deploy(hf): sync szl-holdings/a11oy@51cc3a8bc33ee38facb5b208d5f9f933af73838c derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy 51cc3a8bc33ee38facb5b208d5f9f933af73838c.
Files: 1361 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

a11oy_command_center.py

@@ -6,6 +6,10 @@
 Product host: a-11-oy.com  (this surface)
 Proof host:   a11oy.net    (do not serve this surface there)
 
+The canonical /command surface serves the reviewed public Command Center SPA.
+The dormant Elite Console is deliberately not a candidate: its browser-safety,
+API-schema, evidence-source, and canonical-number contracts are not release-ready.
+
 Additive routes:
   GET+HEAD /command
   GET+HEAD /command-v2
@@ -17,7 +21,7 @@ Additive routes:
   GET+HEAD /command/{rest}
 
 The additive router does not steal /console or the host-root /brain route.
-/command remains on elite_console.html; /command-v2 is an independently
+/command-v2 is an independently
 reviewable skin until an explicit, evidence-backed promotion changes that.
 """
 from pathlib import Path
@@ -37,10 +41,9 @@ REQUIRED_PAGES = {"command-v2.html"}
 
 
 def _spa_path() -> Path:
+    """Resolve only the reviewed public Command Center asset."""
     here = Path(__file__).resolve().parent
     candidates = (
-        here / "web" / "elite_console.html",
-        Path("/app/web/elite_console.html"),
         here / "pages" / "command-center.html",
         Path("/app/pages/command-center.html"),
         here / "command-center.html",
@@ -48,7 +51,7 @@ def _spa_path() -> Path:
     for candidate in candidates:
         if candidate.is_file():
             return candidate
-    return here / "web" / "elite_console.html"
+    return here / "pages" / "command-center.html"
 
 
 def _page(name: str) -> Path:
@@ -153,7 +156,7 @@ def register(app, ns: str = "a11oy") -> List[str]:
     _add(CATCHALL, _spa, ["GET", "HEAD"])
     _front_move(app, [path for path, _name in SPECIFIC] + list(MOUNTS))
     registered.append(
-        "command-center on /command; /command-v2 additive; "
+        "command-center reviewed-public on /command (dormant elite excluded); /command-v2 additive; "
         "constellation/brain/ops beat catch-all; /console and host-root /brain untouched"
     )
     return registered
@@ -168,11 +171,8 @@ def _selftest() -> None:
     spa = _spa_path()
     assert spa.is_file(), spa
     html = spa.read_text(encoding="utf-8")
-    assert ("Elite Console" in html) or ("a11oy Command Center" in html)
-    if spa.name == "elite_console.html":
-        assert "20 fully-functional tabs" in html
-        assert "/api/a11oy/" in html
-        assert "zero mocks" in html.lower()
+    assert spa.name == "command-center.html"
+    assert "a11oy Command Center" in html
     assert "cdnjs" not in html and "googleapis" not in html and "jsdelivr" not in html
     assert "Conjecture 1" in html
 
@@ -191,6 +191,8 @@ def _selftest() -> None:
     for path in ("/command", "/command/anatomy", "/command/honest"):
         response = client.get(path)
         assert response.status_code == 200, (path, response.status_code)
+        assert "a11oy Command Center" in response.text
+        assert client.head(path).status_code == 200, path
 
     command_v2 = _page("command-v2.html")
     if command_v2.is_file():

a11oy_khipu_chat.py

@@ -12,11 +12,12 @@ proxies:
 
 Auth is the publicly documented dummy Bearer not-a-secret. HF_TOKEN is never
 read or forwarded. GET does not mint a receipt. POST passes through the lab's
-UNSIGNED record_sha256 when present; missing fields are UNKNOWN.
+reported signature state and record_sha256 when present; missing fields are
+UNKNOWN, and receipt verification stays UNAVAILABLE without payload/key/chain.
 
 GPU Inference Endpoint remains ROADMAP. Forge lab is SNAPSHOT — not a
-trainer, not Serve Studio. Energy-attested-runs 8/8 is SIMULATED. Ask & Act
-is not a live control plane. killinchu detector stays SIMULATED.
+trainer, not Serve Studio. Energy-attested runs remain UNAVAILABLE until a
+canonical runtime source is wired. Ask & Act is not a live control plane.
 Λ = Conjecture 1.
 """
 import hashlib
@@ -36,7 +37,6 @@ from packages.inference.src.voters.khipu_gguf import (
     KHIPU_LAB_DUMMY_BEARER,
     KHIPU_LAB_V1,
     KHIPU_MAX_TOKENS,
-    KHIPU_MEASURED_PROBE_2026_08_28,
     KHIPU_TEMPERATURE,
     clamp_max_tokens,
     extract_lab_receipt,
@@ -44,24 +44,59 @@ from packages.inference.src.voters.khipu_gguf import (
     khipu_lab_v1,
     khipu_pin,
 )
+from szl_be_hardening import DOCTRINE_LOCK
 
