deploy(hf): sync szl-holdings/a11oy@3b6f107e139541e7d0000ad2e1c03e36ef13bba8 derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy 3b6f107e139541e7d0000ad2e1c03e36ef13bba8.
Files: 1298 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

static/3d/surfaces/brainreranker.js

@@ -89,7 +89,8 @@ function paint() {
   if (!overlay) return;
   const s = state.status || {}, inv = s.inventory || {}, ds = s.dataset || {};
   const feed = s.feed || {}, model = s.model || {}, evaluation = s.evaluation || {};
-  overlay.querySelector("[data-v=status]").textContent = value(s.status || state.mode);
+  overlay.querySelector("[data-v=status]").textContent =
+    value(s.label || "UNAVAILABLE") + " · pipeline " + value(s.status || state.mode);
   overlay.querySelector("[data-v=raw]").textContent = value(inv.raw_node_count);
   overlay.querySelector("[data-v=rendered]").textContent = value(
     state.inventory && state.inventory.decisions ? state.inventory.decisions.length : 0
@@ -103,10 +104,16 @@ function paint() {
   overlay.querySelector("[data-v=loop]").textContent = value(feed.status) + " · " + value(feed.checkpoint);
   overlay.querySelector("[data-v=receipt]").textContent = value(feed.last_successful_receipt);
   overlay.querySelector("[data-v=next]").textContent = value(feed.next_refresh_utc);
+  // The honest label ladder comes from the service: MEASURED only when the whole
+  // pipeline is READY, MODELED when the inventory was read live this request but the
+  // model/evaluation pipeline is BLOCKED, UNAVAILABLE when the graph is unreadable.
   overlay.querySelector("[data-v=note]").textContent = state.error ||
-    ((ds.reasons || []).join(" | ") || "No readiness claim exceeds the receipts shown here.");
+    s.label_basis || ((ds.reasons || []).join(" | ") ||
+    "No readiness claim exceeds the receipts shown here.");
   if (show) {
-    show.setChip("state", s.status || "UNAVAILABLE", { text: "dataset" });
+    show.setChip("state", s.label || "UNAVAILABLE", {
+      text: "pipeline " + value(s.status || state.mode)
+    });
     show.setChip("nodes", s.inventory_label || "UNAVAILABLE", {
       text: "raw nodes " + (inv.raw_node_count == null ? "UNKNOWN" : String(inv.raw_node_count))
     });

static/3d/surfaces/sovereign.js

@@ -49,6 +49,7 @@ const S = {
   reachable:false, baseUrl:null, envPresent:null, apiStyle:null,
   modelTag:"llama3-szl-finetuned-q4", modelServed:null, modelsLive:[],
   via:null, dependency:null, reachNote:null,
+  reason:null, reasonText:null, baseSource:null,
   selftestLabel:"UNAVAILABLE", selftestAnswer:null, selftestPrompt:"State your doctrine in one line",
   activeStage:"UNKNOWN", stageNote:null,
   signMode:null, signed:null, signerFp:null,
@@ -94,6 +95,11 @@ function _onPanel(j){
   S.via=sov.via||null;
   S.dependency=sov.dependency||null;
   S.reachNote=sov.note||null;
+  // Honest, machine-readable reason for a non-live sovereign: an unset env var
+  // (environment gap) reads differently from a configured-but-silent node.
+  S.reason=(sov.unavailable_reason||j.unavailable_reason)||null;
+  S.reasonText=(sov.unavailable_reason_text||j.unavailable_reason_text)||null;
+  S.baseSource=sov.base_url_source||null;
   S.modelTag=j.model_tag||S.modelTag;
 
