deploy(hf): sync szl-holdings/a11oy@9adabb6a301ee28c8023587e7a48768504449539 derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy 9adabb6a301ee28c8023587e7a48768504449539.
Files: 1211 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

a11oy_landing.html

@@ -396,6 +396,7 @@
     <button type="button" class="menu-toggle" id="menu-toggle" aria-label="Open menu" aria-controls="site-nav" aria-expanded="false">☰</button>
     <nav class="nav-links" id="site-nav">
       <a class="hide-sm" href="#surfaces">Surfaces</a>
+      <a class="hide-sm" href="/immune">IMMUNE</a>
       <a class="hide-sm" href="/ecosystem">Ecosystem</a>
       <a class="hide-sm" href="/anatomy-v5">Anatomy v5</a>
       <a class="hide-sm" href="#proof">The proof</a>
@@ -425,7 +426,7 @@
         <b>BLOCKED</b> instead of a confident guess.</p>
       <div class="cta-row">
         <a class="btn btn-primary" href="/console">Open the command center →</a>
-        <a class="btn btn-lattice" href="/ecosystem">Explore the ecosystem</a>
+        <a class="btn btn-lattice" href="/immune">Open IMMUNE</a>
         <a class="btn btn-ghost" href="/verify">Verify a receipt offline</a>
       </div>
       <div class="hero-stats">
@@ -498,7 +499,7 @@
     <a class="card surface-card" href="/console#mesh"><div class="ic">◇</div><h3>Mesh</h3><p>The BFT-quorum mesh graph — 3-of-4 consensus, live state read from <span class="mono">/api/a11oy/v1/mesh/state</span>.</p><div class="golinks"><span class="go">Open the mesh →</span></div></a>
     <a class="card surface-card" href="/formulas"><div class="ic">Σ</div><h3>Formulas</h3><p>The PURIQ agentic formula genome — live-recomputed values, each carrying its own Khipu receipt.</p><div class="golinks"><span class="go">Open /formulas →</span></div></a>
     <a class="card surface-card" href="/trust"><div class="ic">✓</div><h3>Evidence</h3><p>The trust center: the locked-8 with truthful Lean refs, Theorem&nbsp;U vs Conjecture&nbsp;1, the receipt ledger, offline verify.</p><div class="golinks"><span class="go">Open the evidence →</span></div></a>
-    <a class="card surface-card" href="/static/viz/router/"><div class="ic mono">⇄</div><h3>LLM Router</h3><p>STALE NOT_MEASURED · snapshot 2026-07-11. Router health is not live, not healthy, and not MEASURED.</p><div class="golinks"><span class="go">Open the router →</span></div></a>
+    <a class="card surface-card" href="/immune"><div class="ic">⬡</div><h3>IMMUNE</h3><p>Fail-closed Hukulla kernel (Channel A) plus Field lattice (Channel B): exile, mesh, quorum, delta. Hunt / isolate / deceive — never strike people. Same-origin tab. Never fabricates LIVE or PASS.</p><div class="golinks"><span class="go">Open /immune →</span></div></a>
   </div>
 </section>
 
@@ -751,7 +752,8 @@
         <a href="/verify">Verify a receipt</a>
         <a href="/living-anatomy">Living anatomy · 3D</a>
         <a href="/elite">killinchu · counter-UAS</a>
-        <a href="https://szlholdings-immune.hf.space" target="_blank" rel="noopener">IMMUNE · live investor demo</a></div>
+        <a href="/immune">IMMUNE · Hukulla + live kernel</a>
+        <a href="https://szlholdings-immune.hf.space" target="_blank" rel="noopener">IMMUNE kernel Space</a></div>
       <div class="lk"><strong style="color:var(--ink)">Evidence</strong>
         <a href="/trust">Trust center</a>
         <a href="/api/a11oy/v1/ledger">Receipt ledger</a>

