Spaces:

SZLHOLDINGS
/

a11oy

Running

App Files Files Community

betterwithage Claude Opus 4.7 commited on 18 days ago

Commit

5fa6996

verified ·

1 Parent(s): 06fda08

deploy(hf): sync szl-holdings/a11oy@c735a0be78f11a56fd089ef76cbe7bf9b035ed10 derived COPY set

Browse files

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy c735a0be78f11a56fd089ef76cbe7bf9b035ed10.
Files: 1343 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Files changed (4) hide show

console/3d/aegis-proof-cells.html +157 -0
console/3d/aegis-proof-cells/app.mjs +272 -0
console/3d/aegis-proof-cells/registry.json +321 -0
console/3d/aegis-proof-cells/styles.css +262 -0

console/3d/aegis-proof-cells.html ADDED Viewed

	@@ -0,0 +1,157 @@

+<!doctype html>
+<html lang="en" data-szl-public-experience-v3="true" data-aegis-proof-cells="v1">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
+  <meta name="description" content="Aegis Proof Cells: a governed, defensive, evidence-preserving investigation planner.">
+  <title>Aegis Proof Cells — SZL Holdings</title>
+  <link rel="stylesheet" href="/static/3d/aegis-proof-cells/styles.css?v=5b85354daf5fd09abea415bbad6a4c87f1c8a14f6cb7b62ded77637323461019">
+  <script type="module" src="/static/3d/aegis-proof-cells/app.mjs?v=ef16f51b2182701d9950c1ffa6dc22965f52df27f29a35a7fe7e67c433c20df9"></script>
+</head>
+<body>
+<a class="skip" href="#main">Skip to Aegis Proof Cells</a>
+<main id="main">
+  <header>
+    <div class="eyebrow">Aegis / Governed Defensive Operations</div>
+    <h1>Proof Cells</h1>
+    <p class="lede">
+      A coordinated defensive investigation workbench built around tenant isolation,
+      evidence continuity, explicit procedure capsules, analyst approval, and deterministic
+      Proof Chain receipts.
+    </p>
+    <div class="truth-banner" id="boot-state" role="status" aria-live="polite">
+      Original SZL/Aegis implementation. Bricklayer.ai public materials are architectural
+      references only. No Bricklayer source, prompts, site copy, visual identity, or private
+      implementation is included. External writes and effectors are disabled.
+    </div>
+  </header>
+  <section class="metrics" aria-label="Capability status">
+    <article class="metric">
+      <span class="metric-label">Proof cells</span>
+      <strong id="cell-count">11</strong>
+    </article>
+    <article class="metric">
+      <span class="metric-label">Procedure capsules</span>
+      <strong id="capsule-count">6</strong>
+    </article>
+    <article class="metric">
+      <span class="metric-label">Operating mode</span>
+      <strong id="mode">DEFENSIVE READ-ONLY</strong>
+    </article>
+  </section>
+  <section class="layout">
+    <article class="panel">
+      <div class="eyebrow">Investigation planner</div>
+      <h2>Evaluate a defensive case</h2>
+      <p>
+        The planner returns a deterministic cell sequence and decision state. It never
+        executes containment, remediation, credential access, or external writes.
+      </p>
+      <form id="case-form">
+        <label>
+          Tenant ID
+          <input name="tenant_id" value="tenant-demo" autocomplete="off" required>
+        </label>
+        <label>
+          Passport tenant ID
+          <input name="passport_tenant_id" value="tenant-demo" autocomplete="off" required>
+        </label>
+        <label>
+          Alert ID
+          <input name="alert_id" value="alert-001" autocomplete="off">
+        </label>
+        <label>
+          Source
+          <input name="source" value="SIEM" autocomplete="off">
+        </label>
+        <label>
+          Mission
+          <select name="mission">
+            <option value="alert-triage">Alert triage</option>