   const st=j.doctrine_selftest||{};
@@ -179,6 +185,8 @@ function _buildOverlay(ctx){
     '<div style="margin-top:2px;color:#8fb3bd;font-size:10.5px">Operator status of the founder\'s <b>LOCAL sovereign model</b> (Ollama on the Tower, Doctrine-v11 system prompt over base llama3.1:8b). The Tower is <b>not reachable from CI/cloud</b>, so off-Tower this reads <b>UNAVAILABLE</b> — never a fabricated live status or doctrine line.</div>'+
     _row("Reachable","sv-reach")+_row("Model tag","sv-tag")+
     _row("Served (live)","sv-served")+_row("Endpoint base","sv-base")+
+    _row("Why not live","sv-reason")+
+    '<div id="sv-reasontext" style="margin-top:3px;font-size:10.5px;color:#9fc;line-height:1.5"></div>'+
     '<hr style="border:0;border-top:1px solid #1b3a44;margin:8px 0">'+
     '<div style="font-size:10.5px;color:#8fb3bd;margin-bottom:3px">Doctrine self-test — “State your doctrine in one line”</div>'+
     _row("Result","sv-stlabel")+
@@ -218,14 +226,17 @@ function _paintOverlay(){
   const missing=(S.state==="missing"||S.state==="error");
   if(_show) _show.setChip("label",S.label||"UNAVAILABLE");
   if(missing){
-    ["sv-reach","sv-tag","sv-served","sv-base","sv-stlabel","sv-stage","sv-sign"].forEach((id)=>_set(id,"NO-LIVE-DATA"));
+    ["sv-reach","sv-tag","sv-served","sv-base","sv-reason","sv-stlabel","sv-stage","sv-sign"].forEach((id)=>_set(id,"NO-LIVE-DATA"));
+    _set2("sv-reasontext","panel endpoint did not answer this request \u2014 no status inferred.");
     _set2("sv-answer","backend offline — NO-LIVE-DATA (honest, never fabricated).");
     if(_plain)_applyPlain(); return;
   }
   _set("sv-reach",S.reachable?"YES · LIVE-SOVEREIGN":"NO · UNAVAILABLE");
   _set("sv-tag",S.modelTag||"—");
   _set("sv-served",(S.reachable&&S.modelServed)?S.modelServed:"— (node unreachable)");
-  _set("sv-base",S.baseUrl?String(S.baseUrl):(S.envPresent===false?"SZL_LOCAL_LLM_URL unset":"—"));
+  _set("sv-base",(S.baseUrl?String(S.baseUrl):"—")+(S.baseSource?" ( "+S.baseSource+" )":""));
+  _set("sv-reason",S.reachable?"— (node answered this request)":(S.reason||"UNKNOWN"));
+  _set2("sv-reasontext",S.reachable?"":(S.reasonText||""));
   _set("sv-stlabel",S.selftestLabel||"UNAVAILABLE");
   _set2("sv-answer", S.selftestAnswer
     ? S.selftestAnswer

szl_brain_reranker.py

@@ -45,6 +45,8 @@ READY = "READY"
 BLOCKED = "BLOCKED"
 DEGRADED = "DEGRADED"
 UNAVAILABLE = "UNAVAILABLE"
+MEASURED = "MEASURED"
+MODELED = "MODELED"
 UNKNOWN = "UNKNOWN"
 UNVERIFIED = "UNVERIFIED"
 
@@ -822,13 +824,54 @@ def service_status(ns: str = "a11oy", repo_root: pathlib.Path | str | None = Non
         dataset["evaluation_readiness"]["status"],
     )
     operational = all(state == READY for state in readiness)
+    # ------------------------------------------------------------------
+    # Honest surface label (Doctrine v11).  The previous rule collapsed the
+    # surface label to UNAVAILABLE unless ALL THREE readiness dimensions were
+    # READY, so an estate that really does compute a live evidence inventory
+    # every request (real graph read + an admission/quarantine decision per raw
+    # node) advertised itself as having nothing at all, purely because no trained
+    # reranker model manifest exists yet.  That understates what is served and is
+    # as dishonest as overstating it.  The ladder below reports exactly what is
+    # true THIS request and nothing more:
+    #   MEASURED    - dataset + model + evaluation all READY (a real trained and
+    #                 evaluated reranker; a performance claim is then defensible).
+    #   MODELED     - the inventory was read live THIS request (real graph bytes,
+    #                 real decisions) but the model/evaluation pipeline is BLOCKED,
+    #                 so structure and admission decisions are served with NO model
+    #                 performance claim.
+    #   UNAVAILABLE - the graph itself could not be read; nothing real to show.
+    # `status` stays BLOCKED until the pipeline is genuinely operational, so no
+    # reader can mistake MODELED for an operational model.
+    inventory_measured = inventory["label"] == MEASURED
+    blocking_reasons = sorted({
+        *(dataset["dataset_readiness"]["reasons"] or []),
+        *[f"MODEL:{r}" for r in (dataset["model_readiness"].get("reasons") or [])],
+        *[f"EVALUATION:{r}" for r in (dataset["evaluation_readiness"].get("reasons") or [])],
+    })
+    if operational:
+        label = MEASURED
+        label_basis = ("dataset, model and evaluation readiness are all READY — measured "
+                       "from the verified manifests read THIS request.")
+    elif inventory_measured:
+        label = MODELED
+        label_basis = ("evidence inventory read live THIS request (graph bytes hashed, one "
+                       "admission/quarantine decision per raw node), but the reranker "
+                       "model/evaluation pipeline is BLOCKED, so NO model-performance "
+                       "claim is made. Blocking: " + (", ".join(blocking_reasons) or "none"))
+    else:
+        label = UNAVAILABLE
+        label_basis = ("the Brain graph could not be read THIS request — nothing measured "
+                       "and nothing modeled; no state fabricated.")
     return {
         "ok": True, "schema_version": SERVICE_SCHEMA,
         # The inventory can be measured while the train/eval/model pipeline is still
         # unavailable.  Keep those truths separate so the estate rollup cannot turn
         # a measured node count into an operational model claim.
         "status": READY if operational else BLOCKED,
-        "label": "MEASURED" if operational else UNAVAILABLE,
+        "label": label,
+        "label_basis": label_basis,
+        "blocking_reasons": blocking_reasons,
+        "operational": operational,
         "inventory_label": inventory["label"],
         "inventory": inventory["inventory"],
         "inventory_sha256": inventory["inventory_sha256"],