a11oy_nav_wireup.py

@@ -63,6 +63,7 @@ _SURFACES = [
     ("/cockpit",        "\u2318",     "Command Cockpit"),                   # ⌘
     ("/sovereign",      "\u26D3",     "Sovereign Ledger"),                  # khipu health+spend
     ("/nemo",           "\u25C6",     "SZL-Nemo"),                          # ◆
+    ("/immune",         "\u2B21",     "IMMUNE"),                            # ⬡
     ("/autoreview",     "\u2713",     "Auto-Review (Governed Autonomy)"),   # ✓
     ("/factory",        "\u2699",     "Governed Factory"),                  # ⚙
     ("/constitution",   "\u00A7",     "Constitution"),                      # §
@@ -91,6 +92,7 @@ _SURFACE_GROUP_OF = {
     "/cockpit": "Sovereign & Agentic Core",
     "/sovereign": "Sovereign & Agentic Core",
     "/nemo": "Sovereign & Agentic Core",
+    "/immune": "Sovereign & Agentic Core",
     "/autoreview": "Sovereign & Agentic Core",
     "/factory": "Sovereign & Agentic Core",
     "/constitution": "Sovereign & Agentic Core",
@@ -209,7 +211,7 @@ _REL_MARKER = b'data-related-surfaces="qa10"'
 # Flagship surfaces that get the cross-link strip. /restraint-bench (the REAL
 # Restraint page) is used, not /restraint (generic shell fallthrough).
 _FLAGSHIP_PATHS = {
-    "/nemo", "/autoreview", "/factory", "/constitution",
+    "/nemo", "/immune", "/autoreview", "/factory", "/constitution",
     "/energy", "/agent-loop", "/quant", "/grc", "/restraint-bench",
     "/code", "/fleet-c2", "/living-anatomy",
 }
@@ -220,6 +222,7 @@ def _build_related_strip(current_path: str) -> bytes:
     other. Inline-styled (0 CDN). Honest labels; the current page is omitted."""
     rel = [
         ("/nemo", "SZL-Nemo"),
+        ("/immune", "IMMUNE"),
         ("/autoreview", "Auto-Review"),
         ("/factory", "Factory"),
         ("/constitution", "Constitution"),
@@ -558,6 +561,7 @@ if __name__ == "__main__":
     assert n2.count('data-related-surfaces="qa10"') == 1, "related strip must be idempotent"
     assert "Auto-Review" in n1 and "/autoreview" in n1, "strip must cross-link surfaces"
     assert "/restraint-bench" in n1, "strip must cross-link the real Restraint page"
+    assert "/immune" in n1, "strip must cross-link the IMMUNE tab"
     assert "/nemo" not in n1.split('data-related-surfaces="qa10"')[1].split("</nav>")[0], \
         "related strip must omit the current page (/nemo)"
     assert n1 == n2, "second nemo render must be byte-identical"

serve.py

@@ -4020,8 +4020,8 @@ try:
     # /api/a11oy/v1/immune/verdict and shows the REAL deny/allow + signals + signed
     # Khipu receipt digest. Title "Immune (Hukulla) — fail-closed egress gate". NEVER a
     # codename. Replaces the prior 200 SPA shell that read nothing real.
-    app.add_api_route("/immune", _ptg_serve("immune.html"), methods=["GET"], include_in_schema=False)
-    app.add_api_route("/a11oy/immune", _ptg_serve("immune.html"), methods=["GET"], include_in_schema=False)
+    app.add_api_route("/immune", _ptg_serve("immune.html"), methods=["GET", "HEAD"], include_in_schema=False)
+    app.add_api_route("/a11oy/immune", _ptg_serve("immune.html"), methods=["GET", "HEAD"], include_in_schema=False)
     # MATERIALS (Q'allariy) tab (2026-06-16): the honest, user-visible Verifiable
     # Alloy & Crystal Discovery surface. Standalone sovereign page (0 runtime CDN),
     # binds to live /api/a11oy/v1/materials/* — a crystal-novelty form that POSTs to

szl_immune.py

@@ -30,6 +30,16 @@ ENDPOINTS (dual-registered under /api/a11oy/v1/immune/* AND /v1/immune/*):
                     real feed; resets on restart — empty = IDLE, never faked).
   GET  /threats  -> the threats_full STIX/MITRE corpus.
   GET  /verify   -> re-walk the immune Khipu chain (judge-verifiable integrity).
+  GET  /kernel   -> same-origin probe of the public IMMUNE kernel Space
+                    (SZLHOLDINGS/immune /readyz). REACHABLE vs UNAVAILABLE only;
+                    never fabricates LIVE or PASS. write_ready is forwarded
+                    verbatim when the probe succeeds.
+  GET  /field    -> same-origin probe of Channel B Field catalog
+                    (SZLHOLDINGS/immune-lattice /api/field). RANGE cells
+                    compiled as hunt/isolate/deceive — never strike people.
+                    REACHABLE vs UNAVAILABLE only; never LIVE or PASS.
+                    Actuation is SIMULATED. This flagship does not become a
+                    second COP.
 
 INSPECTION LOGIC (byte-identical to serve.py's embedded immune block):
   _THREAT_SIGNATURES = ["DROP TABLE","rm -rf","<script","eval(","subprocess","../../etc"]
@@ -53,9 +63,12 @@ import collections
 import datetime
 import hashlib
 import json
+import os
 import secrets
 import threading
 import time
+import urllib.error
+import urllib.request
 from typing import Any, Optional
 
 from fastapi import Request
@@ -84,6 +97,24 @@ _LEAN_PROOFS = [
 _LOCKED_PROVEN = ["F1", "F4", "F7", "F11", "F12", "F18", "F19", "F22"]  # EXACTLY 8 @ c7c0ba17
 _KERNEL_COMMIT = "c7c0ba17"
 
