deploy(hf): sync szl-holdings/a11oy@cc12ca51e9641926fc8f2c84801ddb4726989adc derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy cc12ca51e9641926fc8f2c84801ddb4726989adc.
Files: 1168 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

routers/series_a_web/app.js

@@ -90,12 +90,52 @@
   };
   document.getElementById("refresh").addEventListener("click", async () => {
     const button = document.getElementById("refresh");
+    let failure = null;
     button.disabled = true;
     try {
-      await request("/refresh", {method: "POST", headers: {"content-type": "application/json"}, body: JSON.stringify({actor: "series-a-ui"})});
+      if (!currentEvidence) {
+        throw new Error("OBSERVED signed server evidence is required");
+      }
+      const evaluated = await request("/passports/evaluate", {
+        method: "POST",
+        headers: {"content-type": "application/json"},
+        body: JSON.stringify({
+          principal_id: "series-a-ui",
+          action: {
+            type: "estate.refresh",
+            target: "szl://estate/current",
+            impact: "MODERATE",
+            irreversible: false
+          },
+          evidence: [{...currentEvidence}],
+          expected_if_withheld: "Current estate observation remains unchanged",
+          expected_if_acted: "A bounded governed estate refresh completes or fails closed"
+        })
+      });
+      if (evaluated.passport?.decision !== "ALLOW") {
+        throw new Error(
+          `PASSPORT_${evaluated.passport?.decision || "UNAVAILABLE"}: ${
+            (evaluated.passport?.reason_codes || []).join(",")
+          }`
+        );
+      }
+      const value = await request("/passports/execute", {
+        method: "POST",
+        headers: {"content-type": "application/json"},
+        body: JSON.stringify({passport_digest: evaluated.passport_digest})
+      }, EXECUTION_TIMEOUT_MS);
+      if (value.outcome?.status !== "SUCCEEDED") {
+        throw new Error(
+          `SERIES_A_REFRESH_FAILED: ${value.outcome?.error_class || value.outcome?.status || "UNKNOWN"}`
+        );
+      }
     } catch (error) {
-      document.getElementById("updated").textContent = String(error.message || error);
-    } finally { button.disabled = false; await load(); }
+      failure = String(error.message || error);
+    } finally {
+      button.disabled = false;
+      await load();
+      if (failure) document.getElementById("updated").textContent = failure;
+    }
   });
   const actionSelect = document.querySelector('select[name="type"]');
   const targetInput = document.querySelector('input[name="target"]');

routers/series_a_web/index.html

@@ -15,7 +15,7 @@
 </header>
 <main id="main" tabindex="-1">
   <section class="toolbar" aria-label="Control plane actions">
-    <button id="refresh" type="button">Refresh live estate</button>
+    <button id="refresh" type="button">Run governed refresh</button>
     <span id="updated" aria-live="polite">Not observed yet</span>
   </section>
   <section class="grid" id="cards" aria-label="Live status">