chore(sync): mirror backend .py + Dockerfile to Space (hf-sync-backend)

Automated backend sync from szl-holdings/a11oy main via hf-sync-backend.
Updated (differed from the Space): Dockerfile, szl_energy_live.py, szl_energy_measured.py, szl_energy_operator.py
Deleted (gone from the repo + Dockerfile COPY set): (none)

Keeps the Space-built backend (serve.py + the Dockerfile-COPY'd .py
modules) identical to GitHub main so the Space never rebuilds from a
stale backend, new endpoints don't 404 there, and orphaned modules
removed from the repo don't linger in the Space tree.

Dockerfile

@@ -649,7 +649,7 @@ COPY web/formulas.html web/v4_fleet_panel.html web/operator.html web/fleet-c2.ht
 # physical-bounds) and szl_governed_api.py (govern/infer energy reference). Per-file
 # COPY (this Dockerfile uses no `COPY . .`) or the guarded import falls back and the
 # endpoint 404s / the govern receipt cannot cite the MEASURED reference.
-COPY knowledge.json szl_parity_gaps.py compliance_crosswalk.py szl_compliance_mesh.py a11oy_warhacker_obs.py serve.py szl_governed_api.py szl_demo_tier1.py szl_assurance.py govern_showcase.html a11oy_wireA_metrics.py cathedral.html a11oy_operator_organ.py a11oy_hf_assets.py szl_b2_secdata.py gates_manifest.json a11oy_code_orchestrator.py a11oy_agent_loop.py a11oy_org_rag.py a11oy_mcp_client.py szl_rag.py a11oy_code_ide.html wayra_serve.py wayra_snapshot.json wayra_digests_7d.json szl_khipu_os_routes.py szl_spaces_proxy.py szl_spaces_surface.py szl_khipu_consensus.py szl_puriq_formulas.py ayni_os_serve.py szl_live_wires.py live_wires.html live_wires_3d.js szl_intoto.py szl_intoto_routes.py szl_scitt.py szl_dsse.py szl_provenance.py szl_be_hardening.py szl_unay.py szl_khipu_lmdb.py szl_khipu_replicate.py szl_unay_routes.py szl_warhacker_aliases.py a11oy_v4_hickok.py szl_khipu.py szl_formulas.py a11oy_v4_formulas.py szl_anatomy_3d.py szl_anatomy_routes.py _vendor_blobs.py szl_v4_fleet.py operator_shell_v4.py szl_bridge.py szl_bridge_schemas.py agent.html a11oy_bridge_cli.py szl_ken.py a11oy_formula_endpoints.py a11oy_formula_registry_guard.py a11oy_formulas_page.py a11oy_frontier_patch.py a11oy_v4_agent.py szl_brain.py szl_wire.py szl_hub.py szl_rosie_companion.py szl_receipt_substrate.py szl_alloy_embed_fabric.py szl_ayni_quorum.py szl_agentic_loop.py szl_ltc_dynamics.py szl_sgh_scheduler.py szl_formula_wiring.py szl_formula_surfaces.py a11oy_code_engine.py a11oy_code_runloop.py a11oy_code.py a11oy_seismic.py szl_warhacker_real.py szl_warhacker_demos.py NOTICE_warhacker_demos.txt szl_llm_registry.py szl_elite_console.py szl_alloy_models.py szl_scaling.py szl_allodial.py szl_entanglement.py szl_neuroplasticity.py szl_neuromorphic.py szl_kan.py szl_titans.py szl_mor.py szl_ternary.py szl_agentmem.py szl_edgefusion.py szl_hybridssm.py szl_aigov.py szl_chain_of_title.py szl_sovereign_compute.py szl_a11oy_interpretability.py a11oy_active_flux_router.py szl_energy_budget.py szl_energy_sovereign.py szl_energy_provenance.py szl_heart_blood.py szl_engine_status.py szl_backend_hardening.py revenue_endpoints.py a11oy_harvest_endpoints.py joule_billing.py szl_durable_ledger.py szl_energy_ledger.py szl_energy_operator.py szl_energy_projection.py szl_cheapest_watt.py szl_energy_live.py szl_orbital_topology.py szl_orbital_projection.py a11oy_orbital_page.py a11oy_frontier_page.py szl_frontier_manifest.py szl_frontier_zkinfer.py szl_frontier_fmverif.py szl_frontier_supplychain.py a11oy_code_as_action.py a11oy_governed_kernel.py szl_lambda_tripwire.py szl_provenance_receipt.py szl_khipu_verify.py szl_attest_stack.py szl_demo_sign.py szl_sda.py szl_fabric_surface.py szl_nemo_agents.py szl_kverify.py szl_specdec.py szl_immune.py szl_quant_qbio_holo.py szl_materials.py szl_materials_predict.py a11oy_factory.py a11oy_constitution.py a11oy_nav_wireup.py szl_mbse_cosim.py szl_mbse_nav.py szl_mbse.py szl_factory.py szl_willay_gateway.py a11oy_willay_nav.py szl_waqay.py a11oy_waqay_nav.py szl_yupay.py a11oy_yupay_nav.py a11oy_uds_portability_nav.py szl_pinn_bounds.py szl_pinn_residual.py physical_bounds_certificate.json agentic_decision_trail.json physical_bounds_certificate.dsse.json szl_pinn_inverse.py szl_governed_ipinn.py szl_calphad_inverse.py szl_pnt_mesh.py quantum_sensing_limits.py pnt_resilience.py nav_coasting.py fundamental_limits.py szl_counter_uas_proxy.py szl_gpu_quant.py szl_joules_truth.py revenue_model.py szl_prod_hardening.py szl_resilience.py szl_observability.py szl_corpus_publish.py szl_lake_store.py szl_lake_ingest.py szl_e8.py szl_trajectory_sign.py szl_nemotron_ingest.py szl_nemotron_corpus.py szl_nemo_verify.py a11oy_nemo_core.py szl_restraint.py szl_sapa.py szl_sapa_patch.py szl_restraint_energy.py a11oy_react_core.py szl_org_lambda.py a11oy_canonical_domain.py a11oy_formula_tiers.py szl_physical_bounds.py szl_kc_loop_forge.py szl_kc_loop_forge_metrics.py szl_kc_atlas.py szl_eval_arena.py szl_vqc.py szl_kc_jpt.py ./