+            <option value="phishing">Phishing investigation</option>
+            <option value="endpoint">Endpoint investigation</option>
+            <option value="vulnerability">Vulnerability prioritization</option>
+            <option value="cloud">Cloud posture review</option>
+            <option value="threat-intel">Threat intelligence brief</option>
+          </select>
+        </label>
+        <label>
+          Requested action
+          <select name="requested_action">
+            <option value="investigate">Investigate</option>
+            <option value="draft-report">Draft report</option>
+            <option value="block-indicator">Block indicator</option>
+            <option value="isolate-host">Isolate host</option>
+            <option value="disable-account">Disable account</option>
+            <option value="purge-email">Purge email</option>
+            <option value="remediate">Remediate</option>
+          </select>
+        </label>
+        <label>
+          Severity
+          <select name="severity">
+            <option>LOW</option>
+            <option selected>MEDIUM</option>
+            <option>HIGH</option>
+            <option>CRITICAL</option>
+          </select>
+        </label>
+        <label>
+          Evidence atom count
+          <input name="evidence_count" type="number" min="0" max="1000" value="3">
+        </label>
+        <label class="checkbox">
+          <input name="evidence_fresh" type="checkbox" checked>
+          Evidence is current
+        </label>
+        <label class="checkbox">
+          <input name="human_approved" type="checkbox">
+          Human approval recorded
+        </label>
+        <button type="submit">Generate governed plan</button>
+      </form>
+      <div class="status">Decision: <strong id="decision-state">UNAVAILABLE</strong></div>
+      <pre id="case-result" aria-live="polite">Submit the case to generate a deterministic, effect-free plan.</pre>
+    </article>
+    <aside class="panel">
+      <div class="eyebrow">Evidence bus</div>
+      <h2>Read-only A11oy security context</h2>
+      <p>
+        These probes call same-origin defensive evidence routes. A failed source remains
+        <strong>UNAVAILABLE</strong>; it is never upgraded to live evidence.
+      </p>
+      <button id="refresh-evidence" type="button">Refresh evidence sources</button>
+      <div class="status" id="evidence-state">Not observed</div>
+      <pre id="evidence-output" aria-live="polite">Evidence sources have not been probed.</pre>
+    </aside>
+  </section>
+  <section aria-labelledby="cells-heading">
+    <div class="section-heading">
+      <div class="eyebrow">Specialist workforce</div>
+      <h2 id="cells-heading">Eleven bounded Proof Cells</h2>
+      <p class="lede">
+        Every cell receives the same Tenant Passport and accumulates typed Evidence Atoms.
+        Handoffs preserve source, freshness, procedure, hypothesis, decision, and outcome context.
+      </p>
+    </div>
+    <div class="cells" id="cells"></div>
+  </section>
+  <footer>
+    <p>
+      Registry SHA-256: <code>6dbffba48d8c1204f4c6586695705718f4d15b8232377606ff553230761c7880</code>. JavaScript SHA-256:
+      <code>ef16f51b2182701d9950c1ffa6dc22965f52df27f29a35a7fe7e67c433c20df9</code>. CSS SHA-256: <code>5b85354daf5fd09abea415bbad6a4c87f1c8a14f6cb7b62ded77637323461019</code>.
+    </p>
+    <p>
+      Defensive decision support only. No affiliation with Bricklayer AI. No production
+      action is authorized by this page or its MODELED score. Inspect the
+      <a href="/static/3d/aegis-proof-cells/registry.json">machine registry</a>.
+    </p>
+  </footer>
+</main>
+</body>
+</html>