+# Public kernel Space (Channel A). Browser CSP is connect-src 'self', so this
+# page cannot fetch hf.space directly — the product tab probes same-origin.
+# Channel B (immune-lattice) is the COP overlay sibling; its /readyz is intercepted
+# by the HF proxy (502 HTML). Do not treat that 502 as kernel death.
+_KERNEL_SPACE_URL = os.environ.get(
+    "IMMUNE_KERNEL_BASE", "https://szlholdings-immune.hf.space"
+).rstrip("/")
+_KERNEL_LATTICE_URL = os.environ.get(
+    "IMMUNE_LATTICE_BASE", "https://szlholdings-immune-lattice.hf.space"
+).rstrip("/")
+_KERNEL_TIMEOUT = float(os.environ.get("IMMUNE_KERNEL_TIMEOUT", "8"))
+_KERNEL_CACHE_TTL = float(os.environ.get("IMMUNE_KERNEL_CACHE_TTL", "8"))
+_KERNEL_UA = (
+    "Mozilla/5.0 (compatible; a11oy-immune-kernel-probe/1.0; +https://a-11-oy.com/immune)"
+)
+_KERNEL_CACHE: dict[str, Any] = {"at": 0.0, "payload": None}
+_FIELD_CACHE: dict[str, Any] = {"at": 0.0, "payload": None}
+
 # ---------------------------------------------------------------------------
 # REAL inspection logic — byte-identical to serve.py's embedded immune block.
 # ---------------------------------------------------------------------------
@@ -382,6 +413,157 @@ def _verify_chain() -> dict:
     }
 
 
+def _probe_json(url: str) -> tuple[Optional[int], Any, Optional[str]]:
+    """Public read-only GET. Fail closed: never invent a JSON body."""
+    req = urllib.request.Request(
+        url,
+        headers={"Accept": "application/json", "User-Agent": _KERNEL_UA},
+        method="GET",
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=_KERNEL_TIMEOUT) as resp:  # nosec - public read-only
+            raw = resp.read(65536)
+            status = int(getattr(resp, "status", 200) or 200)
+        text = raw.decode("utf-8", "replace").strip()
+        if not text:
+            return status, None, "empty body"
+        try:
+            return status, json.loads(text), None
+        except json.JSONDecodeError:
+            return status, None, "upstream non-JSON"
+    except urllib.error.HTTPError as exc:
+        return int(exc.code), None, "HTTP " + str(exc.code)
+    except Exception as exc:  # noqa: BLE001 — honest UNAVAILABLE, never crash the organ
+        return None, None, type(exc).__name__
+
+
+def _kernel(now: Optional[float] = None, probe=_probe_json) -> dict:
+    """Same-origin kernel probe. REACHABLE / UNAVAILABLE only — never LIVE or PASS."""
+    ts = time.time() if now is None else float(now)
+    cached = _KERNEL_CACHE.get("payload")
+    cached_at = float(_KERNEL_CACHE.get("at") or 0)
+    if cached and (ts - cached_at) < _KERNEL_CACHE_TTL:
+        out = dict(cached)
+        out["cached"] = True
+        return out
+
+    status, data, err = probe(_KERNEL_SPACE_URL + "/readyz")
+    body = data if isinstance(data, dict) else {}
+    write_ready = body.get("write_ready") if isinstance(body.get("write_ready"), bool) else None
+    authority = body.get("authority")
+    if isinstance(authority, dict):
+        key_id = authority.get("keyId") or authority.get("key_id") or authority.get("kid")
+        evidence_state = authority.get("evidenceState") or authority.get("evidence_state")
+    else:
+        key_id = body.get("keyId") or body.get("key_id") or body.get("kid")
+        evidence_state = body.get("evidenceState") or body.get("evidence_state")
+        authority = authority if authority is not None else evidence_state
+    ledger = body.get("receiptCount")
+    if ledger is None:
+        ledger = body.get("ledger")
+    reachable = status == 200 and isinstance(data, dict)
+    payload = {
+        "ok": reachable,
+        "reachability": "REACHABLE" if reachable else "UNAVAILABLE",
+        "write_ready": write_ready if reachable else None,
+        "authority": authority if reachable else None,
+        "evidence_state": evidence_state if reachable else None,
+        "key_id": key_id if reachable else None,
+        "ledger": ledger if reachable else None,
+        "blockers": body.get("blockers") if reachable else None,
+        "upstream_status": body.get("status") if reachable else None,
+        "upstream_http": status,
+        "error": None if reachable else (err or "kernel unobserved"),
+        "channel_a": {
+            "space": "SZLHOLDINGS/immune",
+            "url": _KERNEL_SPACE_URL,
+            "contract": "/readyz",
+        },
+        "channel_b": {
+            "space": "SZLHOLDINGS/immune-lattice",
+            "url": _KERNEL_LATTICE_URL,
+            "contract": "/api/field",
+            "note": "COP overlay sibling (Field cells). HF proxy intercepts /readyz; a 502 HTML there is not kernel death.",
+        },
+        "product_tab": "/immune",
+        "honesty": {
+            "lambda": "Conjecture 1 (NOT a theorem)",
+            "never_fabricate": ["LIVE", "PASS"],
+            "first_paint": "CONNECTING",
+            "failed_probe": "UNAVAILABLE",
+            "write_ready_true": "REACHABLE (not LIVE)",
+        },
+        "organ": _ORGAN_NAME,
+        "cached": False,
+    }
+    enveloped = _gov(payload, status="REAL" if reachable else "DEGRADED")
+    _KERNEL_CACHE["at"] = ts
+    _KERNEL_CACHE["payload"] = enveloped
+    return enveloped
+
+
+def _field(now: Optional[float] = None, probe=_probe_json) -> dict:
+    """Same-origin Channel B Field probe. REACHABLE / UNAVAILABLE only — never LIVE or PASS."""
+    ts = time.time() if now is None else float(now)
+    cached = _FIELD_CACHE.get("payload")
+    cached_at = float(_FIELD_CACHE.get("at") or 0)
+    if cached and (ts - cached_at) < _KERNEL_CACHE_TTL:
+        out = dict(cached)
+        out["cached"] = True
+        return out
+
+    status, data, err = probe(_KERNEL_LATTICE_URL + "/api/field")
+    body = data if isinstance(data, dict) else {}
+    reachable = status == 200 and isinstance(data, dict)
+    raw_cells = body.get("cells") if reachable else None
+    cells = raw_cells if isinstance(raw_cells, list) else None
+    raw_hunts = body.get("hunts") if reachable else None
+    hunts = None
+    if isinstance(raw_hunts, list):
+        hunts = []
+        for item in raw_hunts:
+            if not isinstance(item, dict):
+                continue
+            hunts.append({
+                "id": item.get("id"),
+                "name": item.get("name"),
+                "cluster": item.get("cluster") or item.get("attck") or item.get("pack"),
+            })
+    payload = {
+        "ok": reachable,
+        "reachability": "REACHABLE" if reachable else "UNAVAILABLE",
+        "lambda_status": body.get("lambda_status") if reachable else None,
+        "actuation": body.get("actuation") if reachable else None,
+        "rule": body.get("rule") if reachable else None,
+        "cells": cells,
+        "hunts": hunts,
+        "cell_count": len(cells) if cells is not None else None,
+        "upstream_http": status,
+        "error": None if reachable else (err or "field unobserved"),
+        "channel": "B",
+        "space": "SZLHOLDINGS/immune-lattice",
+        "contract": "/api/field",
+        "url": _KERNEL_LATTICE_URL + "/api/field",
+        "product_tab": "/immune",
+        "honesty": {
+            "lambda": "Conjecture 1 (NOT a theorem)",
+            "never_fabricate": ["LIVE", "PASS"],
+            "first_paint": "CONNECTING",
+            "failed_probe": "UNAVAILABLE",
+            "actuation": "SIMULATED",
+            "rule": "hunt isolate deceive — never strike people",
+            "not_a_second_cop": True,
+        },
+        "organ": _ORGAN_NAME,
+        "cached": False,
+        "field_doctrine": body.get("doctrine") if reachable else None,
+    }
+    enveloped = _gov(payload, status="REAL" if reachable else "DEGRADED")
+    _FIELD_CACHE["at"] = ts
+    _FIELD_CACHE["payload"] = enveloped
+    return enveloped
+
+
 # ---------------------------------------------------------------------------
 # Registration — dual-register under /api/{ns}/v1/immune/* AND /v1/immune/*.
 # Mirrors szl_kverify's add_api_route pattern. Registered BEFORE the SPA catch-
@@ -425,6 +607,12 @@ def register(app, ns: str = "a11oy") -> dict:
     async def _h_verify():  # noqa: ANN202
         return JSONResponse(_verify_chain())
 