 _STATUS_PATH = "/api/a11oy/v1/khipu/status"
 _CHAT_PATH = "/api/a11oy/v1/khipu/chat"
 _PROMPT_CHAR_CAP = 4000
+_CANONICAL_LOCKED_FORMULA_IDS = frozenset({"F1", "F4", "F7", "F11", "F12", "F18", "F19", "F22"})
+_CANONICAL_LOCKED_FORMULA_COUNT = len(_CANONICAL_LOCKED_FORMULA_IDS)
+
+
+def _doctrine_status() -> dict:
+    """Copy the lock only when it is exactly the canonical locked-eight set."""
+    doctrine = DOCTRINE_LOCK if isinstance(DOCTRINE_LOCK, dict) else {}
+    raw_ids = doctrine.get("locked_formula_ids")
+    ids = list(raw_ids) if isinstance(raw_ids, list) else []
+    count = doctrine.get("locked_formula_count")
+    lambda_value = doctrine.get("lambda")
+    valid = (
+        doctrine.get("doctrine") == "v11"
+        and doctrine.get("state") == "LOCKED"
+        and count == _CANONICAL_LOCKED_FORMULA_COUNT
+        and not isinstance(count, bool)
+        and len(ids) == count
+        and all(isinstance(item, str) for item in ids)
+        and frozenset(ids) == _CANONICAL_LOCKED_FORMULA_IDS
+    )
+    if not valid:
+        count = None
+        ids = []
+    return {
+        "version": doctrine.get("doctrine") if valid else "UNAVAILABLE",
+        "state": "LOCKED" if valid else "UNAVAILABLE",
+        "source": "szl_be_hardening.DOCTRINE_LOCK",
+        "locked_formula_count": count,
+        "locked_formula_ids": ids,
+        "lambda": lambda_value if isinstance(lambda_value, str) else "UNAVAILABLE",
+    }
 
 
 def _honesty() -> dict:
     return {
-        "lab": "MEASURED this request when /healthz returns READY; else FAILED",
+        "lab": (
+            "MEASURED health HTTP response only; FAILED on resolved non-READY; "
+            "UNAVAILABLE on transport failure"
+        ),
         "lab_v1": KHIPU_LAB_V1,
         "gpu_inference_endpoint": "ROADMAP",
         "forge_lab": "SNAPSHOT — not a trainer, not Serve Studio",
-        "energy_attested_runs": "8/8 SIMULATED",
+        "energy_attested_runs": "UNAVAILABLE",
         "ask_and_act": "not a live control plane",
         "killinchu_detector": "SIMULATED",
         "lambda": "Conjecture 1",
         "tokens_per_second": "not reported",
-        "signing": "UNSIGNED unless the lab returns a signature; never fabricated",
+        "signing": "UNAVAILABLE — upstream signature state is not verified by this proxy",
     }
 
 
@@ -86,7 +121,7 @@ async def _healthz() -> tuple[str, dict | None, str | None]:
             return "READY", body, None
         return "FAILED", body, "healthz HTTP %s status=%s" % (resp.status_code, status or "UNKNOWN")
     except Exception as exc:
-        return "FAILED", None, "%s: %s" % (type(exc).__name__, exc)
+        return "UNAVAILABLE", None, "%s: %s" % (type(exc).__name__, exc)
 
 
 async def _handle_status(request: Request) -> JSONResponse:
@@ -97,12 +132,8 @@ async def _handle_status(request: Request) -> JSONResponse:
         "error": err,
         "pin": khipu_pin(),
         "honesty": _honesty(),
-        "measured_probe_2026_08_28": KHIPU_MEASURED_PROBE_2026_08_28,
-        "doctrine": {
-            "version": "v11",
-            "locked_formulas": 8,
-            "lambda": "Conjecture 1",
-        },
+        "measured_probe": {"label": "UNAVAILABLE", "reason": "no generated benchmark receipt is wired"},
+        "doctrine": _doctrine_status(),
     }
     return JSONResponse(payload)
 
@@ -155,8 +186,8 @@ async def _handle_chat(request: Request) -> JSONResponse:
         extracted = extract_lab_receipt(data)
         ok = resp.status_code == 200 and bool(extracted["text"])
         lab_status = "READY" if ok else "FAILED"
-        # Prefer the lab's elapsed_ms when present; otherwise this proxy's wall.
-        elapsed = extracted["elapsed_ms"] if extracted["elapsed_ms"] is not None else wall_ms
+        # Measure at the proxy boundary; never relabel an untrusted upstream duration.
+        elapsed = wall_ms
         out = {
             "ok": ok,
             "lab_status": lab_status,
@@ -167,7 +198,14 @@ async def _handle_chat(request: Request) -> JSONResponse:
             "usage": extracted["usage"] if ok else {},
             "usage_label": "REPORTED" if (ok and extracted["usage"]) else "UNKNOWN",
             "elapsed_ms": elapsed,
+            "elapsed_ms_source": "PROXY_WALL",
             "elapsed_ms_label": "MEASURED",
+            "receipt_evidence_label": "UNAVAILABLE",
+            "receipt_evidence_reason": (
+                "the proxy does not receive a receipt payload, verification key, or chain proof"
+            ),
+            "signature_evidence_label": "UNAVAILABLE",
+            "record_hash_evidence_label": "UNAVAILABLE",
             "wall_ms": wall_ms,
             "model": extracted["model"],
             "pin": pin,
@@ -182,14 +220,19 @@ async def _handle_chat(request: Request) -> JSONResponse:
         return JSONResponse(
             {
                 "ok": False,
-                "lab_status": "FAILED",
+                "lab_status": "UNAVAILABLE",
                 "text": None,
                 "signature": "UNKNOWN",
                 "record_sha256": "UNKNOWN",
                 "usage": {},
                 "usage_label": "UNKNOWN",
                 "elapsed_ms": wall_ms,
+                "elapsed_ms_source": "PROXY_WALL",
                 "elapsed_ms_label": "MEASURED",
+                "receipt_evidence_label": "UNAVAILABLE",
+                "receipt_evidence_reason": "no upstream response was available to verify",
+                "signature_evidence_label": "UNAVAILABLE",
+                "record_hash_evidence_label": "UNAVAILABLE",
                 "pin": pin,
                 "honesty": _honesty(),
                 "error": "%s: %s" % (type(exc).__name__, exc),