szl_sovereign_panel.py

@@ -70,6 +70,31 @@ DOCTRINE_SELFTEST_PROMPT = "State your doctrine in one line"
 # merged yet we fall back to the registry helper / a direct probe and say so).
 DEV1_HEALTH_ROUTE = "/api/a11oy/v1/llm/sovereign/health"
 
+# Machine-readable reasons for an UNAVAILABLE sovereign. These distinguish the two
+# honestly-different causes so an operator (and the surface HUD) can tell an
+# UNCONFIGURED estate apart from a CONFIGURED-but-down node. Neither is a code bug
+# and neither is ever upgraded to a live label.
+REASON_ENV_UNSET = "SZL_LOCAL_LLM_URL_UNSET"          # no Tower targeted at all
+REASON_NODE_UNREACHABLE = "NODE_UNREACHABLE_THIS_REQUEST"  # env set, node silent
+REASON_NONE = None                                     # reachable — no reason needed
+
+# How the probed base URL was chosen (env vs the localhost fallback default).
+BASE_FROM_ENV = "env:SZL_LOCAL_LLM_URL"
+BASE_FROM_DEFAULT = "default:localhost (SZL_LOCAL_LLM_URL unset)"
+
+
+def unavailable_reason(reachable: bool, env_present: bool) -> str | None:
+    """Honest, machine-readable reason code for a non-live sovereign.
+
+    reachable=True  -> None (nothing to explain; the node answered THIS request).
+    env unset       -> REASON_ENV_UNSET (env gap: the estate never named a Tower;
+                       the probe fell back to the localhost default and was refused).
+    env set, silent -> REASON_NODE_UNREACHABLE (Tower down / not routable from here).
+    """
+    if reachable:
+        return REASON_NONE
+    return REASON_ENV_UNSET if not env_present else REASON_NODE_UNREACHABLE
+
 