+    async def _h_kernel():  # noqa: ANN202
+        return JSONResponse(_kernel())
+
+    async def _h_field():  # noqa: ANN202
+        return JSONResponse(_field())
+
     prefixes = [f"/api/{ns}/v1/immune", "/v1/immune"]
     routes: list[str] = []
     for p in prefixes:
@@ -435,8 +623,10 @@ def register(app, ns: str = "a11oy") -> dict:
         app.add_api_route(f"{p}/feed", _h_feed, methods=["GET"], include_in_schema=True)
         app.add_api_route(f"{p}/verdict", _h_verdict, methods=["POST", "GET"], include_in_schema=True)
         app.add_api_route(f"{p}/verify", _h_verify, methods=["GET"], include_in_schema=True)
+        app.add_api_route(f"{p}/kernel", _h_kernel, methods=["GET", "HEAD"], include_in_schema=True)
+        app.add_api_route(f"{p}/field", _h_field, methods=["GET", "HEAD"], include_in_schema=True)
         routes.extend([f"{p}/healthz", f"{p}/status", f"{p}/gates", f"{p}/threats",
-                       f"{p}/feed", f"{p}/verdict", f"{p}/verify"])
+                       f"{p}/feed", f"{p}/verdict", f"{p}/verify", f"{p}/kernel", f"{p}/field"])
 
     print(f"[{ns}] szl_immune routes registered "
           f"(Immune (Hukulla) fail-closed egress gate, {len(routes)} routes)", flush=True)