console/assets/brain-frontier-v7.js

@@ -13,11 +13,28 @@
   const SOURCE_REPOSITORIES = new Set([
     "szl-holdings/szl-formulas",
     "szl-holdings/anatomy",
-    "szl-holdings/ouroboros",
+    "szl-holdings/szl-ouroboros",
     "szl-holdings/a11oy",
     "szl-holdings/szl-forge",
     "szl-holdings/szl-nemo",
+    "szl-holdings/szl-kernels",
   ]);
+  const HANDLE_KINDS = new Set([
+    "formula-authority", "quant-domain", "attributed-formula", "executable-formula",
+    "python-contract", "estate-authority", "estate-surface", "source-document",
+  ]);
+  const HANDLE_ADMISSIONS = new Set([
+    "DISCOVERED_REVIEW_REQUIRED",
+    "EXECUTABLE_CONSTRAINT_REVIEW_REQUIRED",
+    "OPEN_NOT_EXECUTION_AUTHORITY",
+    "REFERENCE_AND_CONSTRAINT_INPUT_ONLY",
+    "REFERENCE_ONLY_EXECUTION_AUTHORITY_NONE",
+    "REFERENCE_ONLY_NO_PROVIDER_MUTATION",
+    "REFERENCE_ONLY_UNLESS_EXECUTABLE_MATCH_IS_EXPLICIT",
+    "SOURCE_RECEIPT_REQUIRED_FOR_CURRENT_CLAIM",
+  ]);
+  const LOOP = ["OBSERVE", "ORIENT", "PROPOSE", "VERIFY", "HOLD"];
+  const MAX_SNAPSHOT_BYTES = 256 * 1024;
   const REDUCED_MOTION = window.matchMedia("(prefers-reduced-motion: reduce)");
   const state = {
     open: false,
@@ -48,12 +65,28 @@
     return text.startsWith("szl-holdings/") ? text.slice(13) : text;
   };
 
+  const record = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+  const matches = (value, pattern) => typeof value === "string" && pattern.test(value);
+  const exactKeys = (value, required, optional = []) => record(value)
+    && required.every((key) => Object.hasOwn(value, key))
+    && Object.keys(value).every((key) => required.includes(key) || optional.includes(key));
+  const safeTitle = (value) => typeof value === "string" && value.trim().length > 0
+    && [...value].length <= 180 && !/[\u0000-\u001f\u007f-\u009f\ud800-\udfff]/u.test(value);
+  const safePath = (value) => typeof value === "string" && value.length <= 512
+    && value.split("/").every((part) => /^[A-Za-z0-9_.-]+$/.test(part) && part !== "." && part !== "..");
+  const safeDomain = (value) => matches(value, /^[a-z0-9][a-z0-9_-]{0,79}$/);
+
   function validateHandle(handle) {
-    if (!handle || typeof handle !== "object") return false;
-    if (!HANDLE_ID.test(String(handle.nodeId ?? ""))) return false;
-    if (!DIGEST.test(String(handle.sha256 ?? ""))) return false;
-    if (!REVISION.test(String(handle.revision ?? ""))) return false;
+    if (!exactKeys(handle, ["nodeId", "title", "sha256", "repository", "revision", "path",
+      "kind", "admission", "candidateState", "contentAccess", "authority"], ["quantDomain"])) return false;
+    if (!matches(handle.nodeId, HANDLE_ID)) return false;
+    if (!matches(handle.sha256, DIGEST) || !matches(handle.revision, REVISION)) return false;
     if (!SOURCE_REPOSITORIES.has(handle.repository)) return false;
+    if (!HANDLE_KINDS.has(handle.kind)) return false;
+    if (!safeTitle(handle.title) || !safePath(handle.path)) return false;
+    if (!HANDLE_ADMISSIONS.has(handle.admission)) return false;
+    if (Object.hasOwn(handle, "quantDomain") && !safeDomain(handle.quantDomain)) return false;
+    if (handle.kind === "quant-domain" && !safeDomain(handle.quantDomain)) return false;
     if (handle.candidateState !== "DISCOVERED_REVIEW_REQUIRED") return false;
     if (handle.contentAccess !== "HANDLES_ONLY") return false;
     if (handle.authority !== "NONE") return false;
@@ -62,30 +95,61 @@
   }
 