+COPY knowledge.json szl_parity_gaps.py compliance_crosswalk.py szl_compliance_mesh.py a11oy_warhacker_obs.py serve.py szl_governed_api.py szl_demo_tier1.py szl_assurance.py govern_showcase.html a11oy_wireA_metrics.py cathedral.html a11oy_operator_organ.py a11oy_hf_assets.py szl_b2_secdata.py gates_manifest.json a11oy_code_orchestrator.py a11oy_agent_loop.py a11oy_org_rag.py a11oy_mcp_client.py szl_rag.py a11oy_code_ide.html wayra_serve.py wayra_snapshot.json wayra_digests_7d.json szl_khipu_os_routes.py szl_spaces_proxy.py szl_spaces_surface.py szl_khipu_consensus.py szl_puriq_formulas.py ayni_os_serve.py szl_live_wires.py live_wires.html live_wires_3d.js szl_intoto.py szl_intoto_routes.py szl_scitt.py szl_dsse.py szl_provenance.py szl_be_hardening.py szl_unay.py szl_khipu_lmdb.py szl_khipu_replicate.py szl_unay_routes.py szl_warhacker_aliases.py a11oy_v4_hickok.py szl_khipu.py szl_formulas.py a11oy_v4_formulas.py szl_anatomy_3d.py szl_anatomy_routes.py _vendor_blobs.py szl_v4_fleet.py operator_shell_v4.py szl_bridge.py szl_bridge_schemas.py agent.html a11oy_bridge_cli.py szl_ken.py a11oy_formula_endpoints.py a11oy_formula_registry_guard.py a11oy_formulas_page.py a11oy_frontier_patch.py a11oy_v4_agent.py szl_brain.py szl_wire.py szl_hub.py szl_rosie_companion.py szl_receipt_substrate.py szl_alloy_embed_fabric.py szl_ayni_quorum.py szl_agentic_loop.py szl_ltc_dynamics.py szl_sgh_scheduler.py szl_formula_wiring.py szl_formula_surfaces.py a11oy_code_engine.py a11oy_code_runloop.py a11oy_code.py a11oy_seismic.py szl_warhacker_real.py szl_warhacker_demos.py NOTICE_warhacker_demos.txt szl_llm_registry.py szl_elite_console.py szl_alloy_models.py szl_scaling.py szl_allodial.py szl_entanglement.py szl_neuroplasticity.py szl_neuromorphic.py szl_kan.py szl_titans.py szl_mor.py szl_ternary.py szl_agentmem.py szl_edgefusion.py szl_hybridssm.py szl_aigov.py szl_chain_of_title.py szl_sovereign_compute.py szl_a11oy_interpretability.py a11oy_active_flux_router.py szl_energy_budget.py szl_energy_sovereign.py szl_energy_provenance.py szl_heart_blood.py szl_engine_status.py szl_backend_hardening.py revenue_endpoints.py a11oy_harvest_endpoints.py szl_energy_measured.py joule_billing.py szl_durable_ledger.py szl_energy_ledger.py szl_energy_operator.py szl_energy_projection.py szl_cheapest_watt.py szl_energy_live.py szl_orbital_topology.py szl_orbital_projection.py a11oy_orbital_page.py a11oy_frontier_page.py szl_frontier_manifest.py szl_frontier_zkinfer.py szl_frontier_fmverif.py szl_frontier_supplychain.py a11oy_code_as_action.py a11oy_governed_kernel.py szl_lambda_tripwire.py szl_provenance_receipt.py szl_khipu_verify.py szl_attest_stack.py szl_demo_sign.py szl_sda.py szl_fabric_surface.py szl_nemo_agents.py szl_kverify.py szl_specdec.py szl_immune.py szl_quant_qbio_holo.py szl_materials.py szl_materials_predict.py a11oy_factory.py a11oy_constitution.py a11oy_nav_wireup.py szl_mbse_cosim.py szl_mbse_nav.py szl_mbse.py szl_factory.py szl_willay_gateway.py a11oy_willay_nav.py szl_waqay.py a11oy_waqay_nav.py szl_yupay.py a11oy_yupay_nav.py a11oy_uds_portability_nav.py szl_pinn_bounds.py szl_pinn_residual.py physical_bounds_certificate.json agentic_decision_trail.json physical_bounds_certificate.dsse.json szl_pinn_inverse.py szl_governed_ipinn.py szl_calphad_inverse.py szl_pnt_mesh.py quantum_sensing_limits.py pnt_resilience.py nav_coasting.py fundamental_limits.py szl_counter_uas_proxy.py szl_gpu_quant.py szl_joules_truth.py revenue_model.py szl_prod_hardening.py szl_resilience.py szl_observability.py szl_corpus_publish.py szl_lake_store.py szl_lake_ingest.py szl_e8.py szl_trajectory_sign.py szl_nemotron_ingest.py szl_nemotron_corpus.py szl_nemo_verify.py a11oy_nemo_core.py szl_restraint.py szl_sapa.py szl_sapa_patch.py szl_restraint_energy.py a11oy_react_core.py szl_org_lambda.py a11oy_canonical_domain.py a11oy_formula_tiers.py szl_physical_bounds.py szl_kc_loop_forge.py szl_kc_loop_forge_metrics.py szl_kc_atlas.py szl_eval_arena.py szl_vqc.py szl_kc_jpt.py ./
 
