chore(sync): mirror backend .py + Dockerfile to Space (hf-sync-backend)

Automated backend sync from szl-holdings/a11oy main via hf-sync-backend.
Updated (differed from the Space): Dockerfile, a11oy_vertical_feeds.py, serve.py, szl_demo_sign.py
Deleted (gone from the repo + Dockerfile COPY set): (none)

Keeps the Space-built backend (serve.py + the Dockerfile-COPY'd .py
modules) identical to GitHub main so the Space never rebuilds from a
stale backend, new endpoints don't 404 there, and orphaned modules
removed from the repo don't linger in the Space tree.

Dockerfile

@@ -225,6 +225,12 @@ COPY szl_provenance_receipt.py ./
 # and /api/a11oy/v1/khipu/{organs,chain,verify} 404s live. Reads the shared szl_khipu
 # DAG in-process (already COPY'd above) — no new deps.
 COPY szl_khipu_verify.py ./
+# DEMO-ONLY signing (Option B): szl_demo_sign exposes the demo-signing-key path so
+# /verify shows a real ECDSA-P256 VERIFIED badge. MUST be per-file COPY'd or the
+# guarded imports in serve.py (/demo-cosign.pub) and a11oy_vertical_feeds (infer
+# fallback) fall back and the demo signature never appears. Production cosign key
+# stays founder-gated; only the demo PUBLIC key ships in this module.
+COPY szl_demo_sign.py ./
 # REGRESSION RESTORE — serve.py imports these (guarded) but their per-file COPY was
 # dropped, so in the HF image each guarded import falls back to a STUB (merged-but-not-
 # live) and the copy-sync lockstep guard is red on main. szl_sda was added by the most

a11oy_vertical_feeds.py

@@ -241,6 +241,22 @@ def governed_turn(vertical: str, text: str, *, declared: str | None = None,
             receipt = signed.get("receipt", receipt)
         except Exception as e:
             dsse = {"signed": False, "honesty": f"sign-unavailable: {e}"}
+        # ADDITIVE demo-signing fallback (Option B): when the production cosign key
+        # is founder-gated/absent (dsse unsigned), sign with the clearly-labelled
+        # DEMO key so /verify can show a REAL in-browser ECDSA-P256 verification.
+        # keyid="demo-signing-key" — NEVER mislabelled as the production signature.
+        # Fully guarded: any failure keeps the honest UNSIGNED/placeholder behaviour
+        # and never breaks the infer path.
+        if isinstance(dsse, dict) and not dsse.get("signed") and isinstance(receipt, dict):
+            try:
+                import szl_demo_sign
+                _demo = szl_demo_sign.demo_sign_receipt(receipt)
+                if _demo is not None:
+                    dsse = _demo["dsse"]
+                    receipt = _demo["receipt"]
+            except Exception as e:
+                import sys as _dsys
+                print(f"[demo-sign] non-fatal, staying UNSIGNED: {e!r}", file=_dsys.stderr)
 
     return {
         "vertical": vertical,

serve.py

@@ -5909,6 +5909,24 @@ async def a11oy_cosign_pub_v2() -> Response:
     return PlainTextResponse(_A11OY_PUB_PEM, media_type="text/plain")
 
 
+# ---- /demo-cosign.pub — DEMO-ONLY public key (PEM, text/plain) -------------
+# Serves the PUBLIC half of the clearly-labelled demo-signing-key (Option B).
+# The /verify JS fetches this ONLY when a receipt's keyid == "demo-signing-key",
+# so a buyer can watch a real in-browser ECDSA-P256 verification succeed while the
+# PRODUCTION cosign key stays founder-gated and is NEVER placed in this runtime.
+# This is PUBLIC data; it is NOT the production cosign.pub.
+@app.get("/demo-cosign.pub")
+@app.get("/api/a11oy/demo-cosign.pub")
+async def a11oy_demo_cosign_pub() -> Response:
+    try:
+        import szl_demo_sign
+        return PlainTextResponse(szl_demo_sign.DEMO_COSIGN_PUBLIC_PEM,
+                                 media_type="text/plain")
+    except Exception:
+        return PlainTextResponse("# demo signing key module unavailable\n",
+                                 status_code=503)
+
+
 # ---- Receipt chain (in-image, hash-chained, signed) ----
 def _a11oy_build_chain(n: int = 24) -> dict:
     """Build a deterministic in-image receipt hash-chain. Each receipt commits