   function validatePayload(payload) {
-    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+    if (!exactKeys(payload, ["schema", "state", "surface", "snapshot_sha256", "handles",
+      "selected_handle_count", "sources", "formula_atlas", "authority", "loop"])) return false;
     if (payload.schema !== "szl.a11oy.brain-frontier-holographic-v7/v1") return false;
     if (payload.state !== "SOURCE_BOUND_REVIEW_MEMORY") return false;
     if (payload.surface !== "A11OY_HOLOGRAPHIC_V7_BRAIN_FRONTIER") return false;
-    if (!DIGEST.test(String(payload.snapshot_sha256 ?? ""))) return false;
+    if (!matches(payload.snapshot_sha256, DIGEST)) return false;
     if (!Array.isArray(payload.handles) || payload.handles.length !== 72) return false;
     if (!payload.handles.every(validateHandle)) return false;
+    if (new Set(payload.handles.map((handle) => handle.nodeId)).size !== 72) return false;
     const repositories = new Set(payload.handles.map((handle) => handle.repository));
     if (![...SOURCE_REPOSITORIES].every((repository) => repositories.has(repository))) return false;
     if (payload.selected_handle_count !== payload.handles.length) return false;
+    const kindCount = (kind) => payload.handles.filter((handle) => handle.kind === kind).length;
+    if (kindCount("formula-authority") !== 1 || kindCount("attributed-formula") !== 30
+      || kindCount("executable-formula") !== 21 || kindCount("quant-domain") !== 9) return false;
+    const domains = new Set(payload.handles.filter((handle) => handle.kind === "quant-domain")
+      .map((handle) => handle.quantDomain));
+    if (domains.size !== 9 || payload.handles.some((handle) => handle.quantDomain
+      && !domains.has(handle.quantDomain))) return false;
+    if (!Array.isArray(payload.loop) || payload.loop.length !== LOOP.length
+      || !payload.loop.every((step, index) => step === LOOP[index])) return false;
+    if (!exactKeys(payload.sources, ["second_brain", "anatomy", "formulas", "ouroboros"])) return false;
     const brain = payload.sources?.second_brain;
     const anatomy = payload.sources?.anatomy;
     const formula = payload.formula_atlas;
     const authority = payload.authority;
-    if (!brain || !REVISION.test(String(brain.revision ?? ""))) return false;
-    if (!DIGEST.test(String(brain.candidate_set_sha256 ?? ""))) return false;
-    if (!anatomy || anatomy.repository !== "szl-holdings/anatomy") return false;
-    if (!REVISION.test(String(anatomy.revision ?? ""))) return false;
-    if (!formula || formula.attributed_formula_count !== 30) return false;
+    if (!exactKeys(brain, ["repository", "revision", "candidate_set_sha256", "candidate_count",
+      "state_sha256", "candidate_file_sha256"])) return false;
+    if (brain.repository !== "szl-holdings/szl-second-brain" || !matches(brain.revision, REVISION)) return false;
+    if (![brain.candidate_set_sha256, brain.state_sha256, brain.candidate_file_sha256]
+      .every((digest) => matches(digest, DIGEST))) return false;
+    if (!Number.isSafeInteger(brain.candidate_count) || brain.candidate_count < 72) return false;
+    if (!exactKeys(anatomy, ["repository", "revision", "live_origin", "holographic_v7_path"])) return false;
+    if (anatomy.repository !== "szl-holdings/anatomy" || !matches(anatomy.revision, REVISION)) return false;
+    if (anatomy.live_origin !== "https://betterwithage-anatomy.hf.space"
+      || anatomy.holographic_v7_path !== "/api/anatomy/v1/holographic-v7") return false;
+    const formulas = payload.sources.formulas;
+    const ouroboros = payload.sources.ouroboros;
+    if (!exactKeys(formulas, ["repository", "revision"]) || formulas.repository !== "szl-holdings/szl-formulas"
+      || !matches(formulas.revision, REVISION)) return false;
+    if (!exactKeys(ouroboros, ["repository", "revision", "review_workflow"])
+      || ouroboros.repository !== "szl-holdings/szl-ouroboros" || !matches(ouroboros.revision, REVISION)
+      || ouroboros.review_workflow !== ".github/workflows/codex-frontier-review.yml") return false;
+    if (!exactKeys(formula, ["attributed_formula_count", "executable_formula_count", "quant_domain_count",
+      "locked_proven_formula_count", "f_number_to_executable_mapping", "lambda"])) return false;
+    if (formula.attributed_formula_count !== 30) return false;
     if (formula.executable_formula_count !== 21 || formula.quant_domain_count !== 9) return false;
     if (formula.locked_proven_formula_count !== 8) return false;
     if (formula.f_number_to_executable_mapping !== "UNKNOWN_NOT_INFERRED") return false;
     if (formula.lambda !== "CONJECTURE_1") return false;
-    if (!authority || authority.public_content_access !== "HANDLES_ONLY") return false;
+    if (!exactKeys(authority, ["public_content_access", "controller_content_access", "training", "promotion",
+      "execution", "merge", "provider_mutation", "private_graph_present", "raw_graph_nodes_admitted_to_gradients",
+      "human_review_required"])) return false;
+    if (authority.public_content_access !== "HANDLES_ONLY"
+      || authority.controller_content_access !== "NOT_EXPOSED_BY_A11OY_HOLOGRAPHIC") return false;
     if (authority.training !== "NONE" || authority.promotion !== "NONE") return false;
     if (authority.execution !== "NONE" || authority.merge !== "NONE") return false;
     if (authority.provider_mutation !== "NONE" || authority.private_graph_present !== false) return false;
@@ -94,10 +158,65 @@
     return true;
   }
 
