deploy(hf): sync szl-holdings/a11oy@db8e5cb3fbc20cd429bcc6aad81165fa51a87026 derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy db8e5cb3fbc20cd429bcc6aad81165fa51a87026.
Files: 1161 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

routers/series_a_web/app.js

@@ -0,0 +1,84 @@
+(() => {
+  "use strict";
+  const API = "/api/a11oy/v1/series-a";
+  const terminal = (value) => value == null ? "UNKNOWN" : String(value);
+  const set = (key, value) => {
+    const node = document.querySelector(`[data-key="${key}"]`);
+    if (node) node.textContent = terminal(value);
+  };
+  const sha256 = async (text) => {
+    const bytes = new TextEncoder().encode(text);
+    const digest = await crypto.subtle.digest("SHA-256", bytes);
+    return [...new Uint8Array(digest)].map(value => value.toString(16).padStart(2, "0")).join("");
+  };
+  const request = async (path, options = {}) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 8000);
+    try {
+      const response = await fetch(API + path, {cache: "no-store", ...options, signal: controller.signal});
+      if (!response.ok) throw new Error(`HTTP ${response.status}`);
+      return await response.json();
+    } finally { clearTimeout(timer); }
+  };
+  const load = async () => {
+    try {
+      const [status, trust, receipts] = await Promise.all([
+        request("/status"), request("/trust"), request("/receipts")
+      ]);
+      set("estate", status.state);
+      set("repos", status.counts?.github_repositories);
+      set("prs", status.counts?.github_open_pull_requests);
+      set("spaces", status.counts?.spaces);
+      set("models", status.counts?.models);
+      set("datasets", status.counts?.datasets);
+      set("trust", trust.score_0_to_100);
+      set("signer", status.signature_status || status.signing_key_source);
+      document.getElementById("updated").textContent = status.observed_at ? `Observed ${status.observed_at}` : status.detail || "Terminal state reached";
+      const list = document.getElementById("receipts");
+      list.replaceChildren(...(receipts.items || []).slice(0, 8).map(item => {
+        const li = document.createElement("li");
+        li.textContent = `${item.kind} · ${item.receipt_hash.slice(0, 14)}… · ${item.envelope.signature_status}`;
+        return li;
+      }));
+      if (!list.children.length) list.innerHTML = "<li>OBSERVED · no receipts yet</li>";
+    } catch (error) {
+      ["estate", "trust", "signer"].forEach(key => set(key, error.name === "AbortError" ? "TIMED_OUT" : "UNAVAILABLE"));
+      document.getElementById("updated").textContent = error.name === "AbortError" ? "Timed out after 8 seconds" : String(error.message || error);
+    }
+  };
+  document.getElementById("refresh").addEventListener("click", async () => {
+    const button = document.getElementById("refresh");
+    button.disabled = true;
+    try {
+      await request("/refresh", {method: "POST", headers: {"content-type": "application/json"}, body: JSON.stringify({actor: "series-a-ui"})});
+    } catch (error) {
+      document.getElementById("updated").textContent = String(error.message || error);
+    } finally { button.disabled = false; await load(); }
+  });
+  document.getElementById("passport").addEventListener("submit", async (event) => {
+    event.preventDefault();
+    const form = new FormData(event.currentTarget);
+    const evidenceStatement = JSON.stringify({
+      source: "series-a-ui",
+      target: form.get("target"),
+      label: form.get("label"),
+      observed_at: new Date().toISOString()
+    });
+    const body = {
+      principal_id: "series-a-ui",
+      action: {type: form.get("type"), target: form.get("target"), impact: "MODERATE", irreversible: false},
+      evidence: [{evidence_id: "ui-observation", label: form.get("label"), content_digest: await sha256(evidenceStatement)}],
+      expected_if_withheld: "Current state persists",
+      expected_if_acted: "Bounded action completes or fails closed"
+    };
+    const output = document.getElementById("passport-result");
+    output.textContent = "EVALUATING";
+    try {
+      const value = await request("/passports/evaluate", {method: "POST", headers: {"content-type": "application/json"}, body: JSON.stringify(body)});
+      output.textContent = JSON.stringify({decision: value.passport.decision, reason_codes: value.passport.reason_codes, passport_digest: value.passport_digest, signature_status: value.decision_receipt.envelope.signature_status}, null, 2);
+    } catch (error) { output.textContent = `UNAVAILABLE: ${error.message || error}`; }
+    await load();
+  });
+  load();
+  window.setInterval(load, 60000);
+})();