tools/readiness-harness/tabs.json

@@ -18,10 +18,10 @@
     "UNAVAILABLE": "The source or evidence is not available; no replacement value is fabricated."
   },
   "summary": {
-    "tabs": 141,
+    "tabs": 139,
     "endpoints": 100,
-    "tabsWithCitations": 36,
-    "staticTabs": 41
+    "tabsWithCitations": 35,
+    "staticTabs": 40
   },
   "endpoints": {
     "/api/a11oy/v1/lambda": {
@@ -3584,24 +3584,6 @@
         "failOnMissingCitation": false
       }
     },
-    {
-      "key": "estate",
-      "title": "estate",
-      "group": "Console",
-      "route": "/console#estate",
-      "endpoints": [
-        "/api/a11oy/v1/models/series-a",
-        "/api/a11oy/v1/honest"
-      ],
-      "citationsRequired": true,
-      "sampleLabelAllowed": false,
-      "static": false,
-      "degradedRules": {
-        "allowSampleLabel": false,
-        "failOnUnlabeledPlaceholder": true,
-        "failOnMissingCitation": true
-      }
-    },
     {
       "key": "evidence",
       "title": "evidence",
@@ -4040,21 +4022,6 @@
         "failOnMissingCitation": false
       }
     },
-    {
-      "key": "investor",
-      "title": "investor",
-      "group": "Console",
-      "route": "/console#investor",
-      "endpoints": [],
-      "citationsRequired": false,
-      "sampleLabelAllowed": false,
-      "static": true,
-      "degradedRules": {
-        "allowSampleLabel": false,
-        "failOnUnlabeledPlaceholder": true,
-        "failOnMissingCitation": false
-      }
-    },
     {
       "key": "kamay",
       "title": "KAMAY — Agentic Coding",

web/immune.html

@@ -3,8 +3,8 @@
 <head>
 <meta charset="UTF-8"/>
 <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
-<title>Immune (Hukulla) — fail-closed egress gate · SZL Holdings</title>
-<meta name="description" content="Honest operational view of the Immune organ (Quechua role 'Hukulla') — a fail-closed, deny-by-default egress gate. Status, trace, signature, and Khipu-chain evidence are shown only when returned by the live backend. Lambda = Conjecture 1; Khipu = Conjecture 2; trust never 100%."/>
+<title>IMMUNE — fail-closed kernel · SZL Holdings</title>
+<meta name="description" content="Public IMMUNE tab: Hukulla fail-closed egress gate, same-origin Channel A kernel probe, and Channel B Field lattice (exile/mesh/quorum/delta). Hunt/isolate/deceive — never strike people. Status is CONNECTING, REACHABLE, or UNAVAILABLE — never fabricated LIVE or PASS. Lambda = Conjecture 1; Khipu = Conjecture 2; trust never 100%."/>
 <!-- 0 runtime CDN (doctrine v11): system fonts only — no Google Fonts, no external assets. -->
 <style>
 :root{
@@ -69,6 +69,10 @@ textarea:focus,input:focus{outline:none;border-color:var(--teal-line);}
 button.run{margin-top:.6rem;padding:.55rem 1.1rem;border-radius:7px;border:1px solid var(--teal-line);background:var(--teal-soft);color:var(--teal);font-family:var(--mono);font-size:12px;letter-spacing:.06em;text-transform:uppercase;cursor:pointer;transition:.15s;}
 button.run:hover{background:rgba(95,179,163,.18);color:var(--cream);}
 button.run:focus-visible,.preset:focus-visible,.flag:focus-visible{outline:2px solid var(--teal);outline-offset:2px;}
+.kernel-actions{display:flex;flex-wrap:wrap;gap:.45rem;margin-top:.7rem;}
+.kernel-actions a,.kernel-actions button{min-height:44px;display:inline-flex;align-items:center;}
+#kernelFrameHost{margin-top:.8rem;}
+#kernelFrameHost iframe{width:100%;min-height:72vh;border:1px solid var(--gold-line);border-radius:8px;background:#000;}
 .preset{display:inline-block;margin:.3rem .3rem 0 0;padding:.2rem .5rem;border-radius:5px;border:1px solid var(--gold-line);color:var(--muted);font-family:var(--mono);font-size:10.5px;cursor:pointer;}
 .preset:hover{color:var(--cream);border-color:var(--teal-line);}
 .verdict-box{margin-top:.8rem;border:1px solid var(--gold-line);border-radius:8px;padding:.85rem 1rem;background:var(--panel2);font-family:var(--mono);font-size:12px;line-height:1.8;}
@@ -104,9 +108,10 @@ code{font-family:var(--mono);color:var(--teal);}
 <body>
 <div class="topbar">
   <span>SZL HOLDINGS</span><span class="sep">/</span><span>a11oy</span>
-  <span class="live"><span class="live-dot" id="liveDot"></span><span id="liveTag" aria-live="polite">IMMUNE · PROBING</span></span>
+  <span class="live"><span class="live-dot" id="liveDot"></span><span id="liveTag" aria-live="polite">IMMUNE · CONNECTING</span></span>
   <span class="switcher">
     <a class="flag active" href="/immune">Immune</a>
+    <a class="flag" href="/nemo">Nemo</a>
     <a class="flag" href="/energy">Energy</a>
     <a class="flag" href="/fleet-c2">Fleet C2</a>
     <a class="flag" href="/living-anatomy">Living Anatomy</a>
@@ -115,12 +120,21 @@ code{font-family:var(--mono);color:var(--teal);}
 </div>
 