console/3d/aegis-proof-cells/app.mjs ADDED Viewed

	@@ -0,0 +1,272 @@

+const ALLOWED_MISSIONS = new Set([
+  "alert-triage",
+  "phishing",
+  "endpoint",
+  "vulnerability",
+  "cloud",
+  "threat-intel",
+]);
+const PROHIBITED_TOKENS = [
+  "exploit",
+  "exfiltrate",
+  "credential theft",
+  "steal credential",
+  "dump credential",
+  "deploy malware",
+  "ransomware",
+  "disable security",
+  "evade detection",
+  "persistence",
+  "lateral movement",
+  "destructive",
+];
+const APPROVAL_ACTIONS = new Set([
+  "block-indicator",
+  "isolate-host",
+  "disable-account",
+  "purge-email",
+  "remediate",
+]);
+export function canonicalJSONString(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJSONString).join(",")}]`;
+  }
+  const keys = Object.keys(value).sort();
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJSONString(value[key])}`).join(",")}}`;
+}
+export async function sha256Hex(text) {
+  const bytes = new TextEncoder().encode(text);
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+  return Array.from(new Uint8Array(digest), (value) => value.toString(16).padStart(2, "0")).join("");
+}
+function normalizeText(value) {
+  return String(value ?? "").trim();
+}
+function normalizedBoolean(value) {
+  if (typeof value === "boolean") return value;
+  return ["1", "true", "yes", "on"].includes(normalizeText(value).toLowerCase());
+}
+function capsuleFor(registry, mission) {
+  return registry.procedure_capsules.find((item) => item.mission === mission) ?? null;
+}
+function prohibitedAction(action) {
+  const normalized = normalizeText(action).toLowerCase();
+  return PROHIBITED_TOKENS.some((token) => normalized.includes(token));
+}
+export function evaluateCase(input, registry) {
+  const tenantId = normalizeText(input.tenant_id);
+  const passportTenantId = normalizeText(input.passport_tenant_id);
+  const mission = normalizeText(input.mission).toLowerCase();
+  const requestedAction = normalizeText(input.requested_action).toLowerCase() || "investigate";
+  const alertId = normalizeText(input.alert_id) || "UNAVAILABLE";
+  const source = normalizeText(input.source) || "UNAVAILABLE";
+  const severity = normalizeText(input.severity).toUpperCase() || "UNAVAILABLE";
+  const evidenceCount = Number.parseInt(String(input.evidence_count ?? "0"), 10);
+  const evidenceFresh = normalizedBoolean(input.evidence_fresh);
+  const humanApproved = normalizedBoolean(input.human_approved);
+  const capsule = capsuleFor(registry, mission);
+  let state = "SANDBOX_PLAN";
+  let reason = "DEFENSIVE_PLAN_READY";
+  if (!tenantId || !passportTenantId) {
+    state = "DENIED";
+    reason = "TENANT_PASSPORT_REQUIRED";
+  } else if (tenantId !== passportTenantId) {
+    state = "DENIED";
+    reason = "CROSS_TENANT_SCOPE";
+  } else if (!ALLOWED_MISSIONS.has(mission) || capsule === null) {
+    state = "DENIED";
+    reason = "UNSUPPORTED_DEFENSIVE_MISSION";
+  } else if (prohibitedAction(requestedAction)) {
+    state = "DENIED";
+    reason = "PROHIBITED_ACTION";
+  } else if (!Number.isFinite(evidenceCount) || evidenceCount <= 0 || !evidenceFresh) {
+    state = "ABSTAINED";
+    reason = "EVIDENCE_NOT_FRESH";
+  } else if (APPROVAL_ACTIONS.has(requestedAction) && !humanApproved) {
+    state = "AWAITING_APPROVAL";
+    reason = "HUMAN_APPROVAL_REQUIRED";
+  }
+  const decisionGate = state === "DENIED" || state === "ABSTAINED" ? 0 : 1;
+  const evidenceScore = Math.max(0, Math.min(1, Number.isFinite(evidenceCount) ? evidenceCount / 5 : 0));
+  const freshnessScore = evidenceFresh ? 1 : 0;
+  const scopeScore = tenantId && tenantId === passportTenantId ? 1 : 0;
+  const procedureScore = capsule ? 1 : 0;
+  const quality = Math.pow(
+    Math.max(evidenceScore, 0.000001) ** 0.30
+      * Math.max(freshnessScore, 0.000001) ** 0.25
+      * Math.max(scopeScore, 0.000001) ** 0.25
+      * Math.max(procedureScore, 0.000001) ** 0.20,
+    1,
+  );
+  const modeledScore = Math.min(0.97, quality * decisionGate);
+  const plan = capsule
+    ? capsule.cells.map((cellId, index) => {
+        const cell = registry.proof_cells.find((item) => item.id === cellId);
+        return {
+          sequence: index + 1,
+          cell_id: cellId,
+          cell_name: cell?.name ?? cellId,
+          objective: cell?.purpose ?? "UNAVAILABLE",
+          mode: "READ_ONLY_DEFENSIVE",
+        };
+      })
+    : [];
+  const derivation = {
+    schema: "szl.aegis-proof-cells.evaluation/v1",
+    input: {
+      tenant_id: tenantId || "UNAVAILABLE",
