deploy(hf): sync szl-holdings/a11oy@5eeceec2a494fc4d55794023bd7ebc8373124a73 derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy 5eeceec2a494fc4d55794023bd7ebc8373124a73.
Files: 1301 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Dockerfile

@@ -644,6 +644,15 @@ COPY szl_organ_integrity.py ./szl_organ_integrity.py
 # Packet 8 Decision Integrity desk on a-11-oy.com (GET /decision).
 # Frozen evals. Formula authority NONE. Status ROADMAP. Does not stamp LIVE.
 # Bound-path Command Center SPA on a-11-oy.com/command. Does not steal /console.
+# L6 CHAIN-OF-TITLE ATTESTATION (Wave 32): in-toto v1 Statement whose subject binds
+# the locked-8 kernel gitCommit, DSSE-signed via szl_dsse, with a guarded Rekor
+# submission that records UNREACHABLE/UNKNOWN rather than a fabricated entry.
+# Serves GET /api/a11oy/v1/attest/manifest and GET|POST /api/a11oy/v1/attest/verify
+# plus the `attest` holographic surface. Policy: ops/szl_chain_of_title.rego.
+COPY szl_attest.py ./szl_attest.py
+COPY ops/szl_chain_of_title.rego ./ops/szl_chain_of_title.rego
+COPY static/3d/surfaces/attest.js ./static/3d/surfaces/attest.js
+
 COPY verticals/_kernel/a11oy_kernel.py ./verticals/_kernel/a11oy_kernel.py
 COPY verticals/PACKET8.json ./verticals/PACKET8.json
 COPY verticals/terra ./verticals/terra

ops/szl_chain_of_title.rego

@@ -0,0 +1,196 @@
+# SPDX-License-Identifier: Apache-2.0
+# © 2026 Lutar, Stephen P. — SZL Holdings · ORCID 0009-0001-0110-4173 · Doctrine v11
+#
+# szl_chain_of_title.rego — L6 CHAIN-OF-TITLE ATTESTATION POLICY.
+#
+# Input: an in-toto v1 Statement (https://in-toto.io/Statement/v1) carrying
+# predicateType "https://szl.dev/chain-of-title/v1", as emitted by szl_attest.py
+# and DSSE-signed via szl_dsse. Evaluate with OPA:
+#
+#     opa eval -i statement.json -d ops/szl_chain_of_title.rego \
+#       'data.szl.attest.chain_of_title.verdict'
+#
+# The verdict is TRI-STATE and fails closed:
+#
+#   PASSED  — every rule below holds.
+#   FAILED  — at least one rule does not hold (a tampered or under-provenanced
+#             Statement is FAILED, never UNKNOWN).
+#   UNKNOWN — reserved for the TRANSPARENCY strand, which this policy does not
+#             and cannot evaluate offline: a Rekor inclusion proof is a live
+#             network fact. When the caller requires transparency
+#             (input.require_transparency == true) and no real inclusion proof
+#             is present, the verdict is UNKNOWN — NEVER a fabricated PASSED.
+#
+# Doctrine v11 (binding): no fabricated PASSED / MEASURED / Rekor entry; Λ is
+# Conjecture 1, never a theorem; the locked-8 {F1,F4,F7,F11,F12,F18,F19,F22} @
+# c7c0ba17 is immutable and this policy only ATTESTS the pin, never extends it;
+# provenance coverage must be fully disclosed at 1.0.
+#
+# Cited prior art (SZL claims none of it as its own):
+#   in-toto Attestation Framework  — https://github.com/in-toto/attestation
+#   SLSA v1.1 (Build L0-L3 + VSA)  — https://slsa.dev/spec/v1.1/
+#   Sigstore / Rekor transparency  — https://docs.sigstore.dev/logging/overview/
+#   DSSE                           — https://github.com/secure-systems-lab/dsse
+#   sigstore/model-transparency    — https://github.com/sigstore/model-transparency
+#
+# This file is the AUTHORITATIVE statement of the policy. szl_attest.evaluate_policy
+# mirrors it rule for rule in-process so the API verdict and an external OPA
+# evaluation agree; tests/test_attest.py asserts the rule names stay in lockstep.
+
+package szl.attest.chain_of_title
+
+import future.keywords.if
+import future.keywords.in
+
+expected_predicate_type := "https://szl.dev/chain-of-title/v1"
+
+expected_doctrine := "v11"
+
+kernel_subject_name := "locked8_kernel"
+
+# --------------------------------------------------------------------------- #
+# Rule 1 — the predicate type is exactly the SZL chain-of-title type.
+# --------------------------------------------------------------------------- #
+predicate_type_matches if {
+	input.predicateType == expected_predicate_type
+}
+
+# --------------------------------------------------------------------------- #
+# Rule 2 — doctrine v11. An unversioned or drifted doctrine is not attestable.
+# --------------------------------------------------------------------------- #
+doctrine_is_v11 if {
+	input.predicate.doctrine == expected_doctrine
+}
+
+# --------------------------------------------------------------------------- #
+# Rule 3 — the locked-8 kernel was actually verified when the Statement was
+# built (szl_attest re-checks the digest-verified formula registry). Must be
+# boolean true; a truthy string or a missing field does not pass.
+# --------------------------------------------------------------------------- #
+kernel_verified if {
+	input.predicate.provenance.kernel_verified == true
+}
+
+# --------------------------------------------------------------------------- #
+# Rule 4 — every honesty invariant holds. These are the doctrine claims bound
+# INTO the signed predicate; this is what makes the doctrine third-party
+# checkable rather than a marketing line.
+# --------------------------------------------------------------------------- #
+honesty_invariants_all_true if {
+	inv := input.predicate.honesty_invariants
+	inv.no_fabricated_measured == true
+	inv.lambda_is_conjecture_not_theorem == true
+	inv.locked8_immutable == true
+	inv.provenance_coverage == 1.0
+}
+
+# --------------------------------------------------------------------------- #
+# Rule 5 — provenance coverage is exactly 1.0 (fully DISCLOSED: every field is
+# a real read or an explicit null with its reason; nothing omitted).
+# --------------------------------------------------------------------------- #
+provenance_coverage_is_one if {
+	input.predicate.provenance.provenance_coverage == 1.0
+}
+
+# --------------------------------------------------------------------------- #
+# Rule 6 — the subject binds a NON-EMPTY locked-8 kernel gitCommit. An
+# attestation with no bound kernel commit attests nothing.
+# --------------------------------------------------------------------------- #
+subject_binds_kernel_commit if {
+	some s in input.subject
+	s.name == kernel_subject_name
+	commit := s.digest.gitCommit
+	is_string(commit)
+	trim_space(commit) != ""
+}
+
+# --------------------------------------------------------------------------- #
+# Aggregate — passed iff ALL SIX rules hold. Default false: fail closed.
+# --------------------------------------------------------------------------- #
+default passed := false
+
+passed if {
+	predicate_type_matches
+	doctrine_is_v11
+	kernel_verified
+	honesty_invariants_all_true
+	provenance_coverage_is_one
+	subject_binds_kernel_commit
+}
+
+# Named failures, so a denial always says which rule broke rather than just "no".
+failed_rules contains "predicate_type_matches" if not predicate_type_matches
+
+failed_rules contains "doctrine_is_v11" if not doctrine_is_v11
+
+failed_rules contains "kernel_verified" if not kernel_verified
+
+failed_rules contains "honesty_invariants_all_true" if not honesty_invariants_all_true
+
+failed_rules contains "provenance_coverage_is_one" if not provenance_coverage_is_one
+
+failed_rules contains "subject_binds_kernel_commit" if not subject_binds_kernel_commit
+
+# --------------------------------------------------------------------------- #
+# Transparency strand — evaluated ONLY from evidence the caller supplies. A
+# real Rekor inclusion proof plus a log index is the only thing that counts.
+# There is deliberately no branch that infers inclusion from anything else.
+# --------------------------------------------------------------------------- #
+default transparency_recorded := false
+
+transparency_recorded if {
+	input.rekor.status == "RECORDED"
+	input.rekor.inclusion_proof != null
+	input.rekor.log_index != null
+}
+
+default transparency_required := false
+
+transparency_required if {
+	input.require_transparency == true
+}
+
+# --------------------------------------------------------------------------- #
+# The tri-state verdict. Order matters: FAILED wins over UNKNOWN, so a tampered
+# Statement can never hide behind an unreachable log.
+# --------------------------------------------------------------------------- #
+verdict := "FAILED" if {
+	not passed
+}
+
+verdict := "UNKNOWN" if {
+	passed
+	transparency_required
+	not transparency_recorded
+}
+
+verdict := "PASSED" if {
+	passed
+	not transparency_required
+}
+
+verdict := "PASSED" if {
+	passed
+	transparency_required
+	transparency_recorded
+}
+
+# Honest scope string, so a policy-only PASSED is never read as a
+# transparency-anchored one.
+verdict_scope := "policy-only: chain-of-title rules hold; transparency strand not evaluated" if {
+	verdict == "PASSED"
+	not transparency_recorded
+}
+
+verdict_scope := "policy + transparency: rules hold and a real Rekor inclusion proof is present" if {
+	verdict == "PASSED"
+	transparency_recorded
+}
+
+verdict_scope := "transparency required but no real inclusion proof present — UNKNOWN, never a fabricated PASSED" if {
+	verdict == "UNKNOWN"
+}
+
+verdict_scope := sprintf("failed policy rules: %v", [sort(failed_rules)]) if {
+	verdict == "FAILED"
+}

serve.py

@@ -1708,6 +1708,28 @@ try:
 except Exception as _szl_attest_e:  # pragma: no cover
     print(f"[a11oy] Attestation surface NOT registered: {_szl_attest_e!r}; SPA + API unaffected", file=__import__("sys").stderr)
 
+# ── WAVE-32 DEV E: L6 CHAIN-OF-TITLE ATTESTATION (the allodial claim, made third-party
+# verifiable). GET /api/a11oy/v1/attest/manifest → an in-toto v1 Statement (subject binds the
+# locked-8 kernel gitCommit c7c0ba17, plus a sovereign-weights sha256 ONLY when a real weights
+# artifact is readable this request; honest null otherwise), predicateType
+# "https://szl.dev/chain-of-title/v1", predicate = doctrine v11 + provenance (corpus_sha, training
+# cfg read from the committed trainer, kernel_verified re-checked against the digest-verified
+# formula registry, kernel_pin) + energy_measured[] (HONESTLY EMPTY with no live joule meter) +
+# honesty_invariants + the tier-PROPOSED SEAL formula; DSSE-signed via szl_dsse (UNSIGNED and
+# labelled so when no runtime cosign secret exists) and structured for cosign keyless / Rekor.
+# GET+POST /api/a11oy/v1/attest/verify → PASSED / FAILED honestly, UNKNOWN when a required Rekor
+# inclusion proof is unreachable. NEVER a fabricated PASSED, MEASURED, or Rekor entry. Policy is
+# authoritative in ops/szl_chain_of_title.rego and mirrored in-process rule for rule. Registered
+# AFTER szl_attest_stack so the STATIC /attest/manifest + /attest/verify routes front-insert ahead
+# of the parametrized /attest/{receipt_hash} route, and BEFORE the SPA catch-all. Additive,
+# try/except-guarded. Adds NOTHING to the locked-8; Λ stays Conjecture 1.
+try:
+    import szl_attest as _szl_attest
+    _szl_attest_status = _szl_attest.register(app, ns="a11oy")
+    print(f"[a11oy] L6 chain-of-title attestation registered: {_szl_attest_status}", file=__import__("sys").stderr)
+except Exception as _szl_attest_l6_e:  # pragma: no cover
+    print(f"[a11oy] L6 chain-of-title attestation NOT registered: {_szl_attest_l6_e!r}; SPA + API unaffected", file=__import__("sys").stderr)
+
 # ── WAVE-H TEAM 3: ATTESTED INFERENCE (deepening of Wave-A cc-attest). Endpoint
 # GET /api/a11oy/v1/attest/infer?seed&model → deterministic MODELED flow: device attestation
 # (reuses szl_tee_attest measured-boot chain) → Λ-gate (weighted geomean, Conjecture 1) →