 <div class="wrap">
-  <h1>Immune (Hukulla) — fail-closed egress gate<span class="badge" id="organBadge">deny-by-default · evidence pending</span></h1>
+  <h1>IMMUNE — fail-closed kernel<span class="badge" id="organBadge">deny-by-default · connecting</span></h1>
   <p class="lede">
-    The <b>Immune</b> organ (Quechua role <b>Hukulla</b>) is a <b>fail-closed, deny-by-default</b> egress gate.
-    Submitted actions are sent to the live threat-signature, size, and
-    <b>&Lambda;-gate</b> inspection path (MIN of supplied trust axes &lt; 0.5 &rarr; deny). When the backend
-    returns a Khipu receipt, its digest, sequence, signature, chain result, and trace context are shown below.
+    The <b>IMMUNE</b> kernel (organ role <b>Hukulla</b>) is a <b>fail-closed, deny-by-default</b> admission
+    and egress gate: SENTRA inspection, YAWAR SHA-256 receipts, HUKLLA tripwires, MESH 3-of-4, NEMO R1–R5.
+    This tab is first-class on a-11-oy.com. The public kernel lives at
+    <a href="https://szlholdings-immune.hf.space"><code>SZLHOLDINGS/immune</code></a>;
+    the COP overlay sibling is
+    <a href="https://szlholdings-immune-lattice.hf.space"><code>SZLHOLDINGS/immune-lattice</code></a>.
+    Neither Space is deleted. Channel B Field cells (RANGE.CLOUD.EXILE, RANGE.FALLBACK.MESH,
+    CERT.CELL.QUORUM, FIELD.LATTICE.DELTA) compile public Ukraine COP doctrine as
+    <b>hunt / isolate / deceive</b> — never strike people. RANGE twins only; actuation is SIMULATED.
+    This flagship tab cites the lattice; it is not a second COP. This page never fabricates <b>LIVE</b> or <b>PASS</b> —
+    first paint is <b>CONNECTING</b>; a failed probe is <b>UNAVAILABLE</b>; a successful
+    <code>/readyz</code> read is <b>REACHABLE</b> (and <b>WRITE-READY</b> only when the kernel says so).
+    Submitted actions below hit the live Hukulla inspection path (MIN of supplied trust axes < 0.5 &rarr; deny).
     No receipt or signature state is inferred by this page. Proven Lean backing:
     <code>ImmuneNeymanPearsonOpt.lean</code> (Neyman&ndash;Pearson-optimal egress) and
     <code>FrontierWelfordVariance.lean</code> (Welford online variance). These back the gate but are
@@ -128,6 +142,54 @@ code{font-family:var(--mono);color:var(--teal);}
     Khipu = Conjecture&nbsp;2; trust is never 100%; effectors simulated; no fabricated data.
   </p>
 
+  <div class="panel" id="kernelPanel">
+    <h2>Live kernel <span class="meta">GET /api/a11oy/v1/immune/kernel → SZLHOLDINGS/immune /readyz</span></h2>
+    <p class="lede" style="margin:.2rem 0 .6rem;font-size:.86rem;">
+      Same-origin probe so this page stays 0-CDN. Channel A is the public kernel.
+      Channel B is the lattice COP overlay — its <code>/readyz</code> is intercepted by the Hub proxy;
+      that 502 HTML is not kernel death. Click-to-embed is operator-initiated, never first-paint.
+    </p>
+    <div class="cards">
+      <div class="card"><div class="lbl">Reachability</div><div class="big" id="kReach">CONNECTING</div><div class="sub" id="kReachSub">first paint — not UNAVAILABLE</div></div>
+      <div class="card"><div class="lbl">Write-ready</div><div class="big" id="kWrite">—</div><div class="sub" id="kWriteSub">forwarded only when observed</div></div>
+      <div class="card"><div class="lbl">Authority</div><div class="big" id="kAuth">—</div><div class="sub" id="kAuthSub">never inferred PASS</div></div>
+      <div class="card"><div class="lbl">Receipts / kid</div><div class="big" id="kLedger">—</div><div class="sub" id="kKidSub">ledger + key id</div></div>
+    </div>
+    <div class="kv" id="kernelKv" aria-live="polite"><span class="k">status</span><span class="v">CONNECTING</span></div>
+    <div class="kernel-actions">
+      <a class="flag" href="https://szlholdings-immune.hf.space" target="_blank" rel="noopener">Open Channel A kernel</a>
+      <a class="flag" href="https://szlholdings-immune-lattice.hf.space" target="_blank" rel="noopener">Open Channel B lattice</a>
+      <a class="flag" href="https://github.com/szl-holdings/immune" target="_blank" rel="noopener">GitHub kernel</a>
+      <button class="run" id="embedBtn" type="button">Embed live kernel</button>
+    </div>
+    <div id="kernelFrameHost"></div>
+  </div>
+
+  <div class="panel" id="fieldPanel">
+    <h2>Field lattice <span class="meta">GET /api/a11oy/v1/immune/field → Channel B /api/field</span></h2>
+    <p class="lede" style="margin:.2rem 0 .6rem;font-size:.86rem;">
+      Same-origin probe of <code>SZLHOLDINGS/immune-lattice</code>. Cells are compiled as
+      hunt / isolate / deceive — never strike people. First paint is <b>CONNECTING</b>.
+      A failed probe is <b>UNAVAILABLE</b> (cells are not invented). A JSON catalog is
+      <b>REACHABLE</b>, not LIVE. This page is a citation, not a second COP.
+    </p>
+    <div class="cards">
+      <div class="card"><div class="lbl">Reachability</div><div class="big" id="fReach">CONNECTING</div><div class="sub" id="fReachSub">first paint — not UNAVAILABLE</div></div>
+      <div class="card"><div class="lbl">Λ / doctrine</div><div class="big" id="fDoc">—</div><div class="sub" id="fLam">Conjecture 1 — not a theorem</div></div>
+      <div class="card"><div class="lbl">Actuation</div><div class="big" id="fAct">—</div><div class="sub">SIMULATED only</div></div>
+      <div class="card"><div class="lbl">Rule</div><div class="big" id="fRule">—</div><div class="sub" id="fRuleSub">never strike people</div></div>
+    </div>
+    <div class="cards" id="fieldCells"></div>
+    <div class="kv" id="fieldKv" aria-live="polite"><span class="k">status</span><span class="v">CONNECTING</span></div>
+    <div class="kernel-actions">
+      <a class="flag" href="https://szlholdings-immune-lattice.hf.space" target="_blank" rel="noopener">Open Channel B lattice</a>
+      <a class="flag" href="https://github.com/szl-holdings/immune-lattice" target="_blank" rel="noopener">GitHub lattice</a>
+      <a class="flag" href="https://a11oy.net/" target="_blank" rel="noopener">Proof registry</a>
+      <button class="run" id="embedFieldBtn" type="button">Embed live lattice</button>
+    </div>
+    <div id="fieldFrameHost"></div>
+  </div>
+
   <div class="cards">
     <div class="card"><div class="lbl">Verdicts (this process)</div><div class="big" id="cVerdicts">—</div><div class="sub" id="cVerdictsSub">resets on restart</div></div>
     <div class="card"><div class="lbl">Deny rate</div><div class="big" id="cDenyRate">—</div><div class="sub" id="cDenySub">deny / total</div></div>
@@ -157,7 +219,7 @@ code{font-family:var(--mono);color:var(--teal);}
 