+  function canonicalJson(value) {
+    // The validated schema has ASCII keys, Unicode scalar strings and safe integers only.
+    // This matches the materializer's sorted compact JSON encoded as UTF-8.
+    if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+    if (record(value)) return `{${Object.keys(value).sort().map((key) =>
+      `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+    return JSON.stringify(value);
+  }
+
+  async function verifySnapshot(payload) {
+    if (!validatePayload(payload) || !window.crypto?.subtle) return false;
+    const { snapshot_sha256: expected, ...body } = payload;
+    try {
+      const bytes = new TextEncoder().encode(canonicalJson(body));
+      if (bytes.byteLength > MAX_SNAPSHOT_BYTES) return false;
+      const digest = await window.crypto.subtle.digest("SHA-256", bytes);
+      const measured = [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+      return measured === expected;
+    } catch (_error) {
+      return false;
+    }
+  }
+
+  async function readSnapshot(response) {
+    if (!response.headers.get("content-type")?.split(";", 1)[0].trim().match(/^application\/json$/i)) {
+      throw new Error("SNAPSHOT_CONTENT_TYPE_REJECTED");
+    }
+    if (!response.body) throw new Error("SNAPSHOT_BODY_UNAVAILABLE");
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        size += value.byteLength;
+        if (size > MAX_SNAPSHOT_BYTES) throw new Error("SNAPSHOT_SIZE_REJECTED");
+        chunks.push(value);
+      }
+    } catch (error) {
+      await reader.cancel().catch(() => {});
+      throw error;
+    } finally {
+      reader.releaseLock();
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  }
+
   async function loadSnapshot() {
     if (state.loading) return;
     state.loading = true;
-    renderCards();
+    state.payload = null;
+    renderAll();
     const controller = new AbortController();
     const timer = window.setTimeout(() => controller.abort(), 9000);
     try {
@@ -112,8 +231,8 @@
         signal: controller.signal,
       });
       if (!response.ok) throw new Error(`HTTP_${response.status}`);
-      const payload = await response.json();
-      if (!validatePayload(payload)) throw new Error("SNAPSHOT_CONTRACT_REJECTED");
+      const payload = await readSnapshot(response);
+      if (!await verifySnapshot(payload)) throw new Error("SNAPSHOT_CONTRACT_REJECTED");
       state.payload = payload;
     } catch (_error) {
       state.payload = null;
@@ -325,7 +444,7 @@
       const kind = String(handle.kind || "");
       const root = kind.includes("formula") || kind === "quant-domain"
         ? rootPositions.get("formula")
-        : handle.repository === "szl-holdings/ouroboros"
+        : handle.repository === "szl-holdings/szl-ouroboros"
           ? rootPositions.get("loop")
           : handle.repository === "szl-holdings/anatomy"
             ? rootPositions.get("anatomy")

packages/inference/src/voters/khipu_gguf.py

@@ -124,7 +124,7 @@ def khipu_pin() -> Dict[str, Any]:
         "gpu_inference_endpoint": "ROADMAP",
         "forge_lab": "SNAPSHOT",
         "forge_lab_role": "not a trainer, not Serve Studio",
-        "energy_attested_runs": "8/8 SIMULATED",
+        "energy_attested_runs": "UNAVAILABLE",
         "killinchu_detector": "SIMULATED",
         "lambda": "Conjecture 1",
     }
@@ -169,7 +169,6 @@ def extract_lab_receipt(data: Dict[str, Any]) -> Dict[str, Any]:
         or receipt.get("sha256")
         or receipt.get("record_sha256")
         or provenance.get("record_sha256")
-        or data.get("id")
     )
     if not sha:
         sha = "UNKNOWN"