static/3d/holographic.html

@@ -423,6 +423,7 @@ const SURFACES = [
   { id: "open", cat: "more", flag: true, title: "Open Frontier · Live Hugging Face · MEASURED live Hugging Face Hub trending stream — one pillar per org/author (height = summed likes, bead = download reach); most-liked open models orbit as satellites coloured by task; log-scaling is display-only, no invented benchmark, score, or ranking beyond the Hub’s own", mod: "/static/3d/surfaces/open.js" },
   { id: "brainagent", cat: "brain", title: "Brain Agent · honesty-gated agentic graph reasoner · treats the brain graph as a state space and walks it one node at a time for a query, choosing EXPAND/FOLLOW/BACKTRACK/STOP by pure graph heuristics (no model call, fully deterministic); every candidate hop passes an honesty gate built from the sibling surfaces (grounding, provenance, contradiction, uncertainty) — an ungrounded/untraceable/contradicted/uncertain hop is refused with a recorded reason, an absent guard is UNAVAILABLE never a fabricated pass; within an explicit step/node budget it returns ANSWER-GROUNDED/PARTIAL or abstains ABSTAINED-BUDGET/ABSTAINED-INSUFFICIENT rather than answer under-grounded, emits an ordered trace + unsigned SHA-256 receipt-on-write, makes no sentience claim (MODELED)", mod: "/static/3d/surfaces/brainagent.js" },
   { id: "estateconstitution", cat: "governance", title: "Estate Constitution · the WHOLE ESTATE's honesty posture graded continuously against explicit estate-level ARTICLES (the per-query brain-constitution pattern lifted to the estate) · Art 1 the honesty wall holds (0 REACHABLE invariant violations), Art 2 no surface declares a fabricated MEASURED label (every declared label in the honest vocabulary, read VERBATIM), Art 3 manifest coverage DISCLOSED honestly (NATIVE-OK vs NO-MANIFEST counted out loud — a DISCLOSURE Article: admitting the gap is compliance, papering it over is the violation, full coverage never claimed while any surface is unverifiable), Art 4 doctrine invariants (Λ = Conjecture 1 never a theorem, locked-8 never inflated, trust ceiling 0.97 never 100%, no consciousness claim) · each graded COMPLIANT/VIOLATED/UNAVAILABLE over the szl_honestywall aggregate read in-process through a GUARDED import (an unreadable aggregate is UNAVAILABLE, never a fabricated pass) → CONSTITUTIONAL/IN-VIOLATION/INSUFFICIENT-SIGNAL, never CONSTITUTIONAL while any evaluable Article is VIOLATED, unsigned SHA-256 receipt-on-write (MODELED)", mod: "/static/3d/surfaces/estateconstitution.js" },
+  { id: "attest", cat: "governance", title: "Chain of Title · L6 attestation · the allodial claim made third-party verifiable · an in-toto v1 Statement whose SUBJECT binds the locked-8 kernel gitCommit c7c0ba17 (plus a sovereign-weights sha256 ONLY when a real weights artifact is readable this request — honest null otherwise, never an invented digest), predicateType https://szl.dev/chain-of-title/v1, predicate = doctrine v11 + provenance (corpus_sha, training config read VERBATIM from the committed trainer, kernel_verified RE-CHECKED this request against the digest-verified formula registry, kernel_pin) + energy_measured[] (HONESTLY EMPTY with no live joule meter — no joule fabricated) + honesty_invariants {no_fabricated_measured, lambda_is_conjecture_not_theorem, locked8_immutable, provenance_coverage 1.0} bound INTO the signed predicate so the doctrine itself becomes third-party checkable + the tier-PROPOSED SEAL formula (EU CSF SEAL + HHI prior art, no score asserted) · DSSE-signed through the estate cosign key (explicitly UNSIGNED-NO-KEY when no runtime secret is present, never a fabricated signature) and structured for cosign keyless + Rekor: a real inclusion proof reads RECORDED/MEASURED, an unreachable log reads UNREACHABLE and the verdict is UNKNOWN — never a fabricated Rekor entry or PASSED · the verdict is tri-state and FAILED beats UNKNOWN so a tampered Statement cannot hide behind an offline log; policy authoritative in ops/szl_chain_of_title.rego, mirrored in-process rule for rule (MODELED)", mod: "/static/3d/surfaces/attest.js" },
 ];
 
 const stageEl = document.getElementById("stage");