     <div class="panel">
       <h2>Live status <span class="meta" id="statusEp">GET /api/a11oy/v1/immune/status</span></h2>
-      <div class="kv" id="statusKv" aria-live="polite"><span class="k">status</span><span class="v">PROBING</span></div>
+      <div class="kv" id="statusKv" aria-live="polite"><span class="k">status</span><span class="v">CONNECTING</span></div>
       <div class="simnote" id="honestyNote">
         Λ = Conjecture 1 (NOT a theorem). Khipu = Conjecture 2. Trust never 100%. Effectors simulated.
         Decision feed is in-memory (resets on restart) — empty means IDLE, never faked.
@@ -178,7 +240,7 @@ code{font-family:var(--mono);color:var(--teal);}
   <div class="footnote" id="leanFoot">
     Proven Lean backing: Lutar/Wave11/ImmuneNeymanPearsonOpt.lean · Lutar/Innovations/round11/FrontierWelfordVariance.lean.
     Locked-proven set = EXACTLY 8 {F1,F4,F7,F11,F12,F18,F19,F22} @ kernel c7c0ba17 — the immune Lean backing is cited, NOT folded in.
-    SLSA L1/L2/L3-roadmap · 0 runtime CDN. This page reads only the live /api/a11oy/v1/immune/* endpoints.
+    SLSA L1/L2/L3-roadmap · 0 runtime CDN. This page reads only the live /api/a11oy/v1/immune/* endpoints (Hukulla organ + same-origin kernel and Field probes). Channel A = SZLHOLDINGS/immune. Channel B = SZLHOLDINGS/immune-lattice Field (exile/mesh/quorum/delta). Neither Space is deleted. Hunt / isolate / deceive — never strike people.
   </div>
 </div>
 
@@ -324,9 +386,107 @@ document.querySelectorAll(".preset").forEach(p=>p.addEventListener("click",()=>{
 }));
 document.getElementById("runBtn").addEventListener("click",runVerdict);
 