szl_demo_sign.py

@@ -0,0 +1,131 @@
+# SPDX-License-Identifier: Apache-2.0
+# © 2026 Lutar, Stephen P. — SZL Holdings · ORCID 0009-0001-0110-4173 · Doctrine v11 LOCKED
+"""
+szl_demo_sign — DEMO-ONLY ECDSA-P256 signing for SZL Khipu receipts.
+
+WHY THIS EXISTS (read before editing):
+    The PRODUCTION cosign private key is founder-gated and is NEVER placed in the
+    HF Space runtime (see szl_dsse.py). When it is absent, szl_dsse emits an honest
+    UNSIGNED envelope and /verify shows "⚠ UNSIGNED". To let a buyer watch a REAL
+    in-browser ECDSA-P256 verification SUCCEED — without ever exposing the
+    production key — this module signs with a SEPARATE, clearly-labelled DEMO key.
+
+HONESTY CONTRACT (doctrine, non-negotiable):
+    - The demo key is a DISTINCT keypair from the production cosign key.
+    - Every envelope it produces is stamped keyid="demo-signing-key" and carries a
+      human-visible note: "signed with demo-signing-key — NOT the production
+      founder-gated cosign key". A demo signature is NEVER labelled as production.
+    - The DEMO PUBLIC key is committed here and served at /demo-cosign.pub. The
+      DEMO PRIVATE key is loaded ONLY from the Space secret env var
+      SZL_DEMO_SIGN_KEY (PKCS8 PEM, optionally base64-wrapped). It is never
+      committed to git.
+    - If the secret is absent or invalid this module is a no-op: it returns None and
+      the caller keeps the honest DSSE_PLACEHOLDER / UNSIGNED behaviour. It NEVER
+      fabricates a signature and NEVER raises into the infer path.
+
+The envelope is byte-compatible with the /verify WebCrypto verifier: ECDSA-P256
+over the DSSE PAE ("DSSEv1 " ...), exactly as szl_dsse produces for production.
+"""
+from __future__ import annotations
+
+import base64
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any, Optional
+
+# Reuse the EXACT PAE + canonical-JSON encoding the production path and the
+# /verify JS already agree on, so a demo signature verifies through the same code.
+import szl_dsse
+
+DEMO_KEY_ID = "demo-signing-key"
+DEMO_SIGN_KEY_ENV = "SZL_DEMO_SIGN_KEY"
+DEMO_NOTE = ("signed with demo-signing-key — NOT the production founder-gated "
+             "cosign key")
+
+# Demo PUBLIC key (SubjectPublicKeyInfo / SPKI PEM). PUBLIC data — safe to commit.
+# Served at /demo-cosign.pub so the /verify JS can fetch + import it. The matching
+# PRIVATE key lives ONLY in the SZL_DEMO_SIGN_KEY Space secret (never committed).
+DEMO_COSIGN_PUBLIC_PEM = """-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsy4Rh7qm/NtCPupIoCrs+YLJUwqg
+3WyMBuzMeK+IqTY2X8DCRKTVFqdWktYF6IKBpA2ZiHU5Yl5STf4QqX97/A==
+-----END PUBLIC KEY-----
+"""
+
+
+def _load_demo_private_key():
+    """Load the demo EC private key from the SZL_DEMO_SIGN_KEY secret.
+
+    Returns None (never raises) if the secret is absent or invalid — the caller
+    then keeps the honest UNSIGNED / placeholder behaviour."""
+    pem = os.environ.get(DEMO_SIGN_KEY_ENV)
+    if not pem:
+        return None
+    try:
+        if "BEGIN" not in pem:  # allow base64-wrapped secret (HF UI friendliness)
+            pem = base64.b64decode(pem).decode("utf-8")
+        from cryptography.hazmat.primitives.serialization import load_pem_private_key
+        return load_pem_private_key(pem.encode("utf-8"), password=None)
+    except Exception as e:  # pragma: no cover - defensive
+        print(f"[demo-sign] private key load failed (staying UNSIGNED): {e!r}",
+              file=sys.stderr)
+        return None
+
+
+def demo_signing_available() -> bool:
+    return _load_demo_private_key() is not None
+
+
+def sign_payload_demo(payload_obj: Any,
+                      payload_type: str = szl_dsse.KHIPU_PAYLOAD_TYPE
+                      ) -> Optional[dict[str, Any]]:
+    """Produce a DSSE envelope over `payload_obj` using the DEMO key.
+
+    Returns the envelope dict (signed=True, keyid="demo-signing-key") or None if
+    the demo secret is absent/invalid. NEVER fabricates a signature."""
+    priv = _load_demo_private_key()
+    if priv is None:
+        return None
+    try:
+        from cryptography.hazmat.primitives.asymmetric import ec
+        from cryptography.hazmat.primitives import hashes
+        body = szl_dsse.canonical_json(payload_obj)
+        to_sign = szl_dsse.pae(payload_type, body)
+        sig = priv.sign(to_sign, ec.ECDSA(hashes.SHA256()))
+        return {
+            "payloadType": payload_type,
+            "payload": base64.b64encode(body).decode("ascii"),
+            "signatures": [{"sig": base64.b64encode(sig).decode("ascii"),
+                            "keyid": DEMO_KEY_ID}],
+            "signed": True,
+            "_dsse": "DSSEv1",
+            "_signed_at": datetime.now(timezone.utc).isoformat(),
+            "key_id": DEMO_KEY_ID,
+            "key_kind": "demo",
+            "verify_key_url": "/demo-cosign.pub",
+            "honesty": ("DEMO — real ECDSA-P256-SHA256 over the DSSE PAE, "
+                        "verifiable in-browser against /demo-cosign.pub. " + DEMO_NOTE
+                        + ". The production cosign key stays founder-gated and is "
+                        "NEVER placed in this runtime."),
+        }
+    except Exception as e:  # pragma: no cover - defensive
+        print(f"[demo-sign] sign failed (staying UNSIGNED): {e!r}", file=sys.stderr)
+        return None
+
+
+def demo_sign_receipt(receipt: dict[str, Any]) -> Optional[dict[str, Any]]:
+    """Demo-sign a Khipu receipt. Returns {receipt, dsse} or None.
+
+    The returned receipt is stamped with key_id="demo-signing-key" and a
+    human-visible signature_status so no surface can mistake it for a production
+    signature. The dsse envelope is the cryptographic source of truth and is what
+    /verify checks against /demo-cosign.pub. Returns None (caller keeps the honest
+    placeholder) when the demo secret is absent."""
+    env = sign_payload_demo(receipt, szl_dsse.KHIPU_PAYLOAD_TYPE)
+    if env is None:
+        return None
+    out = dict(receipt)
+    out["signature"] = env["signatures"][0]["sig"]
+    out["key_id"] = DEMO_KEY_ID
+    out["signature_status"] = ("DEMO-SIGNED [demo-signing-key] — " + DEMO_NOTE)
+    return {"receipt": out, "dsse": env}