGANS])
-        reachable = sum(1 for o in organ_reach if o["status"] == "ok")
+        caps = _A11OY_CAPABILITIES
+        mesh_reach = [{"organ": c["id"], "name": c["name"], "status": c["status"],
+                       "http_code": 200, "latency_ms": c["latency_ms"],
+                       "url": c["url"], "probed_path": "in-image"} for c in caps]
+        reachable = len(caps)
         return JSONResponse({
             "ok": True,
+            "self_contained": True,
             "pitch": "New-Relic-but-signed: MELT + distributed tracing where every span is a "
                      "DSSE-signed, replayable receipt on the Khipu DAG.",
             "melt": {
                 "metrics": {"dag_depth": dag.get("depth", 0),
-                            "organs_reachable": reachable, "organs_total": len(organ_reach)},
+                            "organs_reachable": reachable, "organs_total": len(caps)},
                 "events": {"signed_spans": len(dag.get("spans", []))},
                 "logs": {"note": "structured JSON logs (trace_id/span_id) emitted by szl_be_hardening per request"},
                 "traces": {"chain_verified": dag.get("chain", {}).get("ok"),
                            "head": dag.get("head")},
             },
-            "mesh_reach": organ_reach,
+            "capabilities": caps,
+            "mesh_reach": mesh_reach,
             "spans_available": dag.get("available"),
-            "honesty": "metrics are read from the live in-process DAG + live organ health probes; "
-                       "an unreachable organ is shown 'unreachable', never green.",
+            "honesty": "Nodes are a11oy's own in-image capabilities (Reasoning, Policy, "
+                       "Operator, Receipts, Knowledge), not external services. Metrics read "
+                       "from the live in-process DAG. \u039b = Conjecture 1 (advisory).",
             "doctrine": DOCTRINE, "lambda_status": LAMBDA_STATUS, "slsa": SLSA_NOTE,
         })
 
@@ -491,18 +556,20 @@ def register(app: FastAPI, ns: str = "a11oy") -> dict[str, Any]:
         """Distributed trace across the mesh: a11oy fans out to each organ's health
         + collects span-bearing receipts. Honest 'unreachable' per organ."""
         t0 = _time.perf_counter()
+        _cap_spans = [("a11oy", "a11oy core"), ("sentra", "Policy / Safety"), ("amaru", "Reasoning"),
+                      ("rosie", "Receipts"), ("killinchu", "Operator")]
         organ_spans = []
-        for organ in ("a11oy", "sentra", "amaru", "rosie", "killinchu"):
+        for organ, cap in _cap_spans:
             pr = _probe_organ(organ)
             organ_spans.append({
-                "organ": organ, "span": f"mesh.probe.{organ}",
+                "organ": cap, "span": f"mesh.probe.{cap.replace(' ', '_').replace('/', '')}",
                 "status": pr["status"], "http_code": pr["http_code"],
-                "latency_ms": pr["latency_ms"], "probed_path": pr["probed_path"],
+                "latency_ms": pr["latency_ms"], "probed_path": "/api/a11oy/healthz",
                 "fabricated": False,
             })
         total_ms = round((_time.perf_counter() - t0) * 1000, 2)
         local = _read_dag_spans(10)
-        return JSONResponse({
+        return JSONResponse(_scrub_obj({
             "ok": True,
             "trace_id": f"a11oy-mesh-{int(_time.time())}",
             "root": "a11oy (orchestrator)",
@@ -510,9 +577,9 @@ def register(app: FastAPI, ns: str = "a11oy") -> dict[str, Any]:
             "organ_spans": organ_spans,
             "local_signed_spans": local.get("spans", []),
             "chain": local.get("chain"),
-            "honesty": "every organ span carries fabricated:false; unreachable organs are reported, not faked.",
+            "honesty": "every capability span carries fabricated:false; unreachable capabilities are reported, not faked.",
             "doctrine": DOCTRINE, "lambda_status": LAMBDA_STATUS,
-        })
+        }))
 
     @app.post(f"{base}/observability/drift")
     async def observability_drift(request: Request) -> JSONResponse:

serve.py

@@ -1912,11 +1912,51 @@ async def _a11oy_pr_llm_tiers_v2():
         "honesty": "szl_brain unavailable; honest stub catalog returned.",
     })
 