+      passport_tenant_id: passportTenantId || "UNAVAILABLE",
+      alert_id: alertId,
+      source,
+      severity,
+      mission: mission || "UNAVAILABLE",
+      requested_action: requestedAction,
+      evidence_count: Number.isFinite(evidenceCount) ? evidenceCount : 0,
+      evidence_fresh: evidenceFresh,
+      human_approved: humanApproved,
+    },
+    decision: {
+      state,
+      reason,
+      evidence_class: "MODELED",
+      score: Number(modeledScore.toFixed(8)),
+      trust_ceiling: 0.97,
+      production_authorization: false,
+    },
+    procedure_capsule: capsule?.id ?? "UNAVAILABLE",
+    plan,
+    context_contract: registry.context_types,
+    authority: {
+      default_effect: "DENY",
+      external_writes: "DISABLED",
+      effectors: [],
+      automatic_retries: 0,
+      credentials_accepted: false,
+      cross_tenant_access: "DENIED",
+      offensive_intrusion: "DENIED",
+    },
+  };
+  return derivation;
+}
+export async function evaluateCaseWithReceipt(input, registry) {
+  const result = evaluateCase(input, registry);
+  return {
+    ...result,
+    proof_chain: {
+      kind: "DETERMINISTIC_CLIENT_RECEIPT",
+      sha256: await sha256Hex(canonicalJSONString(result)),
+      signature_status: "UNAVAILABLE",
+      persisted: false,
+    },
+  };
+}
+function text(element, value) {
+  if (element) element.textContent = value;
+}
+function renderCells(registry) {
+  const grid = document.querySelector("#cells");
+  if (!grid) return;
+  grid.replaceChildren();
+  for (const cell of registry.proof_cells) {
+    const article = document.createElement("article");
+    article.className = "cell";
+    const label = document.createElement("div");
+    label.className = "cell-id";
+    label.textContent = cell.id;
+    const heading = document.createElement("h3");
+    heading.textContent = cell.name;
+    const paragraph = document.createElement("p");
+    paragraph.textContent = cell.purpose;
+    article.append(label, heading, paragraph);
+    grid.append(article);
+  }
+}
+async function readJson(path) {
+  const response = await fetch(path, {
+    cache: "no-store",
+    credentials: "same-origin",
+    redirect: "error",
+    headers: { Accept: "application/json" },
+  });
+  if (!response.ok) throw new Error(`${path} -> HTTP ${response.status}`);
+  return response.json();
+}
+async function refreshEvidence(registry) {
+  const output = document.querySelector("#evidence-output");
+  const summary = [];
+  for (const source of registry.live_read_only_sources) {
+    try {
+      const payload = await readJson(source.path);
+      summary.push({
+        id: source.id,
+        state: "AVAILABLE",
+        path: source.path,
+        observed_at: payload.observed_at ?? "UNAVAILABLE",
+        data_kind: payload.data_kind ?? payload.status ?? "REPORTED",
+      });
+    } catch (error) {
+      summary.push({
+        id: source.id,
+        state: "UNAVAILABLE",
+        path: source.path,
+        reason: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+  if (output) output.textContent = JSON.stringify(summary, null, 2);
+  text(document.querySelector("#evidence-state"), `${summary.filter((row) => row.state === "AVAILABLE").length}/${summary.length} sources available`);
+}
+function readForm(form) {
+  const data = new FormData(form);
+  return Object.fromEntries(data.entries());
+}
+async function boot() {
+  const registry = await readJson("/static/3d/aegis-proof-cells/registry.json");
+  text(document.querySelector("#cell-count"), String(registry.proof_cells.length));
+  text(document.querySelector("#capsule-count"), String(registry.procedure_capsules.length));
+  text(document.querySelector("#mode"), registry.operating_mode);
+  renderCells(registry);
+  const form = document.querySelector("#case-form");
+  const result = document.querySelector("#case-result");
+  form?.addEventListener("submit", async (event) => {
+    event.preventDefault();
+    const evaluated = await evaluateCaseWithReceipt(readForm(form), registry);
+    if (result) result.textContent = JSON.stringify(evaluated, null, 2);
+    text(document.querySelector("#decision-state"), evaluated.decision.state);
+  });
+  document.querySelector("#refresh-evidence")?.addEventListener("click", () => refreshEvidence(registry));
+  await refreshEvidence(registry);
+}
+if (typeof document !== "undefined") {
+  boot().catch((error) => {
+    text(document.querySelector("#boot-state"), `UNAVAILABLE: ${error instanceof Error ? error.message : String(error)}`);
+  });
+}