 # DEV2 Build 1: TEE/TDX attestation hook (2026-06-30) — imported by serve.py (guarded);
 # MUST be per-file COPY'd or /api/a11oy/v1/tee/status + tee_attestation receipt field

szl_energy_live.py

@@ -41,6 +41,10 @@ from starlette.responses import JSONResponse
 # Honest labels (mirror szl_governed_api / szl_joules_truth vocabulary).
 LABEL_MEASURED = "MEASURED"
 LABEL_UNAVAILABLE = "UNAVAILABLE"
+# Per-inference GPU energy where the meter counts the WHOLE GPU and exclusivity is NOT
+# asserted: a real counter delta that may include co-tenant energy (an upper bound).
+# Emitted verbatim by ollama_energy_probe.py; NEVER upgraded to MEASURED here.
+LABEL_BOUNDED = "MEASURED_SHARED_BOUNDED"
 
 # The NVML exporter URL — SAME env the governed-inference GLM engine meters off.
 METER_URL = os.environ.get("SZL_GLM_METER", "https://meter2.a-11-oy.com").rstrip("/")
@@ -377,6 +381,29 @@ def _merged_engine_readings() -> dict:
     return out
 
 
+def _merged_model_readings() -> dict:
+    """Per-inference model energy from the MERGED multi-meter scrape, keyed by the model's
+    BASE name (tag stripped, lower-cased) → the probe's reading dict.
+
+    Populated by ollama_energy_probe.py → omen_joule_exporter.py models[] → the operator's
+    merged meter. Lets the GLM mesh node show its own MEASURED joules/token. Honest
+    (Doctrine v11): no models[] in the meter => empty map => the GLM node keeps its
+    UNAVAILABLE empty-state; a reading's label is carried VERBATIM (never upgraded)."""
+    try:
+        import szl_energy_operator as _op
+        meter = _op._fetch_joule_meter()
+    except Exception:  # noqa: BLE001 — operator/meter absent => empty map, honest fallback
+        return {}
+    out: dict = {}
+    for m in (meter or {}).get("models", []) or []:
+        raw = str(m.get("name") or "").strip().lower()
+        if not raw:
+            continue
+        base = raw.split(":", 1)[0]  # 'glm-4.7-flash:latest' → 'glm-4.7-flash'
+        out.setdefault(base, m)  # first-seen wins, mirrors engine merge
+    return out
+
+
 def build_mesh() -> dict:
     snap = meter_snapshot()
     reachable = bool(snap.get("reachable"))
@@ -386,6 +413,9 @@ def build_mesh() -> dict:
     # and the laptop's meters). This is what lets the laptop node pull its own engine's
     # watts/joules instead of showing null when its meter is a SEPARATE URL from METER_URL.
     engine_map = _merged_engine_readings()
+    # Per-inference model energy (keyed by base model name) for the GLM node — from the
+    # same merged meter scrape. Absent => GLM keeps its honest UNAVAILABLE empty-state.
+    model_map = _merged_model_readings()
 
     # Fallback attribution: match a meter GPU to a mesh node by GPU model token (e.g. the
     # node "…RTX 4060 Ti…" gets the meter GPU whose name label contains "RTX 4060 Ti").
@@ -418,7 +448,7 @@ def build_mesh() -> dict:
             source = "NVML" if g else "mesh-posture"
         if isinstance(watts, (int, float)):
             watt_vals.append(watts)
-        nodes.append({
+        node = {
             "name": n.get("name"),
             "role": n.get("role"),
             "live": n.get("live"),
@@ -426,7 +456,28 @@ def build_mesh() -> dict:
             "joules": joules,
             "joules_label": LABEL_MEASURED if isinstance(joules, (int, float)) else LABEL_UNAVAILABLE,
             "source": source,
-        })
+        }
+        # GLM node: attribute REAL per-inference energy from the probe's models[] entry.
+        # Matched by base model name. The probe's honest label (MEASURED /
+        # MEASURED_SHARED_BOUNDED / UNAVAILABLE) is carried VERBATIM — never upgraded.
+        # No fresh reading => the node keeps its UNAVAILABLE empty-state (null number).
+        if n.get("is_glm"):
+            base = str(n.get("model") or "").strip().lower().split(":", 1)[0]
+            m = model_map.get(base) if base else None
+            jpt = m.get("joules_per_token") if m else None
+            mlabel = (m.get("label") if m else None) or LABEL_UNAVAILABLE
+            if isinstance(jpt, (int, float)) and mlabel != LABEL_UNAVAILABLE:
+                node["joules_per_token"] = jpt
+                node["joules_per_token_label"] = mlabel  # verbatim, never upgraded
+                node["measurement_method"] = m.get("measurement_method")
+                node["exclusive"] = m.get("exclusive")
+                node["energy_joules"] = m.get("energy_joules")
+                node["output_tokens"] = m.get("output_tokens")
+                node["inference_source"] = m.get("source")
+            else:
+                node["joules_per_token"] = None
+                node["joules_per_token_label"] = LABEL_UNAVAILABLE
+        nodes.append(node)
 