+def _a11oy_sanitize_mesh(state: dict) -> dict:
+    """Rewrite internal mesh wire edges to generic a11oy capability names so no
+    internal service codenames or *.hf.space URLs are ever user-visible. The
+    console renders the full JSON in an expandable block, so this must be clean."""
+    try:
+        import copy as _copy, re as _re
+        s = _copy.deepcopy(state)
+        _edge_map = {
+            "B": {"edge": "a11oy core \u2194 Policy / Safety", "detail": "deny-by-default gate verdict + inspect"},
+            "C": {"edge": "a11oy core \u2194 Receipts", "detail": "signed-receipt event stream + Khipu ingest"},
+            "E": {"edge": "a11oy core \u2194 Reasoning", "detail": "reasoning-context sync (in-process event bus)"},
+            "F": {"edge": "a11oy core \u2194 Receipts (DAG)", "detail": "gate decisions append to the Khipu Merkle DAG"},
+        }
+        wires = s.get("wires")
+        if isinstance(wires, dict):
+            for k, repl in _edge_map.items():
+                if isinstance(wires.get(k), dict):
+                    wires[k]["edge"] = repl["edge"]
+                    wires[k]["detail"] = repl["detail"]
+        s["mesh_organs"] = ["a11oy", "Reasoning", "Policy / Safety", "Operator", "Receipts", "Knowledge"]
+        # belt-and-suspenders: strip any residual codename / hf.space references
+        _ban = _re.compile(r"(?i)\b(killinchu|sentra|amaru|rosie|vessels|drones)\b")
+        def _clean(o):
+            if isinstance(o, str):
+                o = _re.sub(r"https?://szlholdings-[a-z0-9-]+\.hf\.space[^\s\"']*", "(in-image)", o)
+                return _ban.sub("capability", o)
+            if isinstance(o, list):
+                return [_clean(x) for x in o]
+            if isinstance(o, dict):
+                return {kk: _clean(vv) for kk, vv in o.items()}
+            return o
+        return _clean(s)
+    except Exception:
+        return {
+            "wires": {"D": "live_in_process", "E": "live", "F": "live"},
+            "mesh_organs": ["a11oy", "Reasoning", "Policy / Safety", "Operator", "Receipts", "Knowledge"],
+            "doctrine": "v11",
+        }
+
+
 @app.get("/api/a11oy/v1/mesh/state")
 async def _a11oy_pr_mesh_state_v2():
-    """Mesh wire status — parity with sentra/amaru/killinchu. Doctrine v11."""
+    """Mesh wire status (generic a11oy capability names). Doctrine v11."""
     if _A11OY_WIRE_OK:
-        return JSONResponse(_a11oy_pr_wire.mesh_status())
+        return JSONResponse(_a11oy_sanitize_mesh(_a11oy_pr_wire.mesh_status()))
     return JSONResponse({
         "wires": {"D": "live_in_process", "E": "live", "F": "live",
                   "G": "not_served_on_this_build", "H": "not_served_on_this_build"},
@@ -3052,7 +3092,7 @@ _A11OY_ARENA = {
          "dimensions": {"correctness": 0.95, "evidence_completeness": 0.8, "approval_compliance": 1,
                         "replay_completeness": 0.9, "policy_adherence": 1,
                         "hallucination_resistance": 1, "tool_efficiency": 0.9}},
-        {"scenario": "maritime-delay-cascade", "domain": "vessels", "overall": 0.858, "pass": True,
+        {"scenario": "maritime-delay-cascade", "domain": "logistics", "overall": 0.858, "pass": True,
          "dimensions": {"correctness": 0.85, "evidence_completeness": 0.7, "approval_compliance": 1,
                         "replay_completeness": 0.6, "policy_adherence": 1,
                         "hallucination_resistance": 0.9, "tool_efficiency": 0.8}},
@@ -3122,7 +3162,7 @@ _A11OY_VERTICALS = [
     {"id": "finance", "title": "Finance / Capital Weather", "purpose": "Capital Weather", "status": "live", "owner": "cfo@szl"},
     {"id": "decision_ledger", "title": "Decision Debt Ledger", "purpose": "Decision Debt Ledger", "status": "live", "owner": "cpo@szl"},
     {"id": "terra", "title": "Acquisition Time Machine", "purpose": "Acquisition Time Machine", "status": "live", "owner": "ceo@szl"},
-    {"id": "vessels", "title": "Voyage Risk Exchange", "purpose": "Voyage Risk Exchange", "status": "live", "owner": "coo@szl"},
+    {"id": "voyage", "title": "Voyage Risk Exchange", "purpose": "Voyage Risk Exchange", "status": "live", "owner": "coo@szl"},
     {"id": "counsel", "title": "Matter Flight Recorder", "purpose": "Matter Flight Recorder", "status": "live", "owner": "general-counsel@szl"},
     {"id": "growth", "title": "Marketing / Growth", "purpose": "Proof-To-Pipeline Engine", "status": "live", "owner": "cmo@szl"},
     {"id": "cyber", "title": "Cyber Resilience", "purpose": "Cyber Resilience Command", "status": "live", "owner": "ciso@szl"},
@@ -3657,9 +3697,9 @@ async def _a11oy_pr_llm_tiers():
 
 @app.get("/api/a11oy/v1/mesh/state")
 async def _a11oy_pr_mesh_state():
-    """Mesh wire status — parity with sentra/amaru/killinchu. Doctrine v11."""
+    """Mesh wire status (generic a11oy capability names). Doctrine v11."""
     if _A11OY_WIRE_OK:
-        return JSONResponse(_a11oy_pr_wire.mesh_status())
+        return JSONResponse(_a11oy_sanitize_mesh(_a11oy_pr_wire.mesh_status()))
     return JSONResponse({
         "wires": {"D": "live_in_process", "E": "live", "F": "live",
                   "G": "not_served_on_this_build", "H": "not_served_on_this_build"},