static/3d/surfaces/attest.js

@@ -0,0 +1,592 @@
+// SPDX-License-Identifier: Apache-2.0
+// © 2026 Lutar, Stephen P. — SZL Holdings · ORCID 0009-0001-0110-4173 · Doctrine v11
+//
+// surfaces/attest.js — CHAIN OF TITLE · L6 ATTESTATION. The allodial claim, drawn as the thing a
+// third party can actually check. One PILLAR per chain-of-title policy rule (predicate type ·
+// doctrine v11 · kernel verified · honesty invariants · provenance coverage 1.0 · subject binds a
+// non-empty kernel commit), a CORE orb carrying the tri-state verdict PASSED / FAILED / UNKNOWN,
+// two SUBJECT anchors on the floor (the locked-8 kernel gitCommit, always bound; the sovereign
+// weights sha256, drawn grey and hollow when no weights artifact is readable — an absent subject
+// is SHOWN, never invented), and a TRANSPARENCY beam standing for the Rekor strand.
+//
+// Pure honesty / provenance / observability. It advances NO detection, fusion, effector, targeting
+// or cueing capability, and it proves nothing new about the locked-8 — it ATTESTS the pin.
+//
+// DATA: live snapshot from GET /api/a11oy/v1/attest/manifest (PURE READ; the ledger write is
+// opt-in on SZL_LAKE_DIR and never happens on this path):
+//   ok, label, verdict, verdict_scope, statement_digest_sha256,
+//   statement{ _type, predicateType, subject[]{name,digest}, predicate{ doctrine,
+//     provenance{ corpus_sha, kernel_verified, kernel_pin, provenance_coverage },
+//     energy_measured[], honesty_invariants{...}, seal{ formula, tier }, lambda{...} } },
+//   envelope{ signed, payloadType, signatures[] },
+//   rekor{ status (RECORDED|UNREACHABLE|NOT_ATTEMPTED), log_index, inclusion_proof, label },
+//   verification{ policy{ checks{...}, failed[] }, signature{ status }, transparency{...} }.
+//
+// HONESTY LABEL: MODELED. It becomes MEASURED only for the transparency strand, and only when a
+//   REAL Rekor inclusion proof came back in the same request — the surface reads the server's
+//   label VERBATIM and never upgrades it. UNKNOWN is drawn as UNKNOWN: an unreachable
+//   transparency log is never coloured as a pass. A FAILED rule is drawn tallest so it cannot
+//   hide. Λ = Conjecture 1 (never a theorem, never green). Trust ceiling 0.97, never 100%. The
+//   SEAL formula is shown with its tier PROPOSED attached, and no score is asserted.
+// COLOURS (approved palette only, no green): proof-teal 0x3af4c8 (PASSED / rule holds / RECORDED),
+//   lattice-blue 0x5b8dee (frame / UNKNOWN), violet-blue 0x8a6bff (FAILED / rule broken),
+//   grey 0x42505d (absent subject / NOT_ATTEMPTED / init).
+// 0 RUNTIME CDN. Vendored three.js via the page importmap (ctx.THREE).
+// CITED PRIOR ART (SZL claims none of it as its own): in-toto Attestation Framework; SLSA v1.1
+//   Build L0-L3 + Verification Summary Attestation; Sigstore/cosign keyless + Rekor; DSSE;
+//   sigstore/model-transparency; EU Cloud Sovereignty Framework SEAL + HHI (the SEAL formula).
+// DOCTRINE v11: adds NOTHING to the locked-8 {F1,F4,F7,F11,F12,F18,F19,F22} @ c7c0ba17; introduces
+//   no theorem; makes no consciousness claim. Degrades grey on 404/error.
+
+import { createShowcase } from "./_showcase.js";
+
+const ID    = "attest";
+const TITLE = "Chain of Title · L6 attestation · the allodial claim, third-party verifiable (live)";
+
+// same-origin, relative — no CDN, no cross-origin fetch. PURE-READ attestation endpoint.
+const EP = "/api/a11oy/v1/attest/manifest";
+
+const C_OK      = 0x3af4c8;  // proof-teal   — PASSED / rule holds / RECORDED
+const C_MID     = 0x5b8dee;  // lattice-blue — UNKNOWN / frame
+const C_BAD     = 0x8a6bff;  // violet-blue  — FAILED / rule broken
+const C_NEUTRAL = 0x42505d;  // grey         — absent subject / NOT_ATTEMPTED / init
+const C_GRID    = 0x1b3a44;
+
+// The six policy rules, in the order ops/szl_chain_of_title.rego declares them.
+const RULES = [
+  ["predicate_type_matches",      "predicate type"],
+  ["doctrine_is_v11",             "doctrine v11"],
+  ["kernel_verified",             "kernel verified"],
+  ["honesty_invariants_all_true", "honesty invariants"],
+  ["provenance_coverage_is_one",  "provenance 1.0"],
+  ["subject_binds_kernel_commit", "subject binds kernel"],
+];
+
+function _verdictColor(v) {
+  const s = String(v || "").toUpperCase();
+  if (s === "PASSED")  return C_OK;
+  if (s === "FAILED")  return C_BAD;
+  if (s === "UNKNOWN") return C_MID;
+  return C_NEUTRAL;
+}
+function _ruleColor(held) {
+  if (held === true)  return C_OK;
+  if (held === false) return C_BAD;
+  return C_NEUTRAL;                       // not evaluated this request
+}
+function _rekorColor(status) {
+  const s = String(status || "").toUpperCase();
+  if (s === "RECORDED")    return C_OK;
+  if (s === "UNREACHABLE") return C_MID;   // UNKNOWN, never a pass
+  return C_NEUTRAL;                        // NOT_ATTEMPTED / init
+}
+
+let _stage = null, _THREE = null, _ctx = null, _group = null, _show = null;
+let _frameReg = false, _polls = [], _el = {}, _badge = null, _plain = false;
+
+let _core = null;             // verdict core orb
+let _pillars = [];            // [{ mesh, key, held }]
+let _anchors = [];            // [{ mesh, name, bound }]
+let _beam = null;             // transparency (Rekor) beam
+let _spin = 0;
+
+// live state — every field read from JSON; nothing invented
+const S = {
+  label:       null,   // server label VERBATIM (MODELED, or MEASURED for a real inclusion proof)
+  verdict:     null,   // PASSED | FAILED | UNKNOWN
+  scope:       null,   // what the verdict actually covers
+  stmtDigest:  null,
+  predType:    null,
+  doctrine:    null,
+  corpusSha:   null,
+  kernelPin:   null,
+  kernelOk:    null,
+  coverage:    null,
+  invariants:  null,   // { name: bool }
+  energyCount: null,   // length of energy_measured[] — 0 is the honest offline state
+  sealFormula: null,
+  sealTier:    null,
+  lambdaStat:  null,
+  lambdaThm:   null,
+  trustCeil:   null,
+  signed:      null,
+  sigStatus:   null,
+  subjects:    [],     // [{ name, bound, digest }]
+  rekorStatus: null,
+  rekorIndex:  null,
+  rekorLabel:  null,
+  rekorNote:   null,
+  checks:      {},     // rule -> bool
+  failed:      [],
+  state:       "init",
+};
+
+// =============================================================================
+export function mount(ctx) {
+  _ctx = ctx; _stage = ctx.stage; _THREE = ctx.THREE;
+  _group = new _THREE.Group();
+  _stage.scene.add(_group);
+  _stage.camera.position.set(0, 5.4, 19.0);
+  try {
+    if (_stage.controls && _stage.controls.target) {
+      _stage.controls.target.set(0, 2.6, 0); _stage.controls.update();
+    }
+  } catch (_) {}
+  try { _stage.setBloom(true); } catch (_) {}
+
+  _buildFloor();
+  _buildCore();
+  _buildBeam();
+
+  if (!_frameReg) { _stage.onFrame(_onFrame); _frameReg = true; }
+
+  _badge = ctx.live.createBadge();
+  _polls.push(ctx.live.poll(EP, 12000, _onData, {
+    badge: _badge,
+    onState: (m) => { S.state = m.state; _paintOverlay(); _paintCore(); },
+  }));
+
+  _buildOverlay();
+  return { id: ID, started: true };
+}
+
+// =============================================================================
+function _buildFloor() {
+  const THREE = _THREE;
+  const grid = new THREE.GridHelper(40, 40, C_GRID, 0x0f2027);
+  grid.material.opacity = 0.16; grid.material.transparent = true; grid.position.y = -0.01;
+  _group.add(grid);
+}
+
+function _buildCore() {
+  const THREE = _THREE;
+  _core = new THREE.Mesh(
+    new THREE.OctahedronGeometry(1.7, 1),
+    new THREE.MeshStandardMaterial({
+      color: C_NEUTRAL, emissive: C_NEUTRAL, emissiveIntensity: 0.34,
+      transparent: true, opacity: 0.9, flatShading: true,
+    }));
+  _core.position.set(0, 5.0, 0);
+  _group.add(_core);
+
+  // the "deed" ring the rules stand on
+  const pts = [];
+  const R = 6.2;
+  for (let i = 0; i <= 80; i++) {
+    const a = (i / 80) * Math.PI * 2;
+    pts.push(new THREE.Vector3(Math.cos(a) * R, 0.02, Math.sin(a) * R));
+  }
+  const ring = new THREE.Line(
+    new THREE.BufferGeometry().setFromPoints(pts),
+    new THREE.LineBasicMaterial({ color: C_MID, transparent: true, opacity: 0.4 }));
+  _group.add(ring);
+}
+
+// The TRANSPARENCY beam — the Rekor strand. Teal and solid only for a real inclusion proof;
+// lattice-blue and translucent for UNREACHABLE (UNKNOWN); grey for NOT_ATTEMPTED. There is no
+// state in which an unanchored attestation is drawn as anchored.
+function _buildBeam() {
+  const THREE = _THREE;
+  _beam = new THREE.Mesh(
+    new THREE.CylinderGeometry(0.16, 0.16, 9.0, 12, 1, true),
+    new THREE.MeshStandardMaterial({
+      color: C_NEUTRAL, emissive: C_NEUTRAL, emissiveIntensity: 0.2,
+      transparent: true, opacity: 0.22, side: THREE.DoubleSide,
+    }));
+  _beam.position.set(0, 9.6, 0);
+  _group.add(_beam);
+}
+
+// One PILLAR per policy rule. A BROKEN rule stands tallest and reads violet so it cannot hide; an
+// un-evaluated rule is a short grey stub, never a quiet pass. Rebuilt on every snapshot.
+function _buildPillars() {
+  const THREE = _THREE;
+  _disposePillars();
+
+  const R = 5.4;
+  const geo = new THREE.BoxGeometry(0.95, 1.0, 0.95);
+  for (let i = 0; i < RULES.length; i++) {
+    const key = RULES[i][0];
+    const held = (key in S.checks) ? !!S.checks[key] : null;
+    const color = _ruleColor(held);
+    const h = held === false ? 4.9 : (held === true ? 3.4 : 1.2);
+    const a = (i / RULES.length) * Math.PI * 2 - Math.PI / 2;
+
+    const mesh = new THREE.Mesh(geo, new THREE.MeshStandardMaterial({
+      color, emissive: color, emissiveIntensity: 0.26,
+      transparent: true, opacity: held === null ? 0.4 : 0.92,
+    }));
+    mesh.scale.y = h;
+    mesh.position.set(Math.cos(a) * R, h / 2, Math.sin(a) * R);
+    _group.add(mesh);
+    _pillars.push({ mesh, key, held });
+  }
+}
+
+// SUBJECT anchors — the two things the deed can bind. The kernel anchor is solid (its gitCommit is
+// always bound). The weights anchor is drawn HOLLOW and grey when no weights artifact is readable:
+// the missing subject is displayed as missing rather than filled in.
+function _buildAnchors() {
+  const THREE = _THREE;
+  _disposeAnchors();
+
+  const want = ["locked8_kernel", "sovereign_weights"];
+  for (let i = 0; i < want.length; i++) {
+    const name = want[i];
+    const found = S.subjects.find((s) => s.name === name);
+    const bound = !!(found && found.bound);
+    const color = bound ? C_OK : C_NEUTRAL;
+    const mesh = new THREE.Mesh(
+      new THREE.TorusGeometry(1.05, bound ? 0.2 : 0.07, 10, 40),
+      new THREE.MeshStandardMaterial({
+        color, emissive: color, emissiveIntensity: bound ? 0.3 : 0.1,
+        transparent: true, opacity: bound ? 0.9 : 0.35, wireframe: !bound,
+      }));
+    mesh.rotation.x = Math.PI / 2;
+    mesh.position.set(i === 0 ? -3.1 : 3.1, 0.35, 8.4);
+    _group.add(mesh);
+    _anchors.push({ mesh, name, bound });
+  }
+}
+
+function _rm(o) {
+  if (!o) return;
+  try {
+    if (o.geometry && o.geometry.dispose) o.geometry.dispose();
+    if (o.material) {
+      const ms = Array.isArray(o.material) ? o.material : [o.material];
+      ms.forEach((m) => m.dispose && m.dispose());
+    }
+    if (_group) _group.remove(o);
+  } catch (_) {}
+}
+function _disposePillars() { _pillars.forEach((p) => _rm(p.mesh)); _pillars = []; }
+function _disposeAnchors() { _anchors.forEach((a) => _rm(a.mesh)); _anchors = []; }
+
+// =============================================================================
+// live data — read VERBATIM, never upgrade a label, never fabricate a pass
+// =============================================================================
+function _onData(j) {
+  const st = (j && j.statement) || {};
+  const pr = (st && st.predicate) || {};
+  const pv = (pr && pr.provenance) || {};
+  const ver = (j && j.verification) || {};
+  const pol = (ver && ver.policy) || {};
+  const env = (j && j.envelope) || {};
+  const rk = (j && j.rekor) || {};
+
+  // The server's own label, verbatim. MODELED unless it reported MEASURED for a real proof.
+  S.label   = j && j.label ? String(j.label).toUpperCase() : "MODELED";
+  S.verdict = j && j.verdict ? String(j.verdict).toUpperCase() : null;
+  S.scope   = j && j.verdict_scope ? String(j.verdict_scope) : null;
+  S.stmtDigest = j && j.statement_digest_sha256 ? String(j.statement_digest_sha256) : null;
+
+  S.predType = st.predicateType ? String(st.predicateType) : null;
+  S.doctrine = pr.doctrine ? String(pr.doctrine) : null;
+  S.corpusSha = typeof pv.corpus_sha === "string" ? pv.corpus_sha : null;
+  S.kernelPin = pv.kernel_pin ? String(pv.kernel_pin) : null;
+  S.kernelOk  = typeof pv.kernel_verified === "boolean" ? pv.kernel_verified : null;
+  S.coverage  = typeof pv.provenance_coverage === "number" ? pv.provenance_coverage : null;
+
+  S.invariants = (pr.honesty_invariants && typeof pr.honesty_invariants === "object")
+    ? pr.honesty_invariants : null;
+  // 0 is the HONEST offline state (no meter answered) — it is displayed as 0, not hidden.
+  S.energyCount = Array.isArray(pr.energy_measured) ? pr.energy_measured.length : null;
+
+  const seal = (pr && pr.seal) || {};
+  S.sealFormula = seal.formula ? String(seal.formula) : null;
+  S.sealTier    = seal.tier ? String(seal.tier).toUpperCase() : null;
+
+  const lam = (pr && pr.lambda) || {};
+  S.lambdaStat = lam.status ? String(lam.status) : null;
+  S.lambdaThm  = typeof lam.is_theorem === "boolean" ? lam.is_theorem : null;
+  S.trustCeil  = typeof lam.trust_ceiling === "number" ? lam.trust_ceiling : null;
+
+  S.signed    = typeof env.signed === "boolean" ? env.signed : null;
+  S.sigStatus = (ver.signature && ver.signature.status)
+    ? String(ver.signature.status).toUpperCase() : null;
+
+  const subs = Array.isArray(st.subject) ? st.subject : [];
+  S.subjects = subs.map((s) => {