console/3d/aegis-proof-cells/registry.json ADDED Viewed

	@@ -0,0 +1,321 @@

+{
+  "authority": {
+    "automatic_retries": 0,
+    "credentials_accepted": false,
+    "cross_tenant_access": "DENIED",
+    "default_effect": "DENY",
+    "destructive_remediation": "DENIED",
+    "effectors": [],
+    "external_writes": "DISABLED",
+    "human_approval_required": true,
+    "offensive_intrusion": "DENIED",
+    "production_authorization": false,
+    "secrets_persisted": false
+  },
+  "bricklayer_boundary": {
+    "affiliation": "NONE",
+    "brand_identity_reused": false,
+    "classification": "REFERENCE_ONLY_CLEAN_ROOM",
+    "note": "Public product and engineering publications were used only to identify high-level operating patterns. The implementation, naming, data model, interface, policies, and code are original SZL/Aegis expression.",
+    "official_public_code_repository_found": false,
+    "proprietary_implementation_available": false,
+    "source_code_copied": false,
+    "visual_identity_copied": false,
+    "website_copy_copied": false
+  },
+  "context_types": [
+    "EVIDENTIARY",
+    "PROCEDURAL",
+    "INVESTIGATIVE",
+    "DECISION",
+    "OUTCOME"
+  ],
+  "evidence_class": "REPORTED_REFERENCE_ARCHITECTURE",
+  "live_read_only_sources": [
+    {
+      "claim": "CISA KEV-backed status when source is available",
+      "id": "kev",
+      "path": "/api/a11oy/v1/sec/kevgate"
+    },
+    {
+      "claim": "ATT&CK-oriented defensive context",
+      "id": "attack",
+      "path": "/api/a11oy/v1/sec/attack"
+    },
+    {
+      "claim": "Current A11oy threat context",
+      "id": "threats",
+      "path": "/api/a11oy/v1/sec/threats"
+    },
+    {
+      "claim": "Read-only threat graph context",
+      "id": "threatgraph",
+      "path": "/api/a11oy/v1/sec/threatgraph"
+    },
+    {
+      "claim": "CVE evidence surface",
+      "id": "cve",
+      "path": "/api/a11oy/v1/sec/cve"
+    }
+  ],
+  "observed_at": "2026-09-03",
+  "operating_mode": "DEFENSIVE_READ_ONLY_INVESTIGATION_PLANNER",
+  "procedure_capsules": [
+    {
+      "approval_required_for": [
+        "block-indicator",
+        "isolate-host",
+        "disable-account",
+        "purge-email",
+        "remediate"
+      ],
+      "cells": [
+        "signal-intake",
+        "identity-scope",
+        "asset-context",
+        "evidence-provenance",
+        "threat-context",
+        "incident-investigation",
+        "outcome-debrief"
+      ],
+      "id": "alert-triage-v1",
+      "mission": "alert-triage"
+    },
+    {
+      "approval_required_for": [
+        "block-indicator",
+        "disable-account",
+        "purge-email",
+        "remediate"
+      ],
+      "cells": [
+        "signal-intake",
+        "identity-scope",
+        "threat-context",
+        "incident-investigation",
+        "evidence-provenance",
+        "remediation-planning",
+        "outcome-debrief"
+      ],
+      "id": "phishing-investigation-v1",
+      "mission": "phishing"
+    },
+    {
+      "approval_required_for": [
+        "isolate-host",
+        "block-indicator",
+        "remediate"
+      ],
+      "cells": [
+        "signal-intake",
+        "identity-scope",
+        "asset-context",
+        "detection-engineering",
+        "threat-context",
+        "incident-investigation",
+        "evidence-provenance",
+        "remediation-planning",
+        "outcome-debrief"
+      ],
+      "id": "endpoint-investigation-v1",
+      "mission": "endpoint"
+    },
+    {
+      "approval_required_for": [
+        "remediate"
+      ],
+      "cells": [
+        "signal-intake",
+        "identity-scope",
+        "asset-context",
+        "exposure-analysis",
+        "threat-context",