 def _now_iso() -> str:
     return datetime.datetime.now(datetime.timezone.utc).isoformat()
@@ -103,6 +128,8 @@ def _probe_reachability() -> dict[str, Any]:
         "via": None,
         "dependency": None,
         "note": "",
+        "base_url_source": None,
+        "unavailable_reason": REASON_ENV_UNSET,
     }
     # Preferred path: Dev-1's registry helper. It is the SAME code that backs the
     # routed GET /api/a11oy/v1/llm/sovereign/health, so this panel and that endpoint
@@ -118,6 +145,8 @@ def _probe_reachability() -> dict[str, Any]:
         out["via"] = "szl_llm_registry.sovereign_probe (backs %s)" % DEV1_HEALTH_ROUTE
         out["dependency"] = "resolved: szl_llm_registry present in this runtime"
         out["note"] = str(probe.get("note") or "")
+        out["base_url_source"] = BASE_FROM_ENV if out["env_present"] else BASE_FROM_DEFAULT
+        out["unavailable_reason"] = unavailable_reason(out["reachable"], out["env_present"])
         return out
     except Exception as exc:  # noqa: BLE001 — Dev-1 module absent → honest direct fallback
         out["dependency"] = (
@@ -135,6 +164,8 @@ def _probe_reachability() -> dict[str, Any]:
     out["base_url"] = base or None
     out["env_present"] = bool(base)
     out["via"] = "direct SZL_LOCAL_LLM_URL probe (Dev-1 helper absent)"
+    out["base_url_source"] = BASE_FROM_ENV if base else BASE_FROM_DEFAULT
+    out["unavailable_reason"] = unavailable_reason(False, bool(base))
     if not base:
         out["note"] = ("SZL_LOCAL_LLM_URL not set — sovereign node is an HONEST STUB; "
                        "reachability UNAVAILABLE (never fabricated).")
@@ -161,6 +192,7 @@ def _probe_reachability() -> dict[str, Any]:
             out["reachable"] = True
             out["models"] = names
             out["api_style"] = kind
+            out["unavailable_reason"] = REASON_NONE
             out["note"] = "node live (%s) — model list real THIS request (direct probe)." % kind
             return out
     out["note"] = ("SZL_LOCAL_LLM_URL set but node did not respond live this request "
@@ -349,6 +381,17 @@ def build_payload() -> dict[str, Any]:
     # A served-model label for the healthz rollup + the panel header (honest).
     live_models = reach.get("models") or []
     model_label = (live_models[0] if (reachable and live_models) else SOVEREIGN_MODEL_TAG)
+    reason = reach.get("unavailable_reason") if not reachable else REASON_NONE
+    reason_text = {
+        REASON_ENV_UNSET: ("SZL_LOCAL_LLM_URL is not set in this runtime, so no Tower was "
+                           "named; the probe fell back to the localhost default and was "
+                           "refused. This is an ENVIRONMENT GAP, not a failed node and not "
+                           "a code fault — set SZL_LOCAL_LLM_URL to a reachable sovereign "
+                           "node and this surface goes live on the next request."),
+        REASON_NODE_UNREACHABLE: ("SZL_LOCAL_LLM_URL is set but the node did not answer this "
+                                  "request (Tower down, or not routable from this runtime). "
+                                  "Honest UNAVAILABLE — no status or answer is fabricated."),
+    }.get(reason)
 
     snapshot: dict[str, Any] = {
         "ok": True,
@@ -370,11 +413,16 @@ def build_payload() -> dict[str, Any]:
             "base_url": reach.get("base_url"),
             "env_present": reach.get("env_present"),
             "api_style": reach.get("api_style"),
+            "base_url_source": reach.get("base_url_source"),
+            "unavailable_reason": reason,
+            "unavailable_reason_text": reason_text,
             "models_live": live_models,
             "via": reach.get("via"),
             "dependency": reach.get("dependency"),
             "note": reach.get("note"),
         },
+        "unavailable_reason": reason,
+        "unavailable_reason_text": reason_text,
         "doctrine_selftest": selftest,
         "stage": stage,
         "dev1_health_route": DEV1_HEALTH_ROUTE,
@@ -405,9 +453,12 @@ def rollup_signal() -> dict[str, Any]:
             "reachable": reachable,
             "model": (live_models[0] if (reachable and live_models) else SOVEREIGN_MODEL_TAG),
             "label": LIVE_SOVEREIGN if reachable else UNAVAILABLE,
+            "unavailable_reason": (reach.get("unavailable_reason")
+                                   if not reachable else REASON_NONE),
         }
     except Exception as exc:  # noqa: BLE001 — never crash the health path; honest UNAVAILABLE
         return {"reachable": False, "model": SOVEREIGN_MODEL_TAG, "label": UNAVAILABLE,
+                "unavailable_reason": REASON_NODE_UNREACHABLE,
                 "error": f"{type(exc).__name__}: {exc}"}
 
 
@@ -420,6 +471,7 @@ def handle() -> dict[str, Any]:
             "ok": False,
             "endpoint": "frontier/sovereign",
             "label": UNAVAILABLE,
+            "unavailable_reason": REASON_NODE_UNREACHABLE,
             "error": str(exc),
             "doctrine": "v11: sovereign surface unavailable; no fabricated status/answer emitted.",
             "timestamp_utc": _now_iso(),