+    const d = (s && s.digest) || {};
+    const val = d.gitCommit || d.sha256 || null;
+    return {
+      name: s && s.name ? String(s.name) : "?",
+      digest: val ? String(val) : null,
+      bound: !!(val && String(val).trim()),
+    };
+  });
+
+  S.rekorStatus = rk.status ? String(rk.status).toUpperCase() : null;
+  S.rekorIndex  = (rk.log_index === null || rk.log_index === undefined) ? null : rk.log_index;
+  S.rekorLabel  = rk.label ? String(rk.label).toUpperCase() : null;
+  S.rekorNote   = rk.note ? String(rk.note) : null;
+
+  S.checks = (pol.checks && typeof pol.checks === "object") ? pol.checks : {};
+  S.failed = Array.isArray(pol.failed) ? pol.failed : [];
+
+  _buildPillars();
+  _buildAnchors();
+  _paintCore();
+  _paintBeam();
+  _paintOverlay();
+}
+
+// =============================================================================
+function _onFrame() {
+  const t = performance.now();
+  if (_group) _group.rotation.y = Math.sin(t * 0.00005) * 0.07;
+
+  const live = S.state === "live";
+  if (_core) {
+    _core.rotation.y += 0.004; _core.rotation.x += 0.0013;
+    _core.material.emissiveIntensity =
+      0.34 + (live ? 0.24 : 0.07) * (0.5 + 0.5 * Math.sin(t * 0.003));
+  }
+  if (_beam) {
+    // The beam only pulses for a REAL inclusion proof; UNKNOWN sits still and dim.
+    const recorded = S.rekorStatus === "RECORDED";
+    _beam.material.emissiveIntensity =
+      recorded && live ? 0.42 + 0.28 * (0.5 + 0.5 * Math.sin(t * 0.004)) : 0.16;
+  }
+  _anchors.forEach((a) => { a.mesh.rotation.z += a.bound ? 0.006 : 0.0015; });
+  if (_pillars.length) {
+    _spin = (t * 0.0002) % 1;
+    const lead = Math.floor(_spin * _pillars.length);
+    for (let i = 0; i < _pillars.length; i++) {
+      const p = _pillars[i];
+      const base = p.held === false ? 0.62 : (p.held === true && live ? 0.26 : 0.11);
+      p.mesh.material.emissiveIntensity = (i === lead && live) ? Math.max(base, 0.85) : base;
+    }
+  }
+}
+
+// =============================================================================
+function _paintCore() {
+  if (!_core) return;
+  const col = (S.state === "live") ? _verdictColor(S.verdict) : C_NEUTRAL;
+  _core.material.color.setHex(col);
+  _core.material.emissive.setHex(col);
+}
+
+function _paintBeam() {
+  if (!_beam) return;
+  const col = (S.state === "live") ? _rekorColor(S.rekorStatus) : C_NEUTRAL;
+  _beam.material.color.setHex(col);
+  _beam.material.emissive.setHex(col);
+  _beam.material.opacity = S.rekorStatus === "RECORDED" ? 0.5 : 0.2;
+}
+
+// =============================================================================
+// overlay (HUD)
+// =============================================================================
+function _buildOverlay() {
+  const ctx = _ctx;
+  _show = createShowcase(ctx, {
+    id: ID, title: TITLE, accent: "#5b8dee", badge: _badge,
+    chips: [{ label: "MODELED", text: "chain of title", name: "lbl" },
+            { label: "—", text: "verdict", name: "vrd" }],
+    legend: ["MODELED"],
+  });
+  const host = _show.body;
+
+  const sub = document.createElement("div");
+  sub.style.cssText = "color:#9fb1bf;font-size:11px;line-height:1.55";
+  sub.innerHTML =
+    'The allodial claim is only worth what a <b>third party can check</b>. This surface reads the ' +
+    'estate\'s <b>in-toto v1 Statement</b>: its <b>subject</b> binds the locked-8 kernel ' +
+    '<b>gitCommit c7c0ba17</b> (and a sovereign-weights sha256 only when a real weights artifact ' +
+    'is readable that request — the hollow grey ring is an <i>absent</i> subject, shown rather ' +
+    'than invented); its <b>predicate</b> carries doctrine v11, the provenance strand ' +
+    '(corpus_sha, training config read verbatim from the committed trainer, kernel_verified ' +
+    're-checked against the digest-verified formula registry), <b>energy_measured[]</b> — empty ' +
+    'when no joule meter answered — and the <b>honesty_invariants</b> themselves, bound INTO the ' +
+    'signed predicate so the doctrine becomes checkable rather than asserted. It is DSSE-signed ' +
+    'with the estate cosign key and structured for cosign keyless + <b>Rekor</b>. The verdict is ' +
+    'tri-state: <b>PASSED</b>, <b>FAILED</b>, or <b>UNKNOWN</b> when a required transparency-log ' +
+    'inclusion proof cannot be obtained. A tampered Statement is FAILED — <b>FAILED beats ' +
+    'UNKNOWN</b>, so nothing hides behind an offline log. Strictly provenance/observability; adds ' +
+    'nothing to the locked-8. 0 runtime CDN.';
+  host.appendChild(sub);
+
+  const card = document.createElement("div");
+  card.style.cssText = "background:#0a1117;border:1px solid #1d2a36;border-radius:9px;padding:9px 10px;display:flex;flex-direction:column;gap:6px";
+
+  const grid = document.createElement("div");
+  grid.style.cssText = "display:grid;grid-template-columns:1fr;gap:4px";
+  function kpiRow(id, label) {
+    const r = document.createElement("div");
+    r.style.cssText = "display:flex;justify-content:space-between;gap:10px;font-size:11px";
+    const l = document.createElement("span"); l.style.cssText = "color:#9fb1bf"; l.textContent = label;
+    const v = document.createElement("b");
+    v.id = id;
+    v.style.cssText = "font-variant-numeric:tabular-nums;color:#eef3f6;text-align:right;max-width:62%;overflow-wrap:anywhere";
+    v.textContent = "—";
+    _el[id] = v;
+    r.appendChild(l); r.appendChild(v); return r;
+  }
+  grid.appendChild(kpiRow("at-verdict",  "verdict"));
+  grid.appendChild(kpiRow("at-scope",    "verdict covers"));
+  grid.appendChild(kpiRow("at-rules",    "policy rules held"));
+  grid.appendChild(kpiRow("at-failed",   "failed rules"));
+  grid.appendChild(kpiRow("at-predtype", "predicate type"));
+  grid.appendChild(kpiRow("at-doctrine", "doctrine"));
+  grid.appendChild(kpiRow("at-kernel",   "kernel verified @ pin"));
+  grid.appendChild(kpiRow("at-subjects", "subjects bound"));
+  grid.appendChild(kpiRow("at-corpus",   "corpus sha256"));
+  grid.appendChild(kpiRow("at-coverage", "provenance coverage"));
+  grid.appendChild(kpiRow("at-energy",   "energy_measured readings"));
+  grid.appendChild(kpiRow("at-sig",      "DSSE signature"));
+  grid.appendChild(kpiRow("at-rekor",    "Rekor transparency"));
+  grid.appendChild(kpiRow("at-digest",   "statement sha256"));
+  grid.appendChild(kpiRow("at-seal",     "SEAL formula (tier)"));
+  grid.appendChild(kpiRow("at-lambda",   "Λ"));
+  grid.appendChild(kpiRow("at-ceil",     "trust ceiling"));
+  card.appendChild(grid);
+  host.appendChild(card);
+
+  const leg = document.createElement("div");
+  leg.style.cssText = "font-size:9.5px;color:#6b7a86;line-height:1.6";
+  leg.innerHTML =
+    '<span style="color:#3af4c8">■</span> PASSED / rule holds / RECORDED &nbsp; ' +
+    '<span style="color:#5b8dee">■</span> UNKNOWN (log unreachable) &nbsp; ' +
+    '<span style="color:#8a6bff">■</span> FAILED / rule broken &nbsp; ' +
+    '<span style="color:#8494a1">■</span> absent subject / NOT_ATTEMPTED. ' +
+    'MODELED — MEASURED only for a real Rekor inclusion proof returned that request. ' +
+    'Prior art cited, none claimed as SZL\'s: in-toto · SLSA v1.1 (Build L0-L3 + VSA) · ' +
+    'Sigstore/Rekor keyless · DSSE · sigstore/model-transparency · EU CSF SEAL + HHI. ' +
+    'Λ = Conjecture 1, never a theorem.';
+  card.appendChild(leg);
+
+  const pl = document.createElement("button");
+  pl.textContent = "◑ what this means";
+  pl.title = "Toggle plain-language explanation for investors & consumers.";
+  pl.style.cssText = "font:11px ui-monospace,monospace;padding:5px 11px;border-radius:7px;border:1px solid #3af4c8;background:#08140f;color:#3af4c8;cursor:pointer;width:fit-content";
+  pl.addEventListener("click", () => {
+    _plain = !_plain;
+    pl.style.background = _plain ? "#0f2a20" : "#08140f";
+    _applyPlain();
+  });
+  host.appendChild(pl);
+
+  const pd = document.createElement("div");
+  pd.id = "at-plain";
+  pd.style.cssText = "font-size:10.5px;color:#c9d6df;line-height:1.55;border:1px dashed #26333f;border-radius:7px;padding:7px 9px;display:none";
+  _el["plain"] = pd;
+  host.appendChild(pd);
+
+  _paintOverlay();
+}
+
+function _applyPlain() {
+  const pd = _el["plain"];
+  if (!pd) return;
+  pd.style.display = _plain ? "block" : "none";
+  if (!_plain) return;
+  pd.innerHTML =
+    "<b>What this means:</b> think of a property <b>deed</b>. Saying “we own this outright” is a " +
+    "claim; a deed is something a stranger can take to a registry and check. This surface is the " +
+    "deed for the software: a signed document that names exactly <i>what</i> is being claimed " +
+    "(the pinned proof kernel, and the model weights when a real weights file is there to point " +
+    "at), <i>where it came from</i> (which corpus, which training settings, read out of the " +
+    "actual training script rather than typed in by hand), and <i>which honesty rules the estate " +
+    "binds itself to</i> — those rules sit inside the signed document, so breaking one breaks the " +
+    "signature's claim. Then it tries to file that deed in a public append-only log (Rekor), the " +
+    "way you would record a deed at a county office. " +
+    "<b>The important part is what happens when something is missing.</b> No weights file, so no " +
+    "weights line on the deed — you see a hollow grey ring, not a made-up number. No power meter " +
+    "answering, so the energy list reads <b>0 readings</b>, not an estimate dressed up as a " +
+    "measurement. The public log unreachable, so the verdict reads <b>UNKNOWN</b> — not " +
+    "“passed”. And if the document itself has been altered, the verdict is <b>FAILED</b>, which " +
+    "always wins over UNKNOWN, so a tamper can never hide behind an offline log. " +
+    "Right now it reads: <b>" + (S.verdict || "—") + "</b> — " + (S.scope || "no live snapshot") +
+    ". Λ stays <b>Conjecture 1</b> — a conjecture, never a theorem; confidence never reaches 100%.";
+}
+
+function _tok(s) {
+  if (s === "live") return null;
+  if (s === "missing") return "NO-LIVE-DATA";
+  if (s === "degraded") return "DEGRADED";
+  if (s === "error") return "OFFLINE";
+  return "…";
+}
+function _set(id, v) { if (_el[id]) _el[id].textContent = v; }
+function _short(h, n) {
+  if (!h) return "—";
+  const s = String(h);
+  return s.length > n ? s.slice(0, n) + "…" : s;
+}
+
+function _paintOverlay() {
+  const t = _tok(S.state);
+  if (_show) {
+    _show.setChip("lbl", S.label || "MODELED", { text: "chain of title" });
+    _show.setChip("vrd", t || (S.verdict || "—"), { text: "verdict" });
+  }
+  const keys = RULES.map((r) => r[0]);
+  const held = keys.filter((k) => S.checks[k] === true).length;
+  const evaluated = keys.filter((k) => k in S.checks).length;
+
+  _set("at-verdict",  t || (S.verdict || "—"));
+  _set("at-scope",    t || (S.scope || "—"));
+  _set("at-rules",    t || (evaluated ? held + " / " + evaluated : "—"));
+  _set("at-failed",   t || (S.failed && S.failed.length ? S.failed.join(", ") : "none"));
+  _set("at-predtype", t || (S.predType || "—"));
+  _set("at-doctrine", t || (S.doctrine || "—"));
+  _set("at-kernel",   t || (S.kernelOk === null ? "—"
+    : (S.kernelOk ? "verified" : "NOT VERIFIED") + " @ " + (S.kernelPin || "—")));
+  _set("at-subjects", t || (S.subjects.length
+    ? S.subjects.map((s) => s.name + (s.bound ? " ✓" : " (absent)")).join(", ")
+    : "—"));
+  // An absent corpus digest reads ABSENT, never a placeholder hash.
+  _set("at-corpus",   t || (S.corpusSha ? _short(S.corpusSha, 18) : "ABSENT (honest null)"));
+  _set("at-coverage", t || (S.coverage === null ? "—" : String(S.coverage)));
+  _set("at-energy",   t || (S.energyCount === null ? "—"
+    : S.energyCount + (S.energyCount === 0 ? " (no meter answered)" : " MEASURED")));
+  _set("at-sig",      t || (S.sigStatus || (S.signed === false ? "UNSIGNED-NO-KEY" : "—")));
+  _set("at-rekor",    t || (S.rekorStatus
+    ? S.rekorStatus + (S.rekorIndex !== null ? " · index " + S.rekorIndex : "")
+    : "—"));
+  _set("at-digest",   t || _short(S.stmtDigest, 18));
+  _set("at-seal",     t || (S.sealFormula
+    ? S.sealFormula + " (" + (S.sealTier || "PROPOSED") + ")" : "—"));
+  _set("at-lambda",   t || (S.lambdaStat
+    ? S.lambdaStat + (S.lambdaThm === false ? " (not a theorem)" : "") : "—"));
+  _set("at-ceil",     t || (S.trustCeil === null ? "—" : String(S.trustCeil)));
+  if (_plain) _applyPlain();
+}
+
+// =============================================================================
+export function unmount() {
+  _polls.forEach((p) => { try { p.stop(); } catch (_) {} }); _polls = [];
+  try { if (_show) _show.destroy(); } catch (_) {}
+  try {
+    _disposePillars();
+    _disposeAnchors();
+    _rm(_beam); _beam = null;
+    if (_group && _stage) {
+      _group.traverse((o) => {
+        if (o.geometry && o.geometry.dispose) o.geometry.dispose();
+        if (o.material) {
+          const ms = Array.isArray(o.material) ? o.material : [o.material];
+          ms.forEach((mm) => { if (mm.dispose) mm.dispose(); });
+        }
+      });
+      _stage.scene.remove(_group);
+    }
+  } catch (_) {}
+  _group = _show = null;
+  _core = null; _pillars = []; _anchors = []; _beam = null;
+  _el = {}; _badge = null; _plain = false; _frameReg = false; _spin = 0;
+  _stage = _THREE = _ctx = null;
+  S.label = S.verdict = S.scope = S.stmtDigest = null;
+  S.predType = S.doctrine = S.corpusSha = S.kernelPin = null;
+  S.kernelOk = S.coverage = S.invariants = S.energyCount = null;
+  S.sealFormula = S.sealTier = S.lambdaStat = S.lambdaThm = S.trustCeil = null;
+  S.signed = S.sigStatus = null;
+  S.subjects = [];
+  S.rekorStatus = S.rekorIndex = S.rekorLabel = S.rekorNote = null;
+  S.checks = {}; S.failed = []; S.state = "init";
+}
+
+export default { id: ID, title: TITLE, endpoints: [EP], mount, unmount };