+        "evidence-provenance",
+        "remediation-planning",
+        "outcome-debrief"
+      ],
+      "id": "vulnerability-prioritization-v1",
+      "mission": "vulnerability"
+    },
+    {
+      "approval_required_for": [
+        "disable-account",
+        "remediate"
+      ],
+      "cells": [
+        "signal-intake",
+        "identity-scope",
+        "asset-context",
+        "cloud-posture",
+        "exposure-analysis",
+        "evidence-provenance",
+        "remediation-planning",
+        "outcome-debrief"
+      ],
+      "id": "cloud-posture-review-v1",
+      "mission": "cloud"
+    },
+    {
+      "approval_required_for": [],
+      "cells": [
+        "signal-intake",
+        "identity-scope",
+        "threat-context",
+        "evidence-provenance",
+        "incident-investigation",
+        "outcome-debrief"
+      ],
+      "id": "threat-intelligence-brief-v1",
+      "mission": "threat-intel"
+    }
+  ],
+  "proof_cells": [
+    {
+      "id": "signal-intake",
+      "name": "Signal Intake",
+      "purpose": "Normalize defensive alerts without discarding source evidence."
+    },
+    {
+      "id": "identity-scope",
+      "name": "Identity & Scope",
+      "purpose": "Bind tenant, principal, mission, and permitted connector labels."
+    },
+    {
+      "id": "asset-context",
+      "name": "Asset Context",
+      "purpose": "Resolve affected assets, owners, and business criticality."
+    },
+    {
+      "id": "detection-engineering",
+      "name": "Detection Engineering",
+      "purpose": "Assess detection intent, logic, and evidence coverage."
+    },
+    {
+      "id": "threat-context",
+      "name": "Threat Context",
+      "purpose": "Map observed behavior to defensive threat knowledge."
+    },
+    {
+      "id": "exposure-analysis",
+      "name": "Exposure Analysis",
+      "purpose": "Prioritize material and exploitable exposure."
+    },
+    {
+      "id": "cloud-posture",
+      "name": "Cloud Posture",
+      "purpose": "Evaluate cloud configuration and identity-control evidence."
+    },
+    {
+      "id": "incident-investigation",
+      "name": "Incident Investigation",
+      "purpose": "Build a source-labelled timeline and test hypotheses."
+    },
+    {
+      "id": "evidence-provenance",
+      "name": "Evidence Provenance",
+      "purpose": "Maintain freshness, source, transformations, and confidence."
+    },
+    {
+      "id": "remediation-planning",
+      "name": "Remediation Planning",
+      "purpose": "Draft bounded defensive actions requiring human approval."
+    },
+    {
+      "id": "outcome-debrief",
+      "name": "Outcome & Debrief",
+      "purpose": "Record limitations, results, and reusable lessons."
+    }
+  ],
+  "public_architecture_observations": [
+    {
+      "abstract_pattern": "Specialized security roles coordinate under approved procedures with analyst oversight.",
+      "id": "coordinated-workforce",
+      "published_or_observed": "observed 2026-09-03",
+      "reuse_policy": "REFERENCE_ONLY",
+      "source": "https://www.bricklayer.ai/platform/",
+      "szl_transformation": "Aegis Proof Cells use Tenant Passports, Evidence Atoms, Procedure Capsules, and Decision Receipts."
+    },
+    {
+      "abstract_pattern": "Investigation context must accumulate across specialist handoffs.",
+      "id": "context-containers",
+      "published_or_observed": "2025-09-26",
+      "reuse_policy": "REFERENCE_ONLY",
+      "source": "https://www.bricklayer.ai/insights/multi-agent-context-engineering-mace-the-discipline-behind-investigative-artificial-intelligence-ai/",
+      "szl_transformation": "Aegis Evidence Groups preserve evidentiary, procedural, investigative, decision, and outcome context."