     # Normalized 0..1 draw for visualization (relative to the busiest live node this tick).
     max_w = max(watt_vals) if watt_vals else 0.0
@@ -853,17 +904,24 @@ def _selftest() -> dict:
     # UNAVAILABLE, never fabricated. This is the regression this fix guards.
     _lap = "Sovereign GPU 1 (laptop · RTX 5050 · Blackwell)"
     _tow = "Sovereign GPU 2 (tower · RTX 4060 Ti · anchor)"
+    _glm = "GLM-4.7-Flash (sovereign · MIT · glm-4.7-flash)"
     _prev_posture = globals()["govern_posture"]
     _prev_readings = globals()["_merged_engine_readings"]
+    _prev_models = globals()["_merged_model_readings"]
     try:
-        # Deterministic posture (no network) with both nodes' engine labels wired.
+        # Deterministic posture (no network) with both nodes' engine labels wired,
+        # plus the GLM node (no exporter, is_glm=True, model tag for models[] match).
         globals()["govern_posture"] = lambda *a, **k: {
-            "available": True, "live_count": 2, "nodes": [
+            "available": True, "live_count": 3, "nodes": [
                 {"name": _tow, "role": "anchor", "gpu_model": "RTX 4060 Ti",
                  "exporter": "omen", "is_glm": False, "live": True},
                 {"name": _lap, "role": "blackwell", "gpu_model": "RTX 5050",
                  "exporter": "betterwithage", "is_glm": False, "live": True},
+                {"name": _glm, "role": "inference", "model": "glm-4.7-flash",
+                 "exporter": None, "is_glm": True, "live": True},
             ]}
+        # No probe reading by default → GLM node stays UNAVAILABLE (honest empty-state).
+        globals()["_merged_model_readings"] = lambda: {}
         # Reachable-but-empty single meter so the GPU-model fallback yields nothing
         # (proves attribution comes from the engine map, and null is honest when absent).
         with _snap_lock:
@@ -881,6 +939,9 @@ def _selftest() -> dict:
         assert by[_lap]["watts"] == 8.0 and by[_lap]["joules"] == 37000.0, by[_lap]
         assert by[_lap]["joules_label"] == LABEL_MEASURED and by[_lap]["source"] == "NVML", by[_lap]
         assert by[_tow]["watts"] == 13.53 and by[_tow]["joules"] == 15896.0, by[_tow]
+        # GLM node with no probe reading → honest UNAVAILABLE, joules_per_token null.
+        assert by[_glm]["joules_per_token"] is None, by[_glm]
+        assert by[_glm]["joules_per_token_label"] == LABEL_UNAVAILABLE, by[_glm]
 
         # Laptop engine absent (meter2 unreachable) → null, NEVER fabricated; tower unaffected.
         globals()["_merged_engine_readings"] = lambda: {"omen": {"watts": 13.53, "joules": 15896.0}}
@@ -889,13 +950,40 @@ def _selftest() -> dict:
         assert by3[_lap]["watts"] is None and by3[_lap]["joules"] is None, by3[_lap]
         assert by3[_lap]["joules_label"] == LABEL_UNAVAILABLE, by3[_lap]
         assert by3[_tow]["watts"] == 13.53, by3[_tow]
+
+        # (g) GLM per-inference energy: a fresh MEASURED_SHARED_BOUNDED reading in models[]
+        # is surfaced on the GLM node with the label carried VERBATIM (never upgraded).
+        globals()["_merged_model_readings"] = lambda: {
+            "glm-4.7-flash": {
+                "name": "glm-4.7-flash:latest", "joules_per_token": 0.42,
+                "energy_joules": 84.0, "output_tokens": 200,
+                "measurement_method": "counter-delta", "exclusive": False,
+                "label": LABEL_BOUNDED, "source": "pynvml.nvmlDeviceGetTotalEnergyConsumption",
+            }}
+        m4 = build_mesh()
+        by4 = {nd["name"]: nd for nd in m4["nodes"]}
+        assert by4[_glm]["joules_per_token"] == 0.42, by4[_glm]
+        assert by4[_glm]["joules_per_token_label"] == LABEL_BOUNDED, by4[_glm]
+        assert by4[_glm]["measurement_method"] == "counter-delta", by4[_glm]
+        assert by4[_glm]["exclusive"] is False, by4[_glm]
+
+        # A models[] entry whose own label is UNAVAILABLE is NOT surfaced as a number.
+        globals()["_merged_model_readings"] = lambda: {
+            "glm-4.7-flash": {"name": "glm-4.7-flash:latest", "joules_per_token": None,
+                              "label": LABEL_UNAVAILABLE}}
+        m5 = build_mesh()
+        by5 = {nd["name"]: nd for nd in m5["nodes"]}
+        assert by5[_glm]["joules_per_token"] is None, by5[_glm]
+        assert by5[_glm]["joules_per_token_label"] == LABEL_UNAVAILABLE, by5[_glm]
     finally:
         globals()["govern_posture"] = _prev_posture
         globals()["_merged_engine_readings"] = _prev_readings
+        globals()["_merged_model_readings"] = _prev_models
         with _snap_lock:
             _snap_cache["data"] = None
             _snap_cache["ts"] = 0.0
     out["mesh_laptop_attribution"] = True
+    out["mesh_glm_inference_energy"] = True
 