szl3d_holographic.py

@@ -166,6 +166,7 @@ SURFACES: List[Dict[str, str]] = [
     {"id": "open", "cat": "more", "flag": True, "title": "Open Frontier · Live Hugging Face · MEASURED live Hugging Face Hub trending stream — one pillar per org/author (height = summed likes, bead = download reach); most-liked open models orbit as satellites coloured by task; log-scaling is display-only, no invented benchmark, score, or ranking beyond the Hub’s own", "owner": "Forge"},
     {"id": "brainagent", "cat": "brain", "title": "Brain Agent · honesty-gated agentic graph reasoner · treats the brain graph as a state space and walks it one node at a time for a query, choosing EXPAND/FOLLOW/BACKTRACK/STOP by pure graph heuristics (no model call, fully deterministic); every candidate hop passes an honesty gate built from the sibling surfaces (grounding, provenance, contradiction, uncertainty) — an ungrounded/untraceable/contradicted/uncertain hop is refused with a recorded reason, an absent guard is UNAVAILABLE never a fabricated pass; within an explicit step/node budget it returns ANSWER-GROUNDED/PARTIAL or abstains ABSTAINED-BUDGET/ABSTAINED-INSUFFICIENT rather than answer under-grounded, emits an ordered trace + unsigned SHA-256 receipt-on-write, makes no sentience claim (MODELED)", "owner": "WaveT-Dev1"},
     {"id": "estateconstitution", "cat": "governance", "title": "Estate Constitution · the WHOLE ESTATE's honesty posture graded continuously against explicit estate-level ARTICLES (the per-query brain-constitution pattern lifted to the estate) · Art 1 the honesty wall holds (0 REACHABLE invariant violations), Art 2 no surface declares a fabricated MEASURED label (every declared label in the honest vocabulary, read VERBATIM), Art 3 manifest coverage DISCLOSED honestly (NATIVE-OK vs NO-MANIFEST counted out loud — a DISCLOSURE Article: admitting the gap is compliance, papering it over is the violation, full coverage never claimed while any surface is unverifiable), Art 4 doctrine invariants (Λ = Conjecture 1 never a theorem, locked-8 never inflated, trust ceiling 0.97 never 100%, no consciousness claim) · each graded COMPLIANT/VIOLATED/UNAVAILABLE over the szl_honestywall aggregate read in-process through a GUARDED import (an unreadable aggregate is UNAVAILABLE, never a fabricated pass) → CONSTITUTIONAL/IN-VIOLATION/INSUFFICIENT-SIGNAL, never CONSTITUTIONAL while any evaluable Article is VIOLATED, unsigned SHA-256 receipt-on-write (MODELED)", "owner": "WaveS-Dev6"},
+    {"id": "attest", "cat": "governance", "title": "Chain of Title · L6 attestation · the allodial claim made third-party verifiable · an in-toto v1 Statement whose SUBJECT binds the locked-8 kernel gitCommit c7c0ba17 (plus a sovereign-weights sha256 ONLY when a real weights artifact is readable this request — honest null otherwise, never an invented digest), predicateType https://szl.dev/chain-of-title/v1, predicate = doctrine v11 + provenance (corpus_sha, training config read VERBATIM from the committed trainer, kernel_verified RE-CHECKED this request against the digest-verified formula registry, kernel_pin) + energy_measured[] (HONESTLY EMPTY with no live joule meter — no joule fabricated) + honesty_invariants {no_fabricated_measured, lambda_is_conjecture_not_theorem, locked8_immutable, provenance_coverage 1.0} bound INTO the signed predicate so the doctrine itself becomes third-party checkable + the tier-PROPOSED SEAL formula (EU CSF SEAL + HHI prior art, no score asserted) · DSSE-signed through the estate cosign key (explicitly UNSIGNED-NO-KEY when no runtime secret is present, never a fabricated signature) and structured for cosign keyless + Rekor: a real inclusion proof reads RECORDED/MEASURED, an unreachable log reads UNREACHABLE and the verdict is UNKNOWN — never a fabricated Rekor entry or PASSED · the verdict is tri-state and FAILED beats UNKNOWN so a tampered Statement cannot hide behind an offline log; policy authoritative in ops/szl_chain_of_title.rego, mirrored in-process rule for rule (MODELED)", "owner": "Wave32-DevE"},
 ]
 