+    },
+    {
+      "abstract_pattern": "Structured, reusable investigation observations should replace unstructured handoff prose.",
+      "id": "insight-groups",
+      "published_or_observed": "2026-04-20",
+      "reuse_policy": "REFERENCE_ONLY",
+      "source": "https://www.bricklayer.ai/insights/introducing-insight-groups-structuring-context-for-the-coordinated-ai-soc/",
+      "szl_transformation": "Evidence Atoms are typed, source-labelled, freshness-bound records grouped into a Proof Chain."
+    },
+    {
+      "abstract_pattern": "Agent actions need an independent control layer and complete auditability.",
+      "id": "policy-enforcement",
+      "published_or_observed": "2026-03-24",
+      "reuse_policy": "REFERENCE_ONLY",
+      "source": "https://www.bricklayer.ai/insights/governing-ai-agents-announcing-our-first-patent-in-agentic-policy-enforcement/",
+      "szl_transformation": "Aegis applies deny-by-default Covenant Policy, hard-zero safety gates, human approvals, and effectors disabled."
+    },
+    {
+      "abstract_pattern": "Proven operational configurations should be packaged as governed reusable assets.",
+      "id": "shared-library",
+      "published_or_observed": "2026-06-03",
+      "reuse_policy": "REFERENCE_ONLY",
+      "source": "https://www.bricklayer.ai/insights/introducing-the-shared-agentic-library/",
+      "szl_transformation": "Versioned Procedure Capsules carry scope, prerequisites, cell graph, evidence contract, and approval requirements."
+    },
+    {
+      "abstract_pattern": "Multi-tenant procedures need explicit credential and environment segmentation.",
+      "id": "credential-segmentation",
+      "published_or_observed": "2025-02-21",
+      "reuse_policy": "REFERENCE_ONLY",
+      "source": "https://www.bricklayer.ai/insights/bricklayer-ai-introduces-credential-labels-and-azure-sentinel-support/",
+      "szl_transformation": "Tenant Passport labels select connector classes only; credentials are never accepted by this client-side workbench."
+    }
+  ],
+  "routes": {
+    "page": "/static/3d/aegis-proof-cells.html",
+    "registry": "/static/3d/aegis-proof-cells/registry.json",
+    "script": "/static/3d/aegis-proof-cells/app.mjs",
+    "styles": "/static/3d/aegis-proof-cells/styles.css"
+  },
+  "schema": "szl.aegis-proof-cells.registry/v1",
+  "standards_and_public_code": [
+    {
+      "license": "Apache-2.0",
+      "name": "Open Cybersecurity Schema Framework",
+      "repository": "https://github.com/ocsf/ocsf-schema",
+      "revision": "2c61b24c2f21d2ea316fca7d640bb37df3374011",
+      "source_code_copied": false,
+      "use": "Semantic reference for normalized defensive evidence."
+    },
+    {
+      "license": "TERMS_REVIEW_REQUIRED",
+      "name": "MITRE ATT&CK STIX Data",
+      "repository": "https://github.com/mitre-attack/attack-stix-data",
+      "revision": "6cda5ad8462c79e14fbb872f4e09059b18e0cfc4",
+      "source_code_copied": false,
+      "use": "Technique-oriented threat context reference."
+    },
+    {
+      "license": "Apache-2.0",
+      "name": "OpenTelemetry Specification",
+      "repository": "https://github.com/open-telemetry/opentelemetry-specification",
+      "revision": "eec6fadba46a5002f55ff88ce4405d58a1aa4aec",
+      "source_code_copied": false,
+      "use": "Trace and evidence-correlation semantic reference."
+    },
+    {
+      "license": "Apache-2.0",
+      "name": "Open Policy Agent",
+      "repository": "https://github.com/open-policy-agent/opa",
+      "revision": "92da7b47f05488487dcbdf1625e405d9141c6c38",
+      "source_code_copied": false,
+      "use": "Policy-decision architecture reference; no runtime dependency."
+    }
+  ],
+  "title": "Aegis Proof Cells"
+}