     out["ok"] = all(v is True for v in out.values())
     return out

szl_energy_measured.py

@@ -0,0 +1,408 @@
+# SPDX-License-Identifier: Apache-2.0
+# © 2026 Lutar, Stephen P. — SZL Holdings · ORCID 0009-0001-0110-4173
+# Doctrine v11 LOCKED: locked-proven=8 · Λ=Conjecture 1 · provenance 1.0
+# Co-Authored-By: Perplexity Computer Agent
+"""szl_energy_measured.py — the ENERGY surface's MEASURED channel.
+
+The `energy` (Energy · Harvest) surface was live-labelled STRUCTURAL-ONLY: its
+joules HUD never carried a real MEASURED reading because the served
+/api/a11oy/v1/harvest/posture endpoint had NO exporter sample off-box, so
+szl_joules_truth honestly returned label "sample" / STRUCTURAL-ONLY.
+
+This organ gives that surface a REAL MEASURED channel by reading the LIVE NVML
+joule meter (meter.a-11-oy.com, engine 'omen', ~6-20 W, joules climbing) the
+SAME way the JPT organ (szl_kc_jpt.py) and the One-Bit organ (szl_kc_onebit.py)
+do — via the env A11OY_JOULE_METER_URLS (comma-separated meter list, aggregated),
+with a browser-like UA + short timeout, fully guarded.
+
+HONESTY SPINE (Doctrine v11 — NON-NEGOTIABLE):
+  * MEASURED only from a REAL live meter reading THIS request. If NO meter env is
+    set or NO meter responds live this request, the channel is honest
+    STRUCTURAL-ONLY with a clear machine-readable `reason` — NEVER a fabricated joule.
+  * MONOTONIC-RESET DETECTION: this organ takes a joule reading BEFORE and AFTER a
+    tiny bounded settle window (or across two reads). If meter_after < meter_before
+    (tower reboot / NVML counter reset) we SKIP the reading, flag `meter_reset`, and
+    fall back to STRUCTURAL-ONLY — we never log a negative or fabricated delta.
+  * PROVENANCE on EVERY number: meter url, engine, exporter, meter ts, fetched-at.
+  * The honesty LABEL is decided SOLELY by szl_joules_truth (the single source of
+    truth shared with the operator / billing / kernel) — never off a flag. We only
+    build the exporter_sample; szl_joules_truth gates it MEASURED vs sample.
+  * Λ = Conjecture 1 — untouched (this organ never emits it).
+  * Pure stdlib only (urllib, json, os, time). Cite the meter/exporter, never ours.
+
+Public surface (consumed by a11oy_harvest_endpoints.handle_posture):
+  measured_channel(now=None) -> dict
+      Always returns a dict with a doctrine-stable schema:
+        {
+          "joules_label": "measured" | "sample",   # from szl_joules_truth
+          "measured": bool,                          # True only when live this request
+          "joules_evidence": dict,                   # {} unless measured
+          "exporter_sample": dict | None,            # the sample handed to joules_truth
+          "reason": str,                             # WHY structural/measured (honest)
+          "provenance": {meter_url, engine, exporter, meter_ts, fetched_at, method},
+          "power_w": float | None,
+          "joules_before": float | None,
+          "joules_after": float | None,
+          "meter_urls": [str, ...],
+        }
+
+A number here is MEASURED because it came from a live meter read with live=true
+NVML this request; it is NEVER a stale or fabricated constant.
+"""
+from __future__ import annotations
+
+import json as _json
+import os as _os
+import time as _time
+import urllib.request as _urllib_request
+from typing import Any, Dict, List, Optional
+
+DOCTRINE_VERSION = "v11"
+
+# The default omen meter (Cloudflare-fronted). Overridden by A11OY_JOULE_METER_URLS
+# (comma-separated) — the SAME env the JPT + One-Bit organs harness. Never hardcodes
+# a wattage; only selects WHERE to read a real reading from.
+_METER_URL_DEFAULT = "https://meter.a-11-oy.com/"
+
+_METER_PROBE_UA = _os.environ.get(
+    "SZL_PROBE_USER_AGENT",
+    "Mozilla/5.0 (compatible; szl-energy-measured/1.0; +https://a-11-oy.com)")
+try:
+    _METER_TIMEOUT_S = float(_os.environ.get("SZL_ENERGY_METER_TIMEOUT", "4.0"))
+except (TypeError, ValueError):
+    _METER_TIMEOUT_S = 4.0
+
+CITATIONS: Dict[str, str] = {
+    "meter": "meter.a-11-oy.com — omen-joule-exporter (real NVML via nvidia-smi)",
+    "exporter": "omen_joule_exporter.py (SZL fleet) reads NVIDIA NVML power via nvidia-smi",
+    "doctrine": "SZL joules doctrine v11 — MEASURED only from a live meter reading this request",
+    "joules_truth": "szl_joules_truth.py — the single source of truth for the joules honesty label",
+    "harness": ("A11OY_JOULE_METER_URLS — the comma-separated meter list the JPT (szl_kc_jpt.py) "
+                "and One-Bit (szl_kc_onebit.py) organs harness; adding a meter = adding a URL"),
+}
+
+
+def _joule_meter_urls() -> List[str]:
+    """Resolve the harnessed meter URL list at call time — the JPT/One-Bit way.
+
+    Priority:
+      1. A11OY_JOULE_METER_URLS (comma-separated) — the multi-meter harness form.
+      2. A11OY_JOULE_METER_URL (single) — the operator/One-Bit single-meter env.
+      3. Empty list when NEITHER is set (the sandbox default) — the organ then
+         honestly reports STRUCTURAL-ONLY (never fabricates a default reading).
+    Never fabricates a meter; only selects WHERE to read a real reading from.
+    """
+    multi = (_os.environ.get("A11OY_JOULE_METER_URLS") or "").strip()
+    urls = [u.strip() for u in multi.split(",") if u.strip()]
+    if urls:
+        return urls
+    single = (_os.environ.get("A11OY_JOULE_METER_URL") or "").strip()
+    if single:
+        return [single]
+    return []
+
+
+def _read_meter_raw(url: str, timeout: float) -> Optional[Dict[str, Any]]:
+    """GET the live joule-meter JSON, or None on ANY failure (unreachable/timeout/
+    non-200/malformed). Guarded — NEVER raises, NEVER fabricates. Browser-like UA so
+    the Cloudflare-fronted meter does not 403. Mirrors szl_kc_jpt._read_meter_raw /
+    szl_kc_onebit.read_live_meter transport."""
+    target = (url or _METER_URL_DEFAULT).strip()
+    try:
+        req = _urllib_request.Request(target, headers={"User-Agent": _METER_PROBE_UA})
+        with _urllib_request.urlopen(req, timeout=timeout) as r:  # noqa: S310
+            status = getattr(r, "status", None) or 200
+            if not (200 <= int(status) < 300):
+                return None
+            raw = r.read().decode("utf-8", "replace")
+        doc = _json.loads(raw)
+    except Exception:  # noqa: BLE001 — degrade honestly
+        return None
+    return doc if isinstance(doc, dict) else None
+
+
+def _live_engine(doc: Optional[Dict[str, Any]]) -> Optional[Dict[str, Any]]:
+    """Return the FIRST engine that carries a live=true GPU with a numeric power_w,
+    or None. HARD honesty gate (mirrors szl_kc_onebit): an engine with no live=true
+    real GPU reading is not a live reading and is dropped."""
+    if not isinstance(doc, dict):
+        return None
+    for e in (doc.get("engines") or []):
+        if not isinstance(e, dict):
+            continue
+        for g in (e.get("gpus") or []):
+            if isinstance(g, dict) and g.get("live") is True and isinstance(g.get("power_w"), (int, float)):