 # Content-type by extension (the only extensions we serve from the 3d tree).

szl_attest.py

@@ -0,0 +1,1242 @@
+# SPDX-License-Identifier: Apache-2.0
+# © 2026 Lutar, Stephen P. — SZL Holdings · ORCID 0009-0001-0110-4173 · Doctrine v11
+"""szl_attest — L6 CHAIN-OF-TITLE ATTESTATION ORGAN.
+
+WHAT THIS IS
+------------
+The allodial claim ("the operator holds real title to this substrate, not a
+rented tenancy") is only worth what a THIRD PARTY can check. This organ emits
+that claim as a machine-checkable **in-toto v1 Statement**, DSSE-signs it with
+the estate's existing cosign keypair (``szl_dsse``), structures it for
+**Sigstore/Rekor** transparency-log inclusion, and evaluates it against an
+explicit policy (mirrored in ``ops/szl_chain_of_title.rego``) that returns
+PASSED / FAILED / UNKNOWN — never a fabricated pass.
+
+    subject        = locked-8 kernel gitCommit  (+ sovereign weights sha256 IF
+                     a real weights artifact is readable this request; honest
+                     null otherwise — a subject is never invented)
+    predicateType  = "https://szl.dev/chain-of-title/v1"
+    predicate      = doctrine v11 · provenance · energy_measured[] ·
+                     honesty_invariants · seal
+
+LEADERS FUSED (cited prior art; SZL claims none of them as its own)
+------------------------------------------------------------------
+  * in-toto Attestation Framework — Statement/v1 envelope + subject/predicate
+    split. https://github.com/in-toto/attestation/blob/main/spec/v1/statement.md
+  * SLSA v1.1 (Apr 2025) — Build L0-L3 track + Verification Summary Attestation
+    (a verifier saying "this passed policy P"). https://slsa.dev/spec/v1.1/
+    and https://slsa.dev/spec/v1.1/verification_summary
+  * Sigstore / cosign keyless + Rekor transparency log — inclusion proof as the
+    third-party-checkable anchor. https://docs.sigstore.dev/logging/overview/
+  * DSSE (secure-systems-lab/dsse) — PAE signing envelope, via ``szl_dsse``.
+    https://github.com/secure-systems-lab/dsse
+  * sigstore/model-transparency — signing ML model weights as the subject.
+    https://github.com/sigstore/model-transparency
+
+WHAT MAKES IT SZL'S OWN (not a re-skin of the above)
+----------------------------------------------------
+  1. ``honesty_invariants`` are IN the signed predicate, so the doctrine itself
+     becomes a cryptographically bound, third-party-checkable claim:
+     no_fabricated_measured · lambda_is_conjecture_not_theorem ·
+     locked8_immutable · provenance_coverage 1.0.
+  2. The subject binds the **locked-8 kernel pin** (c7c0ba17) — the immutable
+     8-formula proof kernel — not just a container digest.
+  3. The verdict is TRI-STATE by construction. A missing transparency log is
+     UNKNOWN, never PASSED. A tampered statement is FAILED, never UNKNOWN.
+  4. Optional szl-lake receipt-on-write, so the attestation act itself lands in
+     the estate ledger.
+
+HONESTY (Doctrine v11 — binding)
+--------------------------------
+  * ``energy_measured`` is EMPTY unless a joule meter answered THIS request.
+    No joule is ever invented.
+  * ``rekor.status`` is RECORDED only with a real inclusion proof returned by a
+    reachable log; UNREACHABLE / NOT_ATTEMPTED otherwise. No Rekor entry, log
+    index, or inclusion proof is ever fabricated.
+  * No signature is fabricated: with no ``SZL_COSIGN_PRIVATE_PEM`` runtime
+    secret, ``szl_dsse`` emits an explicitly UNSIGNED envelope and this organ
+    reports ``signature.status = "UNSIGNED-NO-KEY"``.
+  * Λ = **Conjecture 1** — advisory, never a theorem, never green.
+  * locked-8 {F1,F4,F7,F11,F12,F18,F19,F22} @ c7c0ba17 — this organ adds
+    NOTHING to it and proves nothing new about it; it only ATTESTS the pin.
+  * Surface label: MODELED. It would be MEASURED only for the transparency
+    strand, and only when a real Rekor inclusion proof came back this request.
+  * The seal formula is tier PROPOSED (EU CSF SEAL + HHI prior art), never
+    presented as a validated metric.
+
+Pure stdlib. No new dependency. Never raises into a request path.
+
+Routes (registered additively, BEFORE the SPA catch-all):
+    GET  /api/<ns>/v1/attest/manifest        — statement + envelope + policy verdict
+    GET  /api/<ns>/v1/attest/verify          — verify the freshly built statement
+    POST /api/<ns>/v1/attest/verify          — verify a caller-supplied envelope/statement
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+# --------------------------------------------------------------------------- #
+# Constants — the frozen vocabulary of this organ.
+# --------------------------------------------------------------------------- #
+SCHEMA = "szl.attest.chain-of-title/v1"
+STATEMENT_TYPE = "https://in-toto.io/Statement/v1"
+PREDICATE_TYPE = "https://szl.dev/chain-of-title/v1"
+PAYLOAD_TYPE = "application/vnd.in-toto+json"
+
+DOCTRINE_VERSION = "v11"
+KERNEL_PIN = "c7c0ba17"
+LOCKED_8 = ("F1", "F4", "F7", "F11", "F12", "F18", "F19", "F22")
+TRUST_CEILING = 0.97
+
+SUBJECT_KERNEL_NAME = "locked8_kernel"
+SUBJECT_WEIGHTS_NAME = "sovereign_weights"
+
+LABEL_MODELED = "MODELED"
+LABEL_MEASURED = "MEASURED"
+
+VERDICT_PASSED = "PASSED"
+VERDICT_FAILED = "FAILED"
+VERDICT_UNKNOWN = "UNKNOWN"
+
+REKOR_RECORDED = "RECORDED"
+REKOR_UNREACHABLE = "UNREACHABLE"
+REKOR_NOT_ATTEMPTED = "NOT_ATTEMPTED"
+
+# Public Rekor instance. Only contacted when SZL_REKOR_ENABLE is truthy — the
+# estate never reaches out on a plain read by default.
+DEFAULT_REKOR_URL = "https://rekor.sigstore.dev"
+REKOR_URL_ENV = "SZL_REKOR_URL"
+REKOR_ENABLE_ENV = "SZL_REKOR_ENABLE"
+REKOR_TIMEOUT_ENV = "SZL_REKOR_TIMEOUT_S"
+REQUIRE_TRANSPARENCY_ENV = "SZL_ATTEST_REQUIRE_REKOR"
+WEIGHTS_PATH_ENV = "SZL_SOVEREIGN_WEIGHTS_PATH"
+CORPUS_PATH_ENV = "SZL_SOVEREIGN_CORPUS_PATH"
+JOULE_METER_ENV = "A11OY_JOULE_METER_URLS"
+LAKE_DIR_ENV = "SZL_LAKE_DIR"
+
+ROOT = Path(__file__).resolve().parent
+
+# Candidate sovereign-weights artifacts, in resolution order. Absent = honest
+# null; a weights subject is NEVER invented.
+_WEIGHTS_CANDIDATES = (
+    "sovereign-weights/out-lora-szl/adapter_model.safetensors",
+    "sovereign-weights/out-lora-szl/adapter_model.bin",
+    "sovereign-weights/adapter_model.safetensors",
+)
+_CORPUS_CANDIDATES = (
+    ("sovereign-weights/corpus.jsonl", "corpus"),
+    ("corpus.jsonl", "corpus"),
+    ("sovereign-weights/corpus_template.jsonl", "corpus_template"),
+)
+
+CITES = [
+    "in-toto Attestation Framework — Statement v1 — "
+    "https://github.com/in-toto/attestation/blob/main/spec/v1/statement.md",
+    "SLSA v1.1 (Apr 2025) Build track L0-L3 — https://slsa.dev/spec/v1.1/levels",
+    "SLSA v1.1 Verification Summary Attestation — "
+    "https://slsa.dev/spec/v1.1/verification_summary",
+    "Sigstore/Rekor transparency log — https://docs.sigstore.dev/logging/overview/",
+    "DSSE (secure-systems-lab/dsse) — https://github.com/secure-systems-lab/dsse",
+    "sigstore/model-transparency — https://github.com/sigstore/model-transparency",
+]
+SEAL_CITES = [
+    "EU Cloud Sovereignty Framework 2025 (SEAL / SovScore assurance levels 0-4)",
+    "Herfindahl-Hirschman Index (HHI) — dependency-concentration measure (DCI)",
+]
+SEAL_FORMULA = "A=[Σ wₖ·SEALₖ/4]×(1−DCI)×100"
+
+
+# --------------------------------------------------------------------------- #
+# Small deterministic helpers.
+# --------------------------------------------------------------------------- #
+def _now_iso() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def canonical_json(obj: Any) -> bytes:
+    """Deterministic canonical JSON (sorted keys, tight separators, UTF-8)."""
+    return json.dumps(obj, sort_keys=True, separators=(",", ":"),
+                      ensure_ascii=False).encode("utf-8")
+
+
+def digest_hex(obj: Any) -> str:
+    return hashlib.sha256(canonical_json(obj)).hexdigest()
+
+
+def _sha256_file(path: Path, *, chunk: int = 1 << 20) -> str | None:
+    try:
+        h = hashlib.sha256()
+        with path.open("rb") as fh:
+            while True:
+                block = fh.read(chunk)
+                if not block:
+                    break
+                h.update(block)
+        return h.hexdigest()
+    except Exception:
+        return None
+
+
+def _safe_under_root(raw: str) -> Path | None:
+    """Resolve a caller/env supplied path and refuse anything outside ROOT."""
+    try:
+        p = Path(raw)
+        p = p if p.is_absolute() else (ROOT / p)
+        p = p.resolve()
+        p.relative_to(ROOT)
+        return p
+    except Exception:
+        return None
+
+
+# --------------------------------------------------------------------------- #
+# Subject strand 1 — sovereign weights (honest null when absent).
+# --------------------------------------------------------------------------- #
+def sovereign_weights_digest() -> dict[str, Any]:
+    """sha256 of the sovereign weights artifact, or an HONEST null.
+
+    A trained-weights blob is not committed to this repo (it is an operator
+    artifact). When none is readable this returns ``sha256: None`` with the
+    reason spelled out — the attestation says "no weights subject THIS
+    request", it does not invent one.
+    """
+    override = (os.environ.get(WEIGHTS_PATH_ENV) or "").strip()
+    candidates: list[Path] = []
+    if override:
+        p = _safe_under_root(override)
+        if p is not None:
+            candidates.append(p)
+    candidates.extend(ROOT / rel for rel in _WEIGHTS_CANDIDATES)
+
+    for path in candidates:
+        try:
+            if not path.is_file():
+                continue
+        except Exception:
+            continue
+        sha = _sha256_file(path)
+        if sha:
+            try:
+                rel = str(path.relative_to(ROOT))
+            except Exception:
+                rel = path.name
+            return {
+                "sha256": sha,
+                "path": rel,
+                "bytes": path.stat().st_size,
+                "present": True,
+                "note": "sha256 computed over the readable weights artifact this request",
+            }
+    return {
+        "sha256": None,
+        "path": None,
+        "bytes": None,
+        "present": False,
+        "note": ("no sovereign-weights artifact readable this request (operator "
+                 f"artifact, not committed; set {WEIGHTS_PATH_ENV} to bind one) — "
+                 "honest null, no weights digest fabricated"),
+    }
+
+
+# --------------------------------------------------------------------------- #
+# Subject strand 2 — the locked-8 kernel commit.
+# --------------------------------------------------------------------------- #
+def locked8_kernel_commit() -> dict[str, Any]:
+    """The gitCommit the locked-8 proof kernel is pinned at.
+
+    Doctrine v11 pins the locked-8 {F1,F4,F7,F11,F12,F18,F19,F22} at commit
+    prefix ``c7c0ba17``. That pin — not the rolling build commit — is what the
+    chain-of-title subject binds, because the pin is the immutable thing. The
+    build commit is recorded separately in the provenance strand.
+    """
+    return {
+        "gitCommit": KERNEL_PIN,
+        "locked_proven": list(LOCKED_8),
+        "locked_proven_count": len(LOCKED_8),
+        "source": "doctrine-v11 locked-kernel pin (immutable)",
+    }
+
+
+def build_commit() -> dict[str, Any]:
+    """Best-effort build commit, read from .git without shelling out.
+
+    Reported honestly as ``null`` when the checkout metadata is unreadable (an
+    image build strips .git). Never confused with the locked-8 kernel pin.
+    """
+    git = ROOT / ".git"
+    try:
+        head = (git / "HEAD").read_text(encoding="utf-8").strip()
+    except Exception:
+        return {"commit": None, "source": None,
+                "note": "no readable .git/HEAD in this image — honest null"}
+    if head.startswith("ref:"):
+        ref = head.split(":", 1)[1].strip()
+        try:
+            sha = (git / ref).read_text(encoding="utf-8").strip()
+            return {"commit": sha, "source": f".git/{ref}", "note": None}
+        except Exception:
+            pass
+        try:
+            for line in (git / "packed-refs").read_text(encoding="utf-8").splitlines():
+                if line.endswith(" " + ref):
+                    return {"commit": line.split(" ", 1)[0].strip(),
+                            "source": ".git/packed-refs", "note": None}
+        except Exception:
+            pass
+        return {"commit": None, "source": f".git/{ref}",
+                "note": "ref present but unresolvable — honest null"}
+    if re.fullmatch(r"[0-9a-f]{40}", head):
+        return {"commit": head, "source": ".git/HEAD (detached)", "note": None}
+    return {"commit": None, "source": ".git/HEAD",
+            "note": "unrecognised HEAD form — honest null"}
+
+
+# --------------------------------------------------------------------------- #
+# Provenance strand.
+# --------------------------------------------------------------------------- #
+def corpus_sha() -> dict[str, Any]:
+    """sha256 of the declared training corpus, or an honest null.
+
+    ``kind`` distinguishes a real corpus from the committed TEMPLATE, so a
+    template digest can never be read as a trained-corpus digest.
+    """
+    override = (os.environ.get(CORPUS_PATH_ENV) or "").strip()
+    candidates: list[tuple[Path, str]] = []
+    if override:
+        p = _safe_under_root(override)
+        if p is not None:
+            candidates.append((p, "corpus"))
+    candidates.extend((ROOT / rel, kind) for rel, kind in _CORPUS_CANDIDATES)
+
+    for path, kind in candidates:
+        try:
+            if not path.is_file():
+                continue
+        except Exception:
+            continue
+        sha = _sha256_file(path)
+        if sha:
+            try:
+                rel = str(path.relative_to(ROOT))
+            except Exception:
+                rel = path.name
+            return {"sha256": sha, "path": rel, "kind": kind,
+                    "note": ("template corpus digest — NOT a trained-corpus digest"
+                             if kind == "corpus_template" else
+                             "sha256 over the declared training corpus")}
+    return {"sha256": None, "path": None, "kind": None,
+            "note": "no training corpus readable this request — honest null"}
+
+
+_TRAIN_SCRIPT = "sovereign-weights/train_lora.py"
+_TRAIN_KNOBS = (
+    ("base_model", "--base-model", str),
+    ("lora_r", "--lora-r", int),
+    ("lora_alpha", "--lora-alpha", int),
+    ("lora_dropout", "--lora-dropout", float),
+    ("per_device_batch", "--per-device-batch", int),
+    ("grad_accum", "--grad-accum", int),
+    ("max_seq_len", "--max-seq-len", int),
+    ("epochs", "--epochs", float),
+    ("learning_rate", "--learning-rate", float),
+    ("seed", "--seed", int),
+)
+
+
+def training_config() -> dict[str, Any]:
+    """The training configuration, READ from the committed trainer this request.
+
+    Parsed out of ``sovereign-weights/train_lora.py``'s argparse defaults with
+    a regex rather than hard-coded here, so the attestation cannot drift away
+    from the script it claims to describe. Unreadable script → honest nulls.
+    """
+    path = ROOT / _TRAIN_SCRIPT
+    out: dict[str, Any] = {
+        "source": _TRAIN_SCRIPT,
+        "source_sha256": None,
+        "method": "LoRA (parameter-efficient fine-tune)",
+        "config": {},
+        "note": None,
+    }
+    try:
+        text = path.read_text(encoding="utf-8")
+    except Exception:
+        out["note"] = ("committed trainer not readable this request — honest "
+                       "nulls, no training configuration fabricated")
+        out["config"] = {name: None for name, _, _ in _TRAIN_KNOBS}
+        return out
+    out["source_sha256"] = _sha256_file(path)
+    for name, flag, caster in _TRAIN_KNOBS:
+        m = re.search(
+            re.escape(flag) + r"\"[^)]*?default\s*=\s*(\"[^\"]*\"|[0-9eE.+-]+)",
+            text, re.S)
+        value: Any = None
+        if m:
+            raw = m.group(1)
+            try:
+                value = raw.strip('"') if raw.startswith('"') else caster(raw)
+            except Exception:
+                value = None
+        out["config"][name] = value
+    out["note"] = ("argparse defaults read verbatim from the committed trainer; "
+                   "an operator run may override any knob on the command line")
+    return out
+
+
+def kernel_verification() -> dict[str, Any]:
+    """Verify the locked-8 kernel claim against the digest-verified registry.
+
+    Real in-request verification (never a hard-coded True):
+      1. ``szl_formula_registry`` loads with digest verification ON — it
+         recomputes the canonical SHA-256 over the registry payload and
+         re-asserts its structural invariants, raising on any drift.
+      2. Every doctrine locked-8 id is COVERED by that registry.
+      3. The registry's locked_proven set is not inflated beyond the locked-8.
+      4. Λ is still ``CONJECTURE_1_ADVISORY`` — a promoted Λ invalidates the
+         kernel claim outright.
+
+    Any failed check, or an unreadable registry, yields ``verified: False`` with
+    the reason recorded. There is no path to a fabricated True.
+    """
+    out: dict[str, Any] = {
+        "verified": False,
+        "kernel_pin": KERNEL_PIN,
+        "locked_proven": list(LOCKED_8),
+        "checks": {},
+        "registry": None,
+        "reason": None,
+    }
+    try:
+        import szl_formula_registry as _reg
+    except Exception as exc:
+        out["reason"] = f"formula registry unreadable ({type(exc).__name__}) — not verified"
+        return out
+    try:
+        basis = _reg.receipt_basis()
+        covered = tuple(getattr(_reg, "EXPECTED_COVERED_IDS", ()))
+        locked_ids = tuple(basis.get("locked_proven_ids") or ())
+        checks = {
+            "registry_digest_verified": bool(basis.get("formula_registry_digest")),
+            "locked8_covered": all(fid in covered for fid in LOCKED_8),
+            "locked_set_not_inflated": set(locked_ids).issubset(set(LOCKED_8)),
+            "lambda_is_conjecture": str(basis.get("lambda_status", "")).startswith(
+                "CONJECTURE_1"),
+        }
+        out["checks"] = checks
+        out["registry"] = {