-async function loadAll(){ await Promise.all([loadStatus(),loadGates(),loadFeed()]); }
+function kernelAuthorityLabel(s){
+  if(!s||typeof s!=="object")return null;
+  if(present(s.evidence_state))return s.evidence_state;
+  if(typeof s.authority==="string")return s.authority;
+  if(s.authority&&typeof s.authority==="object"){
+    return s.authority.evidenceState||s.authority.evidence_state||s.authority.status||null;
+  }
+  return null;
+}
+
+async function loadKernel(){
+  const result = await requestJSON(BASE + "/kernel");
+  const kv = document.getElementById("kernelKv");
+  const s = result.data||{};
+  const reach = result.ok && s.reachability==="REACHABLE" ? "REACHABLE" : (result.ok||result.status!=null ? "UNAVAILABLE" : "UNAVAILABLE");
+  document.getElementById("kReach").textContent = reach;
+  document.getElementById("kReachSub").textContent = reach==="REACHABLE" ? "Channel A /readyz answered JSON" : requestFailure(result);
+  const writeReady = s.write_ready===true;
+  document.getElementById("kWrite").textContent = typeof s.write_ready==="boolean"?String(s.write_ready):"—";
+  document.getElementById("kWriteSub").textContent = writeReady?"WRITE-READY (not LIVE)":"not claimed";
+  const auth = kernelAuthorityLabel(s);
+  document.getElementById("kAuth").textContent = present(auth)?String(auth):"—";
+  document.getElementById("kLedger").textContent = present(s.ledger)?String(s.ledger):"—";
+  document.getElementById("kKidSub").textContent = present(s.key_id)?"kid "+s.key_id:"key id unobserved";
+  kv.innerHTML =
+    row("reachability",reach)+
+    row("write_ready",typeof s.write_ready==="boolean"?String(s.write_ready):null)+
+    row("evidence",s.evidence_state)+
+    row("key id",s.key_id)+
+    row("ledger",s.ledger)+
+    row("channel A",s.channel_a&&s.channel_a.space)+
+    row("channel B",s.channel_b&&s.channel_b.space)+
+    row("error",s.error||(!result.ok?requestFailure(result):null))+
+    row("observed at",s.fetchedAt||s.observed_at)+
+    '<div><span class="k">kernel</span><span class="pill '+(reach==="REACHABLE"?(writeReady?"green":"yellow"):"red")+'">'+esc(reach+(writeReady?" · WRITE-READY":""))+'</span></div>';
+}
+
+document.getElementById("embedBtn").addEventListener("click",function(){
+  const host=document.getElementById("kernelFrameHost");
+  if(host.querySelector("iframe"))return;
+  const f=document.createElement("iframe");
+  f.title="IMMUNE kernel Space";
+  f.src="https://szlholdings-immune.hf.space";
+  f.setAttribute("loading","lazy");
+  host.appendChild(f);
+  this.textContent="Kernel embedded";
+});
+
+async function loadField(){
+  const result = await requestJSON(BASE + "/field");
+  const kv = document.getElementById("fieldKv");
+  const s = result.data||{};
+  const reach = result.ok && s.reachability==="REACHABLE" ? "REACHABLE" : "UNAVAILABLE";
+  document.getElementById("fReach").textContent = reach;
+  document.getElementById("fReachSub").textContent = reach==="REACHABLE" ? "Channel B /api/field answered JSON" : requestFailure(result);
+  document.getElementById("fDoc").textContent = present(s.field_doctrine)?String(s.field_doctrine):(present(s.lambda_status)?String(s.lambda_status):"—");
+  document.getElementById("fLam").textContent = present(s.lambda_status)?String(s.lambda_status):"Conjecture 1 — not a theorem";
+  document.getElementById("fAct").textContent = present(s.actuation)?String(s.actuation):"—";
+  document.getElementById("fRule").textContent = present(s.rule)?String(s.rule).slice(0,42):"—";
+  document.getElementById("fRuleSub").textContent = "never strike people";
+  const host = document.getElementById("fieldCells");
+  const cells = Array.isArray(s.cells)?s.cells:[];
+  if(reach!=="REACHABLE" || !cells.length){
+    host.replaceChildren();
+  }else{
+    host.innerHTML = cells.map(function(c){
+      const name=c&&c.name||c&&c.id||"cell";
+      const verb=c&&c.verb||"—";
+      const take=c&&c.take||"";
+      return '<div class="card"><div class="lbl">'+esc(name)+'</div><div class="big">'+esc(verb)+'</div><div class="sub">'+esc(take)+'</div></div>';
+    }).join("");
+  }
+  kv.innerHTML =
+    row("reachability",reach)+
+    row("doctrine",s.field_doctrine)+
+    row("lambda",s.lambda_status)+
+    row("actuation",s.actuation)+
+    row("rule",s.rule)+
+    row("cells",typeof s.cell_count==="number"?String(s.cell_count):null)+
+    row("channel",s.space)+
+    row("error",s.error||(!result.ok?requestFailure(result):null))+
+    row("observed at",s.fetchedAt||s.observed_at)+
+    '<div><span class="k">field</span><span class="pill '+(reach==="REACHABLE"?"green":"red")+'">'+esc(reach)+'</span></div>';
+}
+
+document.getElementById("embedFieldBtn").addEventListener("click",function(){
+  const host=document.getElementById("fieldFrameHost");
+  if(host.querySelector("iframe"))return;
+  const f=document.createElement("iframe");
+  f.title="IMMUNE lattice Space";
+  f.src="https://szlholdings-immune-lattice.hf.space";
+  f.setAttribute("loading","lazy");
+  host.appendChild(f);
+  this.textContent="Lattice embedded";
+});
+
+async function loadAll(){ await Promise.all([loadStatus(),loadGates(),loadFeed(),loadKernel(),loadField()]); }
 loadAll();
 setInterval(loadStatus, 8000);
+setInterval(loadKernel, 8000);
+setInterval(loadField, 8000);
 </script>
 </body>
 </html>