+                return e
+    return None
+
+
+def _engine_joules(engine: Optional[Dict[str, Any]], doc: Optional[Dict[str, Any]]) -> Optional[float]:
+    """Cumulative joules for the live engine (prefer engine.joules; fall back to
+    totals.joules). None if neither is numeric."""
+    if isinstance(engine, dict) and isinstance(engine.get("joules"), (int, float)):
+        return float(engine["joules"])
+    if isinstance(doc, dict):
+        totals = doc.get("totals") if isinstance(doc.get("totals"), dict) else {}
+        tj = totals.get("joules")
+        if isinstance(tj, (int, float)):
+            return float(tj)
+    return None
+
+
+def _engine_power_w(engine: Optional[Dict[str, Any]]) -> Optional[float]:
+    """First live GPU power_w on the engine (for the believable-envelope note)."""
+    if not isinstance(engine, dict):
+        return None
+    for g in (engine.get("gpus") or []):
+        if isinstance(g, dict) and g.get("live") is True and isinstance(g.get("power_w"), (int, float)):
+            return float(g["power_w"])
+    return None
+
+
+def _structural(reason: str, meter_urls: List[str], *,
+                provenance: Optional[Dict[str, Any]] = None,
+                joules_before: Optional[float] = None,
+                joules_after: Optional[float] = None) -> Dict[str, Any]:
+    """Build the honest STRUCTURAL-ONLY channel: joules_label 'sample', NO evidence,
+    NO fabricated joule — just a clear machine-readable reason + what provenance we
+    have. joules_truth is the single source of truth: with exporter_sample None it
+    returns ('sample', {}), so this stays doctrine-clean and self-verifying."""
+    label, evidence = _label_and_evidence(None)
+    return {
+        "joules_label": label,           # "sample" (STRUCTURAL-ONLY on the surface)
+        "measured": False,
+        "joules_evidence": evidence,     # {} — never fabricated
+        "exporter_sample": None,
+        "reason": reason,
+        "provenance": provenance or {
+            "meter_url": None, "engine": None, "exporter": None,
+            "meter_ts": None, "fetched_at": _time.time(),
+            "method": ("read live NVML joule meter (engine live=true) THIS request; "
+                       "measured only when the meter responds live"),
+        },
+        "power_w": None,
+        "joules_before": joules_before,
+        "joules_after": joules_after,
+        "meter_urls": list(meter_urls),
+        "doctrine": DOCTRINE_VERSION,
+        "citations": {k: CITATIONS[k] for k in ("meter", "exporter", "joules_truth", "harness")},
+    }
+
+
+def _label_and_evidence(exporter_sample: Optional[Dict[str, Any]],
+                        now: Optional[float] = None):
+    """Decide the honesty label + evidence via szl_joules_truth (the single source
+    of truth). Guarded fallback returns ('sample', {}) if the module is absent —
+    NEVER fabricates a measured claim."""
+    try:
+        from szl_joules_truth import joules_label as _jl, joules_evidence as _je
+        return _jl(exporter_sample, now=now), _je(exporter_sample, now=now)
+    except Exception:  # noqa: BLE001 — doctrine default is always sample
+        return "sample", {}
+
+
+def measured_channel(now: Optional[float] = None,
+                     meter_urls: Optional[List[str]] = None,
+                     timeout: Optional[float] = None) -> Dict[str, Any]:
+    """Read the LIVE NVML joule meter(s) and build the ENERGY surface's MEASURED
+    channel. Doctrine-stable schema (see module docstring). MEASURED only when a
+    meter responds live THIS request with a live=true NVML engine; otherwise honest
+    STRUCTURAL-ONLY with a reason. NEVER fabricates a joule; NEVER raises."""
+    now = _time.time() if now is None else float(now)
+    to = _METER_TIMEOUT_S if timeout is None else float(timeout)
+    urls = meter_urls if meter_urls is not None else _joule_meter_urls()
+
+    if not urls:
+        return _structural(
+            "no live meter env set (A11OY_JOULE_METER_URLS / A11OY_JOULE_METER_URL) — "
+            "STRUCTURAL-ONLY; no joule fabricated", urls)
+
+    # Iterate the harnessed meters; the FIRST that responds live wins (the omen anchor
+    # is first by default). A dead meter is skipped, never faked — others continue.
+    for url in urls:
+        before_doc = _read_meter_raw(url, to)
+        engine_b = _live_engine(before_doc)
+        if engine_b is None:
+            continue  # this meter is unreachable / has no live NVML reading — try next
+        j_before = _engine_joules(engine_b, before_doc)
+
+        # MONOTONIC-RESET DETECTION: read the meter a SECOND time and compare the
+        # cumulative counter. A tower reboot / NVML reset makes after < before; we
+        # then SKIP this meter honestly (flag meter_reset), never logging a negative
+        # or fabricated delta. When before is unavailable we cannot form a delta but
+        # a single live reading is still a real MEASURED reading (the counter is
+        # cumulative), so we proceed with the live reading and NO delta claim.
+        after_doc = _read_meter_raw(url, to)
+        engine_a = _live_engine(after_doc)
+        j_after = _engine_joules(engine_a, after_doc) if engine_a is not None else None
+
+        if (isinstance(j_before, (int, float)) and isinstance(j_after, (int, float))
+                and j_after < j_before):
+            # counter went backwards between two live reads this request -> reset.
+            return _structural(
+                ("meter_reset_detected: after (%.3f J) < before (%.3f J) — tower reboot / "
+                 "NVML counter reset; STRUCTURAL-ONLY, no delta logged"
+                 % (float(j_after), float(j_before))),
+                urls, joules_before=j_before, joules_after=j_after,
+                provenance={
+                    "meter_url": url,
+                    "engine": (engine_b.get("engine") if isinstance(engine_b, dict) else None),
+                    "exporter": (before_doc.get("exporter") if isinstance(before_doc, dict) else None),
+                    "meter_ts": (before_doc.get("ts") if isinstance(before_doc, dict) else None),
+                    "fetched_at": now,
+                    "method": "two live reads this request; after<before => reset => STRUCTURAL-ONLY",
+                })
+
+        # LIVE this request — build the exporter_sample and let szl_joules_truth gate it.
+        engine_name = str(engine_b.get("engine") or "unknown-engine")
+        power_w = _engine_power_w(engine_a) or _engine_power_w(engine_b)
+        # The cumulative joules to report: prefer the fresher AFTER reading; the
+        # counter is monotonic so after>=before here.
+        joules_now = j_after if isinstance(j_after, (int, float)) else j_before
+        exporter = None
+        for d in (after_doc, before_doc):
+            if isinstance(d, dict) and d.get("exporter") is not None:
+                exporter = str(d.get("exporter"))
+                break
+        meter_ts = None