+            "schema_version": basis.get("schema_version"),
+            "registry_version": basis.get("registry_version"),
+            "formula_registry_digest": basis.get("formula_registry_digest"),
+            "digest_algorithm": basis.get("digest_algorithm"),
+            "signature_status": basis.get("signature_status"),
+            "registry_locked_proven_ids": list(locked_ids),
+            "lambda_status": basis.get("lambda_status"),
+        }
+        out["verified"] = all(checks.values())
+        if not out["verified"]:
+            failed = sorted(k for k, v in checks.items() if not v)
+            out["reason"] = "failed kernel checks: " + ", ".join(failed)
+        return out
+    except Exception as exc:
+        out["reason"] = (f"kernel verification raised {type(exc).__name__} — "
+                         "not verified (no fabricated pass)")
+        return out
+
+
+# --------------------------------------------------------------------------- #
+# Energy strand — empty unless a meter answered THIS request.
+# --------------------------------------------------------------------------- #
+def energy_measured(*, opener: Any = None) -> tuple[list[dict[str, Any]], dict[str, Any]]:
+    """Return (readings, disclosure). Readings are [] with no live meter.
+
+    A joule is only ever recorded when a configured meter answered in this
+    request. No meter configured, or an unreachable one, yields an EMPTY list —
+    never a modelled or remembered joule dressed as MEASURED.
+    """
+    raw = (os.environ.get(JOULE_METER_ENV) or "").strip()
+    urls = [u.strip() for u in raw.split(",") if u.strip()]
+    disclosure: dict[str, Any] = {
+        "meters_configured": len(urls),
+        "meter_env": JOULE_METER_ENV,
+        "label": "STRUCTURAL-ONLY",
+        "note": (f"no joule meter configured ({JOULE_METER_ENV} unset) — "
+                 "energy_measured is honestly EMPTY; no joule fabricated"),
+    }
+    if not urls:
+        return [], disclosure
+
+    readings: list[dict[str, Any]] = []
+    errors: list[str] = []
+    timeout = 1.5
+    for url in urls[:8]:
+        try:
+            if opener is not None:
+                payload = opener(url, timeout)
+            else:
+                import urllib.request
+
+                with urllib.request.urlopen(url, timeout=timeout) as resp:  # noqa: S310
+                    payload = json.loads(resp.read().decode("utf-8", "replace"))
+            joules = payload.get("joules") if isinstance(payload, dict) else None
+            if isinstance(joules, (int, float)):
+                readings.append({
+                    "meter": url,
+                    "joules": float(joules),
+                    "label": LABEL_MEASURED,
+                    "read_at": _now_iso(),
+                })
+            else:
+                errors.append(f"{url}: no numeric joules field")
+        except Exception as exc:
+            errors.append(f"{url}: {type(exc).__name__}")
+    disclosure["errors"] = errors
+    if readings:
+        disclosure["label"] = LABEL_MEASURED
+        disclosure["note"] = (f"{len(readings)} live joule reading(s) taken this "
+                              "request from the configured meter(s)")
+    else:
+        disclosure["label"] = "STRUCTURAL-ONLY"
+        disclosure["note"] = ("meter(s) configured but none answered with a joule "
+                              "reading this request — energy_measured stays EMPTY, "
+                              "no joule fabricated")
+    return readings, disclosure
+
+
+# --------------------------------------------------------------------------- #
+# The in-toto v1 Statement.
+# --------------------------------------------------------------------------- #
+def build_statement(*, ns: str = "a11oy", opener: Any = None) -> dict[str, Any]:
+    """Assemble the in-toto v1 Statement for the L6 chain-of-title claim."""
+    weights = sovereign_weights_digest()
+    kernel = locked8_kernel_commit()
+    kern_v = kernel_verification()
+    corpus = corpus_sha()
+    training = training_config()
+    build = build_commit()
+    readings, energy_disclosure = energy_measured(opener=opener)
+
+    # in-toto requires each subject to carry at least one digest. The kernel
+    # subject always does (gitCommit). The weights subject is appended ONLY
+    # when a real sha256 exists — an empty digest set is never emitted.
+    subject: list[dict[str, Any]] = [{
+        "name": SUBJECT_KERNEL_NAME,
+        "digest": {"gitCommit": kernel["gitCommit"]},
+        "annotations": {
+            "locked_proven": kernel["locked_proven"],
+            "pin_source": kernel["source"],
+        },
+    }]
+    if weights["sha256"]:
+        subject.append({
+            "name": SUBJECT_WEIGHTS_NAME,
+            "digest": {"sha256": weights["sha256"]},
+            "annotations": {"path": weights["path"], "bytes": weights["bytes"]},
+        })
+
+    provenance_coverage = 1.0  # every field below is either a real read or an honest null
+
+    predicate: dict[str, Any] = {
+        "doctrine": DOCTRINE_VERSION,
+        "provenance": {
+            "corpus_sha": corpus["sha256"],
+            "corpus_source": {"path": corpus["path"], "kind": corpus["kind"],
+                              "note": corpus["note"]},
+            "training": training,
+            "kernel_verified": bool(kern_v["verified"]),
+            "kernel_pin": KERNEL_PIN,
+            "kernel_verification": kern_v,
+            "build_commit": build,
+            "sovereign_weights": weights,
+            "provenance_coverage": provenance_coverage,
+            "coverage_rule": ("every provenance field is either a real read this "
+                             "request or an explicit null with its reason — coverage "
+                             "1.0 means fully DISCLOSED, not fully populated"),
+        },
+        # HONEST EMPTY when no meter answered this request. Never a fabricated joule.
+        "energy_measured": readings,
+        "energy_disclosure": energy_disclosure,
+        "honesty_invariants": {
+            "no_fabricated_measured": True,
+            "lambda_is_conjecture_not_theorem": True,
+            "locked8_immutable": True,
+            "provenance_coverage": provenance_coverage,
+        },
+        "honesty_invariants_meaning": {
+            "no_fabricated_measured": ("a MEASURED label is emitted only from a live "
+                                       "reading in the same request; energy_measured "
+                                       "is empty rather than invented"),
+            "lambda_is_conjecture_not_theorem": ("Λ is Conjecture 1 — advisory, never "
+                                                 "a theorem, never green"),
+            "locked8_immutable": ("locked-8 {F1,F4,F7,F11,F12,F18,F19,F22} @ "
+                                  f"{KERNEL_PIN}; this organ adds nothing to it"),
+            "provenance_coverage": ("1.0 — every provenance field disclosed, nulls "
+                                    "included, none omitted"),
+        },
+        "seal": {
+            "formula": SEAL_FORMULA,
+            "tier": "PROPOSED",
+            "cites": list(SEAL_CITES),
+            "note": ("weights need calibration; the score is an engineering "
+                     "composition of cited prior art, not a validated metric, and "
+                     "no score is asserted here"),
+        },
+        "lambda": {
+            "status": "Conjecture 1",
+            "is_theorem": False,
+            "trust_ceiling": TRUST_CEILING,
+        },
+        "attestation": {
+            "schema": SCHEMA,
+            "namespace": ns,
+            "label": LABEL_MODELED,
+            "built_at": _now_iso(),
+            "cites": list(CITES),
+            "slsa": {
+                "build_track": "L0-L3 referenced as the cited direction; no SLSA "
+                               "level is CLAIMED for this image",
+                "vsa": "this Statement is the SZL analogue of a SLSA v1.1 "
+                       "Verification Summary Attestation over the policy in "
+                       "ops/szl_chain_of_title.rego",
+            },
+        },
+    }
+
+    return {
+        "_type": STATEMENT_TYPE,
+        "subject": subject,
+        "predicateType": PREDICATE_TYPE,
+        "predicate": predicate,
+    }
+
+
+# --------------------------------------------------------------------------- #
+# DSSE signing (reuses szl_dsse — the estate is DSSE-LIVE).
+# --------------------------------------------------------------------------- #
+def sign_statement(statement: dict[str, Any]) -> dict[str, Any]:
+    """DSSE-sign the Statement with the estate cosign key via ``szl_dsse``.
+
+    payloadType is the in-toto media type, so the envelope is byte-compatible
+    with ``cosign verify-blob`` / ``cosign verify-attestation``. With no runtime
+    private key the envelope is explicitly UNSIGNED — never a fake signature.
+    """
+    try:
+        import szl_dsse
+    except Exception as exc:  # pragma: no cover — dsse is in-image
+        return {
+            "payloadType": PAYLOAD_TYPE,
+            "payload": None,
+            "signatures": [],
+            "signed": False,
+            "honesty": f"szl_dsse unavailable ({type(exc).__name__}) — no envelope, "
+                       "no fabricated signature",
+        }
+    env = szl_dsse.sign_payload(statement, PAYLOAD_TYPE)
+    env["_statement_digest_sha256"] = digest_hex(statement)
+    return env
+
+
+def signature_status(envelope: dict[str, Any]) -> dict[str, Any]:
+    """Honest signature verdict for an envelope. Never raises."""
+    out: dict[str, Any] = {
+        "signed": bool(envelope.get("signed")),
+        "verified": None,
+        "status": "UNSIGNED-NO-KEY",
+        "keyless_ready": True,
+        "note": None,
+    }
+    if not envelope.get("signatures"):
+        out["note"] = (envelope.get("honesty")
+                       or "no signature present; no signature fabricated")
+        return out
+    try:
+        import szl_dsse
+
+        verdict = szl_dsse.verify_envelope(envelope)
+        out["verified"] = bool(verdict.get("verified"))
+        out["status"] = "VERIFIED" if out["verified"] else "SIGNATURE-INVALID"
+        out["keyid_expected"] = verdict.get("keyid_expected")
+        out["pub_fingerprint_sha256"] = verdict.get("pub_fingerprint_sha256")
+        out["note"] = ("ECDSA-P256-SHA256 over the DSSE PAE; also checkable by "
+                       "`cosign verify-blob --key cosign.pub`")
+    except Exception as exc:
+        out["verified"] = None
+        out["status"] = "UNKNOWN-VERIFIER-ERROR"
+        out["note"] = f"verifier raised {type(exc).__name__} — UNKNOWN, not a pass"
+    return out
+
+
+# --------------------------------------------------------------------------- #
+# Rekor transparency log — HONEST GUARDED CALL.
+# --------------------------------------------------------------------------- #
+def _rekor_configured() -> tuple[bool, str]:
+    url = (os.environ.get(REKOR_URL_ENV) or DEFAULT_REKOR_URL).rstrip("/")
+    enabled = str(os.environ.get(REKOR_ENABLE_ENV, "")).strip().lower() in (
+        "1", "true", "yes", "on")
+    return enabled, url
+
+
+def rekor_submit(envelope: dict[str, Any], *, submitter: Any = None) -> dict[str, Any]:
+    """Structure the envelope for Rekor and submit it IF submission is enabled.
+
+    Tri-state, by construction:
+      * RECORDED       — the log answered with a real entry carrying an
+                         inclusion proof / log index. Only then is anything
+                         recorded, and it is recorded VERBATIM.
+      * UNREACHABLE    — submission was attempted and failed (offline sandbox,
+                         DNS, timeout, non-2xx, unparseable body).
+      * NOT_ATTEMPTED  — submission is not enabled in this runtime.
+
+    There is NO branch that writes a log index, UUID, or inclusion proof that
+    the log did not return. ``submitter`` is an injection seam for tests; the
+    default path uses urllib.
+    """
+    enabled, url = _rekor_configured()
+    proposed = {
+        "kind": "intoto",
+        "apiVersion": "0.0.2",
+        "spec": {
+            "content": {
+                "envelope": {
+                    "payloadType": envelope.get("payloadType"),
+                    "payloadSha256": envelope.get("_statement_digest_sha256"),
+                    "signatures": len(envelope.get("signatures") or []),
+                },
+                "hash": {"algorithm": "sha256",
+                         "value": envelope.get("_statement_digest_sha256")},
+            },
+        },
+    }
+    out: dict[str, Any] = {
+        "status": REKOR_NOT_ATTEMPTED,
+        "log_url": url,
+        "attempted": False,
+        "reachable": None,
+        "log_index": None,
+        "entry_uuid": None,
+        "inclusion_proof": None,
+        "integrated_time": None,
+        "proposed_entry": proposed,
+        "label": "STRUCTURAL-ONLY",
+        "cite": "Sigstore Rekor — https://docs.sigstore.dev/logging/overview/",
+        "note": None,
+    }
+    if not envelope.get("signatures"):
+        out["note"] = ("envelope is UNSIGNED (no runtime cosign secret) — nothing "
+                       "submitted; a transparency-log entry is never fabricated. "
+                       "Structured for cosign keyless + Rekor upload once a key or "
+                       "an OIDC identity is present.")
+        return out
+    if not enabled:
+        out["note"] = (f"Rekor submission not enabled in this runtime "
+                       f"({REKOR_ENABLE_ENV} unset) — NOT_ATTEMPTED, never a "
+                       "fabricated inclusion proof")
+        return out
+
+    out["attempted"] = True
+    try:
+        timeout = float(os.environ.get(REKOR_TIMEOUT_ENV, "3") or 3)
+    except Exception:
+        timeout = 3.0
+    body = canonical_json({"apiVersion": proposed["apiVersion"],
+                           "kind": proposed["kind"],
+                           "spec": proposed["spec"]})
+    try:
+        if submitter is not None:
+            payload = submitter(url, body, timeout)
+        else:
+            import urllib.request
+
+            req = urllib.request.Request(  # noqa: S310
+                url + "/api/v1/log/entries", data=body,
+                headers={"Content-Type": "application/json",
+                         "Accept": "application/json"},
+                method="POST")
+            with urllib.request.urlopen(req, timeout=timeout) as resp:  # noqa: S310
+                payload = json.loads(resp.read().decode("utf-8", "replace"))
+    except Exception as exc:
+        out["status"] = REKOR_UNREACHABLE
+        out["reachable"] = False
+        out["note"] = (f"Rekor unreachable ({type(exc).__name__}) — transparency "
+                       "strand is UNKNOWN; no entry, log index, or inclusion proof "
+                       "fabricated")
+        return out
+
+    entry = _first_rekor_entry(payload)
+    proof = (entry or {}).get("verification", {}).get("inclusionProof")
+    log_index = (entry or {}).get("logIndex")
+    if not entry or proof is None or log_index is None:
+        out["status"] = REKOR_UNREACHABLE
+        out["reachable"] = True
+        out["note"] = ("log answered but returned no inclusion proof / log index — "
+                       "transparency strand stays UNKNOWN rather than claim inclusion")
+        return out
+
+    out["status"] = REKOR_RECORDED
+    out["reachable"] = True
+    out["label"] = LABEL_MEASURED
+    out["log_index"] = log_index
+    out["entry_uuid"] = entry.get("_uuid")
+    out["integrated_time"] = entry.get("integratedTime")
+    out["inclusion_proof"] = proof
+    out["note"] = ("real inclusion proof returned by the transparency log this "
+                   "request, recorded verbatim")
+    return out
+
+
+def _first_rekor_entry(payload: Any) -> dict[str, Any] | None:
+    """Rekor returns {uuid: entry}. Pull the first entry, tagging its uuid."""
+    if isinstance(payload, dict):
+        for uuid, entry in payload.items():
+            if isinstance(entry, dict):
+                out = dict(entry)
+                out["_uuid"] = entry.get("uuid") or uuid
+                return out
+    if isinstance(payload, list) and payload and isinstance(payload[0], dict):
+        return dict(payload[0])
+    return None
+
+
+# --------------------------------------------------------------------------- #
+# Policy evaluation — the Python twin of ops/szl_chain_of_title.rego.
+# --------------------------------------------------------------------------- #
+POLICY_RULES = (
+    "predicate_type_matches",
+    "doctrine_is_v11",
+    "kernel_verified",
+    "honesty_invariants_all_true",
+    "provenance_coverage_is_one",
+    "subject_binds_kernel_commit",
+)
+POLICY_PATH = "ops/szl_chain_of_title.rego"
+POLICY_PACKAGE = "szl.attest.chain_of_title"
+
+
+def evaluate_policy(statement: Any) -> dict[str, Any]:
+    """Evaluate the chain-of-title policy over a Statement.
+
+    Deliberately mirrors ``ops/szl_chain_of_title.rego`` rule for rule so an
+    external OPA evaluation and this in-process evaluation agree. Returns
+    PASSED only when EVERY rule holds; any failure is FAILED with the failing
+    rule names named out loud.
+    """
+    checks: dict[str, bool] = {k: False for k in POLICY_RULES}
+    if not isinstance(statement, dict):
+        return {"policy": VERDICT_FAILED, "checks": checks,
+                "failed": list(POLICY_RULES),
+                "reason": "statement is not a JSON object",
+                "rego": {"path": POLICY_PATH, "package": POLICY_PACKAGE}}
+
+    predicate = statement.get("predicate")
+    predicate = predicate if isinstance(predicate, dict) else {}
+    provenance = predicate.get("provenance")
+    provenance = provenance if isinstance(provenance, dict) else {}
+    inv = predicate.get("honesty_invariants")
+    inv = inv if isinstance(inv, dict) else {}
+
+    checks["predicate_type_matches"] = statement.get("predicateType") == PREDICATE_TYPE
+    checks["doctrine_is_v11"] = predicate.get("doctrine") == DOCTRINE_VERSION
+    checks["kernel_verified"] = provenance.get("kernel_verified") is True
+    checks["honesty_invariants_all_true"] = (
+        inv.get("no_fabricated_measured") is True