pages/console.html

@@ -6564,8 +6564,8 @@ window.warboard_init=warboard_init; window.warboard_all=warboard_all;
           +'<div class="hero-inner">'
           +'<p class="hero-eyebrow mono">GOVERNED-AI SUBSTRATE \u00b7 SZL HOLDINGS</p>'
           +'<h1 class="hero-h1">AI that <span class="hero-accent">signs its work</span><br>and refuses to lie.</h1>'
-          +'<p class="hero-sub">The auditable AI substrate for counter-UAS, maritime threat-intel, supply-chain and governance — built on measured-energy sovereign compute.</p>'
-          +'<div class="hero-counters" role="group" aria-label="live measured platform receipts">'
+          +'<p class="hero-sub">The auditable AI substrate for counter-UAS, maritime threat-intel, supply-chain and governance — built for energy-evidence-aware sovereign compute.</p>'
+          +'<div class="hero-counters" role="group" aria-label="platform evidence and runtime receipts">'
           +'<div class="hctr"><span class="hctr-k mono">ENERGY <em class="mlabel" id="hero-joules-tag">SAMPLE</em></span>'
           +'<span class="hctr-v mono" id="hero-joules" data-maturity="sample">\u2014 J/tok</span>'
           +'<span class="hctr-d">per-token energy \u00b7 NVML</span></div>'
@@ -15298,36 +15298,53 @@ window.warboard_init=warboard_init; window.warboard_all=warboard_all;
     };
     V['energyReceipts']={
       title:'Energy Receipts',
-      badge:'DSSE-SIGNED · KHIPU LAKE · UNAVAILABLE until GPU online',
-      sub:'Every governed inference through a11oy produces a signed energy receipt: '
-         +'measured_joules (or UNAVAILABLE), carbon_gco2eq, sci_score_gco2_per_call, '
-         +'methodology: GSF_SCI_ISO_21031_2024. All fields included in the DSSE-signed '
-         +'payload — offline verifiable. When GPU + meter offline: fields are present but '
-         +'null, labeled UNAVAILABLE. Never fabricated. Λ = Conjecture 1.',
+      badge:'HASH-CHAIN STRUCTURE · MEASUREMENT UNAVAILABLE · SIGNATURE UNAVAILABLE',
+      sub:'The endpoint reports JouleCharge payloads and a structural hash-chain verdict. Its current entry digest '
+         +'does not bind the top-level billing or freshness fields, and the endpoint exposes no signature. '
+         +'This view therefore never promotes a reported joule value to MEASURED. Source labels, dispositions, '
+         +'reasons, and digest presence remain explicitly reported diagnostics; measurement and authenticity evidence '
+         +'stay UNAVAILABLE. Never fabricated. '
+         +'Λ = Conjecture 1.',
       render: function(c){
         c.innerHTML='<div style="padding:1.5rem 2rem">';
-        _szlFetch('/api/a11oy/v1/energy/ledger').then(function(d){
-          var receipts=d.receipts||[];
+        getJSON('/api/a11oy/v1/energy/ledger').then(function(d){
+          if(!d||typeof d!=='object'||Array.isArray(d)) d={};
+          var receipts=Array.isArray(d.receipts)?d.receipts:[];
+          var chainOK=d.chain&&d.chain.ok===true;
+          var chainState=chainOK?'REPORTED OK':(d.chain&&d.chain.ok===false?'FAILED':'UNAVAILABLE');
           var html='<h2 style="font-family:var(--display);color:var(--teal);margin:0 0 .5rem">Energy Receipts</h2>';
           html+='<p style="color:var(--muted);font-size:.8rem;font-family:var(--mono);margin:0 0 1rem">'
-               +receipts.length+' receipts in Khipu lake · chain integrity: '+(d.chain&&d.chain.ok?'<span style="color:var(--teal)">OK</span>':'<span style="color:var(--err)">FAIL</span>')+'</p>';
+               +receipts.length+' entries · chain structure: <span>'+esc(chainState)+'</span> · authenticity: UNAVAILABLE · signature: UNAVAILABLE</p>';
           if(!receipts.length){
             html+='<div style="border:1px solid var(--gold-line);border-radius:8px;padding:1.2rem;color:var(--muted);font-family:var(--mono);font-size:.85rem">';
-            html+='<b style="color:var(--cream)">0 receipts</b> — sovereign GPU + meter are offline.<br>';
-            html+='When the meter is running, every inference turn mints a signed energy receipt here.';
+            html+='<b style="color:var(--cream)">0 entries returned</b> — no receipt decision or MEASURED joule evidence.<br>';
+            html+='A successful read establishes neither an active meter nor signature evidence.';
             html+='</div>';
           } else {
             receipts.slice(0,10).forEach(function(r){
               html+='<div style="border:1px solid var(--gold-line);border-radius:6px;padding:.7rem;margin-bottom:.5rem;font-family:var(--mono);font-size:.78rem">';
-              html+='<div style="display:flex;justify-content:space-between"><span style="color:var(--gold)">'+( r.receipt_id||r.digest||'receipt')+'</span>';
-              var lc=r.joules_label==='MEASURED'?'var(--teal)':r.joules_label==='UNAVAILABLE'?'var(--err)':'var(--warn)';
-              html+='<span style="color:'+lc+'">'+( r.joules_label||'UNAVAILABLE')+'</span></div>';
-              html+='<div style="color:var(--muted)">joules: '+(r.joules_measured_billable||r.measured_joules||'null')+' · gCO₂: '+(r.carbon_gco2eq||'null')+'</div>';
+              var receipt=(r&&r.receipt&&typeof r.receipt==='object')?r.receipt:{};
+              var decision=(receipt.decision&&typeof receipt.decision==='object')?receipt.decision:{};
+              var rawLabel=decision.joules_label;
+              var sourceLabel=(rawLabel==='MEASURED'||rawLabel==='SAMPLE'||rawLabel==='ESTIMATE')?rawLabel:'UNAVAILABLE';
+              var entryDigest=(r&&typeof r.entry_digest==='string'&&/^sha256:[0-9a-f]{64}$/i.test(r.entry_digest))?r.entry_digest:'';
+              var payloadDigest=(typeof receipt.payload_digest==='string'&&/^sha256:[0-9a-f]{64}$/i.test(receipt.payload_digest))?receipt.payload_digest:'';
+              var label='UNAVAILABLE';
+              var digestState=(entryDigest&&payloadDigest)?'REPORTED PRESENT':'UNAVAILABLE';
+              var joules='UNAVAILABLE';
+              var disposition=(r&&r.billable===true?'BILLABLE':(r&&r.billable===false?'REFUSED':'UNAVAILABLE'));
+              var reason=(r&&typeof r.reason==='string'&&r.reason)?r.reason:'UNAVAILABLE';
+              html+='<div style="display:flex;justify-content:space-between"><span style="color:var(--gold)">digest fields: '+esc(digestState)+'</span>';
+              var lc=label==='MEASURED'?'var(--teal)':label==='UNAVAILABLE'?'var(--err)':'var(--warn)';
+              html+='<span style="color:'+lc+'">'+esc(label)+'</span></div>';
+              html+='<div style="color:var(--muted)">joules: '+esc(joules)+' · upstream label (not admitted): '+esc(sourceLabel)
+                   +' · reported disposition: '+esc(disposition)+' · reported reason: '+esc(reason)
+                   +' · authenticity: UNAVAILABLE · signature: UNAVAILABLE</div>';
               html+='</div>';
             });
           }
           c.innerHTML='<div style="padding:1.5rem 2rem">'+html+'</div>';
-        }).catch(function(e){ c.innerHTML='<div style="padding:1.5rem 2rem;color:var(--err);font-family:var(--mono)">'+e+'</div>'; });
+        }).catch(function(e){ c.innerHTML='<div style="padding:1.5rem 2rem;color:var(--err);font-family:var(--mono)">'+esc((e&&e.message)||e)+'</div>'; });
       }
     };
     V['energyGrid']={
@@ -16000,7 +16017,7 @@ window.warboard_init=warboard_init; window.warboard_all=warboard_all;
      nav groups/items into .side at load (Investor WOW, Organ Substrate,
      Counter-UAS, Sovereignty, Formula Atlas, vertical packs, etc.). Rather
      than patch ~28 injectors, this ONE block runs LAST and rebuilds the
-     sidebar to a tight, decision-grade menu: 5 groups / 18 items.
+     sidebar to one tight, decision-grade menu with a single owner per item.
 