+        for d in (after_doc, before_doc):
+            if isinstance(d, dict) and isinstance(d.get("ts"), (int, float)):
+                meter_ts = float(d.get("ts"))
+                break
+
+        # exporter_sample shape szl_joules_truth expects. exporter_last_seen_ts = now
+        # (we JUST read it live this request -> fresh by construction), so the single
+        # source of truth resolves this to MEASURED. If it is somehow judged stale, the
+        # helper honestly downgrades to sample and we surface STRUCTURAL-ONLY below.
+        exporter_sample = {
+            "joules_measured_total": joules_now,
+            "exporter_node": engine_name,
+            "exporter_last_seen_ts": now,
+            "power_w_sample": power_w,
+        }
+        label, evidence = _label_and_evidence(exporter_sample, now=now)
+        provenance = {
+            "meter_url": url,
+            "engine": engine_name,
+            "exporter": exporter,
+            "meter_ts": meter_ts,
+            "fetched_at": now,
+            "method": ("read live NVML joule meter (engine live=true) THIS request "
+                       "with monotonic-reset detection; measured only when live"),
+        }
+        if label != "measured":
+            # joules_truth judged it not fresh/real — honest STRUCTURAL-ONLY, no fabrication.
+            return _structural(
+                "meter responded but joules_truth judged the reading not fresh/real — "
+                "STRUCTURAL-ONLY (honest downgrade, no joule fabricated)",
+                urls, provenance=provenance,
+                joules_before=j_before, joules_after=j_after)
+
+        return {
+            "joules_label": label,             # "measured"
+            "measured": True,
+            "joules_evidence": evidence,       # real NVML evidence with provenance
+            "exporter_sample": exporter_sample,
+            "reason": ("MEASURED — live NVML meter responded with a live=true engine (%s) "
+                       "THIS request; cumulative joules climbing, monotonic-reset checked"
+                       % engine_name),
+            "provenance": provenance,
+            "power_w": power_w,
+            "joules_before": j_before,
+            "joules_after": j_after,
+            "meter_urls": list(urls),
+            "doctrine": DOCTRINE_VERSION,
+            "citations": {k: CITATIONS[k] for k in ("meter", "exporter", "joules_truth", "harness")},
+        }
+
+    # No harnessed meter responded live this request.
+    return _structural(
+        "no harnessed meter responded live this request (all unreachable / no live=true "
+        "NVML reading) — STRUCTURAL-ONLY; no joule fabricated", urls)
+
+
+# ======================================================================================
+# Self-test — MUST print ALL OK network-free.
+#   * No meter env => STRUCTURAL-ONLY, joules_label 'sample', evidence {}, no fabrication.
+#   * Synthetic live snapshot (omen) via injected reader => MEASURED with provenance.
+#   * Monotonic reset (after<before) => STRUCTURAL-ONLY meter_reset, no delta logged.
+# ======================================================================================
+if __name__ == "__main__":
+    import sys as _sys
+
+    # ---- (a) network-free: no meter env, unreachable url => honest STRUCTURAL-ONLY ----
+    ch = measured_channel(meter_urls=["http://127.0.0.1:1/nope"], timeout=0.2)
+    assert ch["measured"] is False, ch
+    assert ch["joules_label"] == "sample", ch["joules_label"]
+    assert ch["joules_evidence"] == {}, "STRUCTURAL-ONLY must carry NO evidence"
+    assert ch["reason"], "STRUCTURAL-ONLY must carry a reason"
+    print("(a) unreachable meter => STRUCTURAL-ONLY:", ch["reason"][:70])
+
+    ch0 = measured_channel(meter_urls=[])
+    assert ch0["measured"] is False and ch0["joules_label"] == "sample", ch0
+    assert "no live meter env" in ch0["reason"], ch0["reason"]
+    print("(a2) no meter env => STRUCTURAL-ONLY:", ch0["reason"][:70])
+
+    # ---- (b) synthetic live snapshot (matches /home/user/workspace/w27 shape) ----
+    # Prove the code path that WOULD produce MEASURED given a live meter delta, by
+    # monkeypatching the raw reader to return a live omen snapshot (real NVML shape).
+    _SNAP = {
+        "engines": [{"engine": "omen", "joules": 6937.669,
+                     "gpus": [{"index": 0, "name": "NVIDIA GeForce RTX 4060 Ti",
+                               "power_w": 6.17, "joules": 6937.669, "live": True}]}],
+        "totals": {"joules": 6937.669},
+        "exporter": "omen-joule-exporter (real NVML via nvidia-smi)",
+        "ts": 1783435960.4713373,
+    }
+    _seq = {"n": 0}
+
+    def _fake_read(url, timeout):  # noqa: ANN001 — climbing counter across two reads
+        d = _json.loads(_json.dumps(_SNAP))
+        # second read this request: counter climbed a hair (real omen ~6-20W)
+        bump = 0.031 * _seq["n"]
+        d["engines"][0]["joules"] = round(6937.669 + bump, 3)
+        d["engines"][0]["gpus"][0]["joules"] = d["engines"][0]["joules"]
+        d["totals"]["joules"] = d["engines"][0]["joules"]
+        _seq["n"] += 1
+        return d
+
+    _orig = _read_meter_raw
+    globals()["_read_meter_raw"] = _fake_read
+    try:
+        chm = measured_channel(meter_urls=["https://meter.a-11-oy.com/"])
+    finally:
+        globals()["_read_meter_raw"] = _orig
+    assert chm["measured"] is True, chm
+    assert chm["joules_label"] == "measured", chm["joules_label"]
+    assert chm["joules_evidence"], "MEASURED must carry NVML evidence"
+    assert chm["provenance"]["engine"] == "omen", chm["provenance"]
+    assert chm["provenance"]["meter_url"] == "https://meter.a-11-oy.com/"
+    assert chm["power_w"] == 6.17, chm["power_w"]
+    assert chm["joules_after"] >= chm["joules_before"], "monotonic: after >= before"
+    print("(b) synthetic live omen snapshot => MEASURED, power_w=%s J=%s engine=%s"
+          % (chm["power_w"], chm["joules_after"], chm["provenance"]["engine"]))
+
+    # ---- (c) monotonic reset: after < before => STRUCTURAL-ONLY meter_reset ----
+    _rseq = {"n": 0}
+
+    def _fake_reset(url, timeout):  # noqa: ANN001 — counter goes BACKWARDS (reboot)
+        d = _json.loads(_json.dumps(_SNAP))
+        val = 6937.669 if _rseq["n"] == 0 else 12.5  # after << before (reset)
+        d["engines"][0]["joules"] = val
+        d["engines"][0]["gpus"][0]["joules"] = val
+        d["totals"]["joules"] = val
+        _rseq["n"] += 1
+        return d
+
+    globals()["_read_meter_raw"] = _fake_reset
+    try:
+        chr_ = measured_channel(meter_urls=["https://meter.a-11-oy.com/"])
+    finally:
+        globals()["_read_meter_raw"] = _orig
+    assert chr_["measured"] is False, chr_
+    assert "meter_reset_detected" in chr_["reason"], chr_["reason"]
+    assert chr_["joules_evidence"] == {}, "reset must carry NO fabricated evidence"
+    print("(c) counter reset (after<before) => STRUCTURAL-ONLY:", chr_["reason"][:70])
+
+    print("ALL OK")
+    _sys.exit(0)