+        and inv.get("lambda_is_conjecture_not_theorem") is True
+        and inv.get("locked8_immutable") is True
+        and inv.get("provenance_coverage") == 1.0
+    )
+    checks["provenance_coverage_is_one"] = provenance.get("provenance_coverage") == 1.0
+
+    subjects = statement.get("subject")
+    subjects = subjects if isinstance(subjects, list) else []
+    kernel_bound = False
+    for s in subjects:
+        if not isinstance(s, dict) or s.get("name") != SUBJECT_KERNEL_NAME:
+            continue
+        digest = s.get("digest")
+        commit = digest.get("gitCommit") if isinstance(digest, dict) else None
+        if isinstance(commit, str) and commit.strip():
+            kernel_bound = True
+            break
+    checks["subject_binds_kernel_commit"] = kernel_bound
+
+    failed = [k for k, v in checks.items() if not v]
+    return {
+        "policy": VERDICT_PASSED if not failed else VERDICT_FAILED,
+        "checks": checks,
+        "failed": failed,
+        "reason": None if not failed else "failed policy rules: " + ", ".join(failed),
+        "rego": {"path": POLICY_PATH, "package": POLICY_PACKAGE,
+                 "rule": "passed",
+                 "note": "in-process evaluation mirrors the Rego policy rule for rule"},
+    }
+
+
+# --------------------------------------------------------------------------- #
+# Verify — the tri-state verdict.
+# --------------------------------------------------------------------------- #
+def _require_transparency_default() -> bool:
+    return str(os.environ.get(REQUIRE_TRANSPARENCY_ENV, "")).strip().lower() in (
+        "1", "true", "yes", "on")
+
+
+def _statement_from(payload: Any) -> tuple[dict[str, Any] | None, dict[str, Any] | None, str | None]:
+    """Accept a Statement, a DSSE envelope, or {statement}/{envelope}.
+
+    Returns (statement, envelope, error).
+    """
+    import base64
+
+    if not isinstance(payload, dict):
+        return None, None, "body must be a JSON object"
+    if isinstance(payload.get("envelope"), dict):
+        payload = payload["envelope"]
+    elif isinstance(payload.get("statement"), dict):
+        stmt = payload["statement"]
+        return stmt, None, None
+    if payload.get("payload") and payload.get("payloadType"):
+        try:
+            body = base64.b64decode(payload["payload"])
+            stmt = json.loads(body.decode("utf-8"))
+        except Exception:
+            return None, payload, "envelope payload is not decodable JSON"
+        if not isinstance(stmt, dict):
+            return None, payload, "envelope payload is not a JSON object"
+        return stmt, payload, None
+    if payload.get("_type") or payload.get("predicateType"):
+        return payload, None, None
+    return None, None, "no in-toto Statement or DSSE envelope found in the body"
+
+
+def verify(statement: Any, *, envelope: dict[str, Any] | None = None,
+           require_transparency: bool | None = None,
+           rekor: dict[str, Any] | None = None,
+           submitter: Any = None) -> dict[str, Any]:
+    """Tri-state verification of a chain-of-title Statement.
+
+      FAILED  — the policy failed, or a present signature did not verify. A
+                tampered statement is always FAILED, never UNKNOWN.
+      UNKNOWN — the policy passed but a REQUIRED transparency-log inclusion
+                proof could not be obtained (Rekor unreachable / not attempted).
+      PASSED  — the policy passed and, when transparency is required, a real
+                inclusion proof came back this request.
+
+    ``verdict_scope`` always states what the verdict covers, so a policy-only
+    PASSED is never mistaken for a transparency-anchored one.
+    """
+    if require_transparency is None:
+        require_transparency = _require_transparency_default()
+
+    policy = evaluate_policy(statement)
+    sig = signature_status(envelope) if isinstance(envelope, dict) else {
+        "signed": False, "verified": None, "status": "NO-ENVELOPE-SUPPLIED",
+        "note": "verification ran over a bare Statement; no signature claimed",
+    }
+    if rekor is None:
+        rekor = (rekor_submit(envelope, submitter=submitter)
+                 if isinstance(envelope, dict)
+                 else {"status": REKOR_NOT_ATTEMPTED, "attempted": False,
+                       "reachable": None, "inclusion_proof": None,
+                       "label": "STRUCTURAL-ONLY",
+                       "note": "no envelope supplied — nothing to submit"})
+
+    transparency_ok = rekor.get("status") == REKOR_RECORDED
+
+    reasons: list[str] = []
+    if policy["policy"] == VERDICT_FAILED:
+        verdict = VERDICT_FAILED
+        reasons.append(policy["reason"] or "policy failed")
+    elif sig.get("status") == "SIGNATURE-INVALID":
+        verdict = VERDICT_FAILED
+        reasons.append("DSSE signature present but did not verify (tamper)")
+    elif sig.get("status") == "UNKNOWN-VERIFIER-ERROR":
+        verdict = VERDICT_UNKNOWN
+        reasons.append("signature verifier error — UNKNOWN, not a pass")
+    elif require_transparency and not transparency_ok:
+        verdict = VERDICT_UNKNOWN
+        reasons.append("transparency-log inclusion required but "
+                       f"{rekor.get('status')} — UNKNOWN, never a fabricated PASSED")
+    else:
+        verdict = VERDICT_PASSED
+
+    if verdict == VERDICT_PASSED and not transparency_ok:
+        scope = ("policy-only: every chain-of-title policy rule holds; the "
+                 "transparency-log strand is UNKNOWN this request and is NOT "
+                 "part of this verdict")
+    elif verdict == VERDICT_PASSED:
+        scope = ("policy + transparency: policy rules hold AND a real Rekor "
+                 "inclusion proof was returned this request")
+    else:
+        scope = "; ".join(reasons)
+
+    return {
+        "ok": True,
+        "schema": SCHEMA,
+        "verdict": verdict,
+        "verdict_scope": scope,
+        "policy": policy,
+        "signature": sig,
+        "transparency": {
+            "required": bool(require_transparency),
+            "status": rekor.get("status"),
+            "label": rekor.get("label", "STRUCTURAL-ONLY"),
+            "log_index": rekor.get("log_index"),
+            "entry_uuid": rekor.get("entry_uuid"),
+            "inclusion_proof": rekor.get("inclusion_proof"),
+            "note": rekor.get("note"),
+        },
+        "reasons": reasons,
+        "label": LABEL_MEASURED if transparency_ok else LABEL_MODELED,
+        "label_rule": ("MEASURED only when a real transparency-log inclusion proof "
+                       "was returned THIS request; MODELED otherwise"),
+        "lambda": {"status": "Conjecture 1", "is_theorem": False,
+                   "trust_ceiling": TRUST_CEILING},
+        "verified_at": _now_iso(),
+    }
+
+
+# --------------------------------------------------------------------------- #
+# Manifest — statement + envelope + rekor + verdict in one read.
+# --------------------------------------------------------------------------- #
+def build_manifest(*, ns: str = "a11oy", require_transparency: bool | None = None,
+                   submitter: Any = None, opener: Any = None) -> dict[str, Any]:
+    """Build, sign, structure-for-Rekor and self-verify in one pure read."""
+    statement = build_statement(ns=ns, opener=opener)
+    envelope = sign_statement(statement)
+    rekor = rekor_submit(envelope, submitter=submitter)
+    verdict = verify(statement, envelope=envelope, rekor=rekor,
+                     require_transparency=require_transparency)
+    return {
+        "ok": True,
+        "schema": SCHEMA,
+        "label": verdict["label"],
+        "statement": statement,
+        "statement_digest_sha256": digest_hex(statement),
+        "envelope": envelope,
+        "rekor": rekor,
+        "verdict": verdict["verdict"],
+        "verdict_scope": verdict["verdict_scope"],
+        "verification": verdict,
+        "policy_source": {"path": POLICY_PATH, "package": POLICY_PACKAGE,
+                          "rules": list(POLICY_RULES)},
+        "cites": list(CITES),
+        "honest_note": (
+            "This is a chain-of-title ATTESTATION, not a proof of correctness. It "
+            "binds what is actually readable this request and says so when a strand "
+            "is absent: no weights digest without weights, no joule without a meter, "
+            "no Rekor entry without a log answer. Λ stays Conjecture 1; the locked-8 "
+            "is attested, never extended; the SEAL score is tier PROPOSED."),
+        "built_at": _now_iso(),
+    }
+
+
+# --------------------------------------------------------------------------- #
+# szl-lake receipt (opt-in, guarded, off the hot path).
+# --------------------------------------------------------------------------- #
+def lake_receipt(manifest: dict[str, Any]) -> dict[str, Any]:
+    """Append an attestation receipt to the szl-lake ledger, IF configured.
+
+    Opt-in on ``SZL_LAKE_DIR`` so a plain read never writes to disk. Guarded:
+    a lake failure is reported, never raised into the request.
+    """
+    if not (os.environ.get(LAKE_DIR_ENV) or "").strip():
+        return {"appended": False, "status": "NOT_CONFIGURED",
+                "note": f"{LAKE_DIR_ENV} unset — no ledger write on a read path"}
+    receipt = {
+        "organ": "attest",
+        "id": manifest.get("statement_digest_sha256"),
+        "ts": manifest.get("built_at"),
+        "schema": SCHEMA,
+        "verdict": manifest.get("verdict"),
+        "label": manifest.get("label"),
+        "predicate_type": PREDICATE_TYPE,
+        "kernel_pin": KERNEL_PIN,
+        "rekor_status": (manifest.get("rekor") or {}).get("status"),
+        "signed": bool((manifest.get("envelope") or {}).get("signed")),
+        # energy is omitted rather than zero-filled — szl_lake_store labels an
+        # absent reading UNAVAILABLE, which is the honest state here.
+    }
+    try:
+        import szl_lake_store
+
+        store = szl_lake_store.LakeStore()
+        res = store.append(receipt)
+        return {"appended": bool(res.get("accepted")), "status": "APPENDED",
+                "receipt_id": res.get("receipt_id"),
+                "chain_index": res.get("chain_index"),
+                "chain_head": res.get("chain_head")}
+    except Exception as exc:
+        print(f"[attest] lake receipt skipped (guarded): {type(exc).__name__}",
+              file=sys.stderr)
+        return {"appended": False, "status": "UNAVAILABLE",
+                "note": f"lake append failed ({type(exc).__name__}) — not fabricated"}
+
+
+# --------------------------------------------------------------------------- #
+# FastAPI registration.
+#
+# GET  manifest / verify  and  POST verify. All three are raw-Request handlers
+# so the POST is version-proof under fastapi==0.137.x (Starlette passes the
+# Request positionally); ``request`` is annotated as ``fastapi.Request`` for the
+# add_api_route fallback path.
+#
+# ROUTE-ORDER GOTCHA: szl_attest_stack already owns the PARAMETRIZED route
+# /api/<ns>/v1/attest/{receipt_hash}, which would otherwise swallow "manifest"
+# and "verify" as a receipt hash. So these STATIC routes are inserted BEFORE the
+# first parametrized /attest/ route (the proven szl_attested_inference pattern),
+# and in any case before the SPA catch-all.
+# --------------------------------------------------------------------------- #
+def register(app, ns: str = "a11oy") -> str:
+    from fastapi.responses import JSONResponse
+
+    base = f"/api/{ns}/v1/attest"
+
+    def _truthy(v: Any) -> bool:
+        return str(v or "").strip().lower() in ("1", "true", "yes", "on")
+
+    def _require_flag(request) -> bool | None:
+        try:
+            raw = request.query_params.get("require_transparency")
+        except Exception:
+            return None
+        if raw is None:
+            return None
+        return _truthy(raw)
+
+    async def _h_manifest(request):
+        """GET manifest — build + sign + structure-for-Rekor + self-verify."""
+        try:
+            man = build_manifest(ns=ns, require_transparency=_require_flag(request))
+            man["lake"] = lake_receipt(man)
+            return JSONResponse(man)
+        except Exception as exc:  # never 500 into the console
+            return JSONResponse({
+                "ok": False, "schema": SCHEMA, "label": LABEL_MODELED,
+                "verdict": VERDICT_UNKNOWN,
+                "verdict_scope": f"manifest build error ({type(exc).__name__}) — "
+                                 "UNKNOWN, never a fabricated PASSED",
+            }, status_code=200)
+
+    async def _h_verify(request):
+        """GET/POST verify — PASSED / FAILED honestly, UNKNOWN when unreachable."""
+        try:
+            body: Any = None
+            if request.method == "POST":
+                try:
+                    body = await request.json()
+                except Exception:
+                    body = None
+            require = _require_flag(request)
+            if body is None:
+                statement = build_statement(ns=ns)
+                envelope = sign_statement(statement)
+                out = verify(statement, envelope=envelope, require_transparency=require)
+                out["source"] = "freshly built statement (no body supplied)"
+                return JSONResponse(out)
+            statement, envelope, err = _statement_from(body)
+            if statement is None:
+                return JSONResponse({
+                    "ok": False, "schema": SCHEMA, "verdict": VERDICT_FAILED,
+                    "verdict_scope": err or "unparseable submission",
+                    "label": LABEL_MODELED,
+                }, status_code=200)
+            out = verify(statement, envelope=envelope, require_transparency=require)
+            out["source"] = "caller-supplied " + ("envelope" if envelope else "statement")
+            return JSONResponse(out)
+        except Exception as exc:
+            return JSONResponse({
+                "ok": False, "schema": SCHEMA, "verdict": VERDICT_UNKNOWN,
+                "verdict_scope": f"verifier error ({type(exc).__name__}) — UNKNOWN, "
+                                 "never a fabricated PASSED",
+                "label": LABEL_MODELED,
+            }, status_code=200)
+
+    try:
+        import fastapi as _fastapi
+        _h_manifest.__annotations__["request"] = _fastapi.Request
+        _h_verify.__annotations__["request"] = _fastapi.Request
+    except Exception:  # noqa: BLE001 — annotation is best-effort only
+        pass
+
+    wired: list[str] = []
+    specs = (
+        (f"{base}/manifest", _h_manifest, ["GET"]),
+        (f"{base}/verify", _h_verify, ["GET", "POST"]),
+    )
+    prefix = base + "/"
+    for path, handler, methods in specs:
+        try:
+            from starlette.routing import Route
+
+            routes = app.router.routes
+            insert_at = 0
+            for i, rt in enumerate(routes):
+                p = getattr(rt, "path", "") or ""
+                if p.startswith(prefix) and "{" in p and p != path:
+                    insert_at = i
+                    break
+            routes.insert(insert_at, Route(path, handler, methods=methods))
+            wired.append(path)
+            continue
+        except Exception as exc:
+            print(f"[{ns}] attest route front-insert failed for {path}: {exc!r}",
+                  file=sys.stderr)
+        try:
+            add_route = getattr(getattr(app, "router", None), "add_route", None)
+            if callable(add_route):
+                add_route(path, handler, methods=methods)
+            else:
+                app.add_api_route(path, handler, methods=methods)
+            wired.append(path)
+        except Exception as exc:  # additive register must never break boot
+            print(f"[{ns}] attest route NOT wired (guarded) {path}: {exc!r}",
+                  file=sys.stderr)
+
+    return f"attest-wired:{len(wired)}"
+
+
+# --------------------------------------------------------------------------- #
+# No-server self-test — the honesty invariants of this organ.
+# --------------------------------------------------------------------------- #
+def _selftest() -> dict[str, Any]:
+    man = build_manifest()
+    stmt = man["statement"]
+    assert stmt["_type"] == STATEMENT_TYPE
+    assert stmt["predicateType"] == PREDICATE_TYPE
+    assert stmt["predicate"]["doctrine"] == DOCTRINE_VERSION
+    # subject always binds a non-empty locked-8 kernel commit
+    kernels = [s for s in stmt["subject"] if s["name"] == SUBJECT_KERNEL_NAME]
+    assert len(kernels) == 1 and kernels[0]["digest"]["gitCommit"] == KERNEL_PIN
+    # no fabricated joule, no fabricated Rekor entry in an offline runtime
+    assert stmt["predicate"]["energy_measured"] == [] or all(
+        r.get("label") == LABEL_MEASURED for r in stmt["predicate"]["energy_measured"])
+    assert man["rekor"]["status"] in (REKOR_RECORDED, REKOR_UNREACHABLE,
+                                     REKOR_NOT_ATTEMPTED)
+    if man["rekor"]["status"] != REKOR_RECORDED:
+        assert man["rekor"]["inclusion_proof"] is None
+        assert man["rekor"]["log_index"] is None
+        assert man["label"] == LABEL_MODELED
+    # policy passes on a well-formed statement, fails on a tampered one
+    assert evaluate_policy(stmt)["policy"] == VERDICT_PASSED, evaluate_policy(stmt)
+    bad = json.loads(json.dumps(stmt))
+    bad["predicate"]["honesty_invariants"]["locked8_immutable"] = False
+    assert evaluate_policy(bad)["policy"] == VERDICT_FAILED
+    assert verify(bad)["verdict"] == VERDICT_FAILED
+    # required transparency with no log => UNKNOWN, never PASSED
+    unk = verify(stmt, envelope=man["envelope"], require_transparency=True)
+    if man["rekor"]["status"] != REKOR_RECORDED:
+        assert unk["verdict"] == VERDICT_UNKNOWN, unk["verdict"]
+    # Λ never a theorem
+    assert stmt["predicate"]["lambda"]["is_theorem"] is False
+    assert stmt["predicate"]["lambda"]["status"] == "Conjecture 1"
+    print(f"szl_attest: ALL OK — verdict={man['verdict']} "
+          f"rekor={man['rekor']['status']} signed={man['envelope'].get('signed')}")
+    return man
+
+
+if __name__ == "__main__":  # pragma: no cover
+    _selftest()