      Every removed view stays registered in window.VIEWS and remains reachable
      via deep-link (/console#<viewkey>) — only the visible menu is slimmed.
@@ -16018,26 +16035,7 @@ window.warboard_init=warboard_init; window.warboard_all=warboard_all;
       ["investor","\u25c7","Investor View"],
       ["mesh","\u22b9","Live System Map"]
     ]],
-    ["Operate", [
-      ["launcher","\u25a6","App Launcher"],
-      ["ask","\u2726","Ask & Act"],
-      ["demo","\u229e","Run a Demo"],
-      ["decision","\u25c8","Governed Decision"]
-    ]],
-    ["Build", [
-      ["llm","\u2687","Model Router"],
-      ["alloy","\u2697","Open-Weight Mesh"],
-      ["mcp","\u2699","Agent Tools"],
-      ["knowledge","\u2b21","Knowledge Ontology"],
-      ["genome","\u2b22","Genome"],
-      ["kbformulas","\u2211","Formulas"]
-    ]],
-    ["Observe", [
-      ["chain","\u26d3","Receipt Chain"],
-      ["evidence","\u2b21","Evidence Ledger"],
-      ["replay","\u25f7","Reasoning Replay"],
-      ["arena","\u229c","Eval Arena"]
-    ]],
+
     ["Operate", [
       ["launcher","\u25a6","App Launcher"],
       ["ask","\u2726","Ask & Act (demo)"],
@@ -16771,15 +16769,21 @@ window.a11oyInvestor = (function(){
     V.investor={
       title:'Investor View',
       badge:'DOCTRINE v11 · LOCKED',
-      sub:'Doctrine, the locked-8, one receipt you can verify, then diligence on a11oy.net. Λ = Conjecture 1 (advisory, gray, never a theorem, never a gate).',
+      sub:'Doctrine, the canonical locked-proven formula set, one receipt you can verify, then diligence on a11oy.net. Λ = Conjecture 1 (advisory, gray, never a theorem, never a gate).',
       render:async function(c){
         var empty = (window.emptyUnknownBlock||function(k,d){ return '<div class="empty-unknown"><span class="empty-unknown-k">'+k+'</span><span class="empty-unknown-d">'+d+'</span></div>'; });
+        async function readJSON(url){
+          if(window.getJSON) return await window.getJSON(url);
+          var response=await fetch(url,{method:'GET',headers:{'Accept':'application/json'},cache:'no-store',credentials:'same-origin'});
+          if(!response.ok) throw new Error('HTTP '+response.status);
+          return await response.json();
+        }
         c.innerHTML='<div class="card"><div class="card-h"><span class="card-t">Doctrine</span><span class="card-ep mono">v11 LOCKED</span></div>'
           +'<p>Every governed state change produces a hash-chained receipt. Signing is claimed only when persistent signer evidence is active and verification passes. Read paths never mint receipts.</p>'
           +'<p class="szl-lambda mono">Λ = Conjecture 1 · advisory, never green, never a theorem, never a gate.</p></div>'
-          +'<div class="card"><div class="card-h"><span class="card-t">Locked-proven</span><span class="card-ep mono">exactly 8</span></div>'
-          +'<p class="mono">{F1, F4, F7, F11, F12, F18, F19, F22}</p>'
-          +'<p class="muted">A proof of rigor, not a traction number. The locked count is not inflated.</p></div>'
+          +'<div class="card"><div class="card-h"><span class="card-t">Locked-proven</span><span class="card-ep mono" id="inv-locked-ep">UNAVAILABLE</span></div>'
+          +'<p class="mono" id="inv-locked-list">UNAVAILABLE</p>'
+          +'<p class="muted">A proof of rigor, not a traction number. Count and IDs render only from the doctrine endpoint.</p></div>'
           +'<div class="card"><div class="card-h"><span class="card-t">One receipt</span><span class="card-ep" id="inv-one-ep">probing</span></div>'
           +'<div id="inv-one-receipt">'+empty('UNKNOWN','live source unavailable')+'</div></div>'
           +'<div class="btns">'
@@ -16787,17 +16791,31 @@ window.a11oyInvestor = (function(){
           +'<a class="btn" href="https://a11oy.net" target="_blank" rel="noopener noreferrer">Open diligence on a11oy.net ↗</a>'
           +'</div>';
         try{
-          var L = await (window.getJSON||window.gjFast||fetch)('/api/a11oy/v1/wow/ledger?limit=1');
-          if(L && L.then) L = await L;
-          if(L && L.data) L = L.data;
+          var H=await readJSON('/api/a11oy/v1/honest');
+          if(H && H.data) H=H.data;
+          var lockedIds=H&&Array.isArray(H.locked_formula_ids)?H.locked_formula_ids:[];
+          var lockedCount=H&&H.locked_formula_count;
+          var canonicalLockedIds=['F1','F4','F7','F11','F12','F18','F19','F22'];
+          var idsCanonical=canonicalLockedIds.every(function(id){ return lockedIds.indexOf(id)!==-1; });
+          var honestValid=H&&H.doctrine==='v11'&&lockedCount===8&&lockedIds.length===8&&
+            lockedIds.every(function(id){ return typeof id==='string'; })&&(new Set(lockedIds)).size===8&&idsCanonical;
+          if(honestValid){
+            var lockedEp=document.getElementById('inv-locked-ep');
+            var lockedList=document.getElementById('inv-locked-list');
+            if(lockedEp) lockedEp.textContent=String(lockedCount)+' locked';
+            if(lockedList) lockedList.textContent='{'+lockedIds.join(', ')+'}';
+          }
+        }catch(_honestUnavailable){}
+        try{
+          var L = await readJSON('/api/a11oy/v1/wow/ledger?limit=1');
+          if(L && L.data) L=L.data;
           var rec=((L&&(L.receipts||L.items))||[])[0];
           var host=document.getElementById('inv-one-receipt');
           var ep=document.getElementById('inv-one-ep');
           if(rec && host){
             var id=rec.receipt_id||rec.hash||rec.id||'';
-            var st=rec.unsigned?'UNSIGNED':((rec.hash||rec.prev_hash)?'HASH-LINKED':'UNSIGNED');
-            host.innerHTML='<div class="row mono"><span class="badge b-teal">'+st+'</span><span>'+String(id).slice(0,48)+'</span></div>';
-            if(ep) ep.textContent='live ledger';
+            host.innerHTML='<div class="row mono"><span class="badge b-teal">REPORTED</span><span>reported id: '+esc(String(id).slice(0,48))+'</span></div>';
+            if(ep) ep.textContent='REPORTED';
           } else {
             if(ep) ep.textContent='UNAVAILABLE';
           }
@@ -17118,7 +17136,7 @@ window.a11oyInvestor = (function(){
 