szl_energy_operator.py

@@ -561,8 +561,10 @@ def _fetch_joule_meter(timeout: float = 4.0) -> Optional[dict]:
     if len(urls) == 1:
         return _fetch_one_meter(urls[0], timeout)
     merged_engines: list[dict] = []
+    merged_models: list[dict] = []
     total = 0.0
     seen_names: set = set()
+    seen_models: set = set()
     any_ok = False
     for u in urls:
         d = _fetch_one_meter(u, timeout)
@@ -577,9 +579,20 @@ def _fetch_joule_meter(timeout: float = 4.0) -> Optional[dict]:
             merged_engines.append(e)
             if isinstance(e.get("joules"), (int, float)):
                 total += float(e["joules"])
+        # Preserve per-inference model readings additively (first-seen wins on name,
+        # mirroring the engine merge). Honest: an absent models[] contributes nothing.
+        for m in (d.get("models") or []):
+            mname = str(m.get("name") or "").lower()
+            if not mname or mname in seen_models:
+                continue
+            seen_models.add(mname)
+            merged_models.append(m)
     if not any_ok:
         return None
-    return {"engines": merged_engines, "totals": {"joules": round(total, 3)}}
+    out: dict = {"engines": merged_engines, "totals": {"joules": round(total, 3)}}
+    if merged_models:
+        out["models"] = merged_models
+    return out
 
 
 def _exporter_sample_for_node(meter: Optional[dict], exporter_node: str,