routers/series_a_web/index.html

@@ -0,0 +1,51 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <title>A11oy Series-A Live Control Plane</title>
+  <link rel="stylesheet" href="/series-a/styles.css">
+</head>
+<body>
+<a class="skip" href="#main">Skip to control plane</a>
+<header>
+  <p class="eyebrow">A11OY · ACTION ASSURANCE</p>
+  <h1>Series‑A Live Control Plane</h1>
+  <p>Current estate truth, counterfactual action passports, signed receipts, and one-attempt execution—observed, not assumed.</p>
+</header>
+<main id="main" tabindex="-1">
+  <section class="toolbar" aria-label="Control plane actions">
+    <button id="refresh" type="button">Refresh live estate</button>
+    <span id="updated" aria-live="polite">Not observed yet</span>
+  </section>
+  <section class="grid" id="cards" aria-label="Live status">
+    <article><h2>Estate</h2><strong data-key="estate">CHECKING</strong><p>Signed current observation.</p></article>
+    <article><h2>GitHub repos</h2><strong data-key="repos">—</strong><p>Complete paginated census.</p></article>
+    <article><h2>Open PRs</h2><strong data-key="prs">—</strong><p>Current public queue.</p></article>
+    <article><h2>HF Spaces</h2><strong data-key="spaces">—</strong><p>One canonical A11oy required.</p></article>
+    <article><h2>Models</h2><strong data-key="models">—</strong><p>Official Hub listing.</p></article>
+    <article><h2>Datasets</h2><strong data-key="datasets">—</strong><p>Official Hub listing.</p></article>
+    <article><h2>Trust factor</h2><strong data-key="trust">CHECKING</strong><p>Derived from signed local decisions.</p></article>
+    <article><h2>Receipt signer</h2><strong data-key="signer">CHECKING</strong><p>Persistent P‑256 preferred.</p></article>
+  </section>
+  <section class="panel">
+    <h2>Counterfactual Action Passport</h2>
+    <form id="passport">
+      <label>Action
+        <select name="type"><option value="estate.refresh">Refresh estate truth</option><option value="probe.public_surface">Probe public surface</option></select>
+      </label>
+      <label>Target <input name="target" value="https://a-11-oy.com/healthz" required></label>
+      <label>Evidence label <select name="label"><option>MEASURED</option><option>REPORTED</option><option>UNKNOWN</option></select></label>
+      <button type="submit">Evaluate passport</button>
+    </form>
+    <pre id="passport-result" aria-live="polite">No passport evaluated.</pre>
+  </section>
+  <section class="panel">
+    <h2>Latest signed receipts</h2>
+    <ol id="receipts"><li>CHECKING</li></ol>
+  </section>
+</main>
+<footer>MEASURED · REPORTED · MODELED · UNKNOWN · UNAVAILABLE · no private reasoning collected</footer>
+<script src="/series-a/app.js" defer></script>
+</body>
+</html>

routers/series_a_web/styles.css

@@ -0,0 +1 @@
+:root{color-scheme:dark;--bg:#07101e;--card:#0d192a;--line:#24344d;--text:#eef5ff;--muted:#9db0c9;--accent:#83d6ff;--good:#7ce7ba}*{box-sizing:border-box}body{margin:0;background:radial-gradient(circle at top,#13223a 0,#07101e 42%);color:var(--text);font:16px/1.5 system-ui,-apple-system,Segoe UI,sans-serif}.skip{position:absolute;left:-9999px}.skip:focus{left:1rem;top:1rem;background:white;color:black;padding:.7rem;z-index:5}header,main,footer{width:min(1180px,calc(100% - 2rem));margin:auto}header{padding:4rem 0 2rem}.eyebrow{color:var(--accent);letter-spacing:.16em;font-weight:800}h1{font-size:clamp(2.2rem,6vw,5rem);line-height:1;margin:.3rem 0}header>p:last-child{max-width:760px;color:var(--muted);font-size:1.12rem}.toolbar{display:flex;gap:1rem;align-items:center;justify-content:space-between;margin-bottom:1rem}.grid{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:1rem}.grid article,.panel{background:linear-gradient(180deg,rgba(18,34,57,.96),rgba(10,22,38,.96));border:1px solid var(--line);border-radius:18px;padding:1.2rem;box-shadow:0 16px 60px rgba(0,0,0,.25)}.grid h2{font-size:.92rem;color:var(--muted);margin:0 0 .5rem}.grid strong{font-size:1.7rem;color:var(--good)}.grid p{color:var(--muted);margin:.4rem 0 0}.panel{margin-top:1rem}form{display:grid;grid-template-columns:1fr 2fr 1fr auto;gap:.8rem;align-items:end}label{display:grid;gap:.35rem;color:var(--muted)}input,select,button{font:inherit;border-radius:10px;border:1px solid var(--line);padding:.7rem .8rem;background:#071321;color:var(--text)}button{background:#dff5ff;color:#06101b;font-weight:800;cursor:pointer}button:disabled{opacity:.55}pre{white-space:pre-wrap;overflow-wrap:anywhere;background:#06101b;border-radius:12px;padding:1rem}footer{padding:2rem 0 4rem;color:var(--muted)}@media(max-width:900px){.grid{grid-template-columns:repeat(2,minmax(0,1fr))}form{grid-template-columns:1fr 1fr}}@media(max-width:560px){header{padding-top:2.5rem}.grid,form{grid-template-columns:1fr}.toolbar{align-items:flex-start;flex-direction:column}.grid article{min-height:130px}}