console/3d/aegis-proof-cells/styles.css ADDED Viewed

	@@ -0,0 +1,262 @@

+:root {
+  color-scheme: dark;
+  --bg: #05070a;
+  --panel: rgba(14, 19, 26, 0.86);
+  --panel-strong: #111722;
+  --line: #273444;
+  --text: #eef4fb;
+  --muted: #9aa9ba;
+  --signal: #78d5ff;
+  --good: #7ee7b6;
+  --warn: #ffd479;
+  --danger: #ff8c8c;
+  --radius: 18px;
+}
+*,
+*::before,
+*::after { box-sizing: border-box; }
+html,
+body {
+  margin: 0;
+  min-height: 100%;
+  max-width: 100%;
+  overflow-x: hidden;
+}
+html { scroll-behavior: smooth; }
+body {
+  background:
+    radial-gradient(circle at 82% 2%, rgba(49, 148, 255, 0.15), transparent 32rem),
+    linear-gradient(rgba(255, 255, 255, 0.025) 1px, transparent 1px),
+    linear-gradient(90deg, rgba(255, 255, 255, 0.025) 1px, transparent 1px),
+    var(--bg);
+  background-size: auto, 32px 32px, 32px 32px, auto;
+  color: var(--text);
+  font: 15px/1.6 Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+}
+a { color: var(--signal); }
+a,
+button,
+input,
+select {
+  min-height: 48px;
+}
+button,
+input,
+select {
+  max-width: 100%;
+  border: 1px solid var(--line);
+  border-radius: 10px;
+  background: #0c1118;
+  color: var(--text);
+  padding: 0.75rem 0.9rem;
+  font: inherit;
+}
+button {
+  cursor: pointer;
+  background: var(--text);
+  color: #05070a;
+  font-weight: 800;
+}
+button:hover { filter: brightness(0.92); }
+button:focus-visible,
+input:focus-visible,
+select:focus-visible,
+a:focus-visible {
+  outline: 3px solid var(--signal);
+  outline-offset: 3px;
+}
+.skip {
+  position: absolute;
+  left: 1rem;
+  top: -8rem;
+  z-index: 100;
+  padding: 0.75rem 1rem;
+  background: var(--text);
+  color: var(--bg);
+}
+.skip:focus { top: 1rem; }
+main {
+  width: min(100%, 1240px);
+  margin: 0 auto;
+  padding: 2rem clamp(1rem, 3vw, 2.5rem) 5rem;
+  min-width: 0;
+}
+header {
+  display: grid;
+  gap: 1rem;
+  padding: clamp(2rem, 8vw, 6rem) 0 2rem;
+}
+.eyebrow,
+.metric-label,
+.cell-id {
+  color: var(--signal);
+  font: 700 0.75rem/1.4 ui-monospace, SFMono-Regular, Consolas, monospace;
+  letter-spacing: 0.13em;
+  text-transform: uppercase;
+}
+h1 {
+  margin: 0;
+  max-width: 13ch;
+  font-size: clamp(2.8rem, 10vw, 7.5rem);
+  line-height: 0.88;
+  letter-spacing: -0.065em;
+  overflow-wrap: anywhere;
+}
+.lede {
+  max-width: 72ch;
+  margin: 0;
+  color: var(--muted);
+  font-size: clamp(1rem, 2vw, 1.25rem);
+}
+.truth-banner {
+  border: 1px solid var(--line);
+  border-left: 4px solid var(--signal);
+  border-radius: 12px;
+  background: rgba(12, 17, 24, 0.9);
+  padding: 1rem 1.1rem;
+  overflow-wrap: anywhere;
+}
+.metrics,
+.layout,
+.cells {
+  display: grid;
+  min-width: 0;
+}
+.metrics {
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 0.8rem;
+  margin: 1.5rem 0 2.5rem;
+}
+.metric,
+.panel,
+.cell {
+  min-width: 0;
+  border: 1px solid var(--line);
+  border-radius: var(--radius);
+  background: var(--panel);
+  backdrop-filter: blur(12px);
+}
+.metric { padding: 1rem; }
+.metric strong {
+  display: block;
+  margin-top: 0.4rem;
+  font-size: clamp(1.1rem, 3vw, 1.8rem);
+  overflow-wrap: anywhere;
+}
+.layout {
+  grid-template-columns: minmax(0, 1.15fr) minmax(0, 0.85fr);
+  gap: 1rem;
+  align-items: start;
+}
+.panel {
+  padding: clamp(1rem, 3vw, 1.5rem);
+  overflow: hidden;
+}
+.panel h2 { margin-top: 0; }
+form {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 0.85rem;
+}
+label {
+  display: grid;
+  gap: 0.4rem;
+  min-width: 0;
+  color: var(--muted);
+  font-weight: 650;
+}
+label.wide,
+form button { grid-column: 1 / -1; }
+.checkbox {
+  display: flex;
+  align-items: center;
+  gap: 0.7rem;
+  min-height: 48px;
+}
+.checkbox input {
+  width: 22px;
+  min-height: 22px;
+  height: 22px;
+  margin: 0;
+}
+pre {
+  width: 100%;
+  max-width: 100%;
+  max-height: 32rem;
+  overflow: auto;
+  margin: 1rem 0 0;
+  padding: 1rem;
+  border: 1px solid var(--line);
+  border-radius: 12px;
+  background: #070b10;
+  color: #cfe9ff;
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+  word-break: break-word;
+  font: 0.78rem/1.55 ui-monospace, SFMono-Regular, Consolas, monospace;
+}
+.section-heading {
+  margin: 4rem 0 1rem;
+}
+.cells {
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 0.8rem;
+}
+.cell { padding: 1rem; }
+.cell h3 { margin: 0.5rem 0; }
+.cell p { margin: 0; color: var(--muted); }
+.status {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.5rem;
+  min-height: 48px;
+  color: var(--muted);
+}
+.status::before {
+  content: "";
+  width: 0.65rem;
+  height: 0.65rem;
+  border-radius: 50%;
+  background: var(--signal);
+  box-shadow: 0 0 1rem var(--signal);
+}
+footer {
+  margin-top: 4rem;
+  padding-top: 1.5rem;
+  border-top: 1px solid var(--line);
+  color: var(--muted);
+}
+@media (max-width: 820px) {
+  .layout,
+  .cells { grid-template-columns: minmax(0, 1fr); }
+}
+@media (max-width: 620px) {
+  .metrics,
+  form { grid-template-columns: minmax(0, 1fr); }
+  label.wide,
+  form button { grid-column: auto; }
+  h1 { font-size: clamp(2.65rem, 17vw, 5rem); }
+}
+@media (prefers-reduced-motion: reduce) {
+  *,
+  *::before,
+  *::after {
+    scroll-behavior: auto !important;
+    animation-duration: 0.01ms !important;
+    animation-iteration-count: 1 !important;
+    transition-duration: 0.01ms !important;
+  }
+}
+@media (prefers-contrast: more) {
+  :root {
+    --line: #a7dfff;
+    --muted: #d7e2ec;
+  }
+}
+@media (forced-colors: active) {
+  .metric,
+  .panel,
+  .cell,
+  .truth-banner { border: 1px solid CanvasText; }
+  .status::before { forced-color-adjust: none; }
+}