 <script>
 /* try-khipu-panel — additive, Command-Center-ONLY "Try Khipu" panel.
-   Doctrine v11. Adds NO nav entry (tabs.json 139-tab gate is untouched) and no
+   Doctrine v11. Adds NO nav entry (the generated tab contract is untouched) and no
    new view key: it wraps V.command.render and appends itself to the Command
    Center body only. Deep links (?view=) are honored so it never mounts on a
    non-command surface (e.g. Investor View).
@@ -17128,13 +17146,13 @@ window.a11oyInvestor = (function(){
    Honesty rules enforced here:
      - lab_status is shown verbatim: READY / FAILED / UNAVAILABLE (probe did not
        resolve THIS request). Never a fabricated READY.
-     - elapsed_ms is MEASURED (server-side wall clock). Token counts are shown
-       only as the lab's own REPORTED usage. No throughput marketing number is
-       computed or displayed anywhere in this panel.
-     - signature is UNSIGNED unless the lab returns a real signature; the
-       receipt hash is shown as record_sha256, UNKNOWN when absent.
-     - the pinned GGUF digest is a SNAPSHOT (pin), GPU inference is ROADMAP,
-       energy attestation is 8/8 SIMULATED (never MEASURED without a live meter).
+     - elapsed_ms renders only with explicit MEASURED proxy-wall evidence.
+       Token counts render only with the lab's explicit REPORTED label.
+     - signature state and record_sha256 are upstream-reported fields only.
+       Receipt proof remains UNAVAILABLE without payload, key, and chain verification.
+     - the pinned GGUF digest is a SNAPSHOT (pin), GPU inference is ROADMAP.
+       Energy-attested run evidence is read from the status API and otherwise
+       remains UNAVAILABLE; the browser owns no numeric fallback.
      - the inference lab is a CPU inference lab: not a trainer, not Serve Studio,
        and Ask & Act is not a live control plane.
      - the proxy authenticates to the lab with the dummy Bearer not-a-secret;
@@ -17198,13 +17216,13 @@ window.a11oyInvestor = (function(){
       +'#'+HOST_ID+' .tk-note{font-family:ui-monospace,Menlo,monospace;font-size:10px;line-height:1.7;color:#8f8a7e;margin-top:.55rem}'
       +'#'+HOST_ID+' pre{white-space:pre-wrap;font-size:12px;line-height:1.6;color:#e8e2d4;margin:.4rem 0 0}'
       +'</style>'
-      +'<h2>Try Khipu <span id="tk-state">'+chip('PROBING','PROBING')+'</span></h2>'
+      +'<h2>Try Khipu <span id="tk-state">'+chip('UNAVAILABLE','UNAVAILABLE')+'</span></h2>'
       +'<p class="tk-sub">A same-origin proxy to the pinned CPU inference lab '
       +'(<code>'+esc(LOCKED_LAB_V1)+'</code>). This is an inference lab: '
       +'<b>not a trainer</b>, <b>not Serve Studio</b>, and Ask &amp; Act on this console is '
       +'<b>not a live control plane</b>. Prompts go to '
       +'<code>'+esc(CHAT_URL)+'</code>; posture comes from <code>'+esc(STATUS_URL)+'</code>. '
-      +'Throughput is not reported — we publish only what the lab measures.</p>'
+      +'Throughput is not reported — we display only what the proxy measures and the lab explicitly reports.</p>'
       +'<div class="tk-grid" id="tk-pin"></div>'
       +'<label class="tk-k" for="tk-prompt">PROMPT · CLAMPED SERVER-SIDE (max_tokens 32 · temperature 0)</label>'
       +'<textarea id="tk-prompt" placeholder="What is a khipu receipt?"></textarea>'
@@ -17215,15 +17233,23 @@ window.a11oyInvestor = (function(){
 
   function renderPin(d){
     var pin=(d&&d.pin)||{}, hon=(d&&d.honesty)||{}, doc=(d&&d.doctrine)||{};
-    var st=(d&&d.lab_status)||'UNAVAILABLE';
+    var rawStatus=d&&d.lab_status;
+    var st=(rawStatus==='READY'||rawStatus==='FAILED'||rawStatus==='UNAVAILABLE')?rawStatus:'UNAVAILABLE';
+    var energyRuns='UNAVAILABLE';
+    var lockedIds=Array.isArray(doc.locked_formula_ids)?doc.locked_formula_ids:[];
+    var canonicalLockedIds=['F1','F4','F7','F11','F12','F18','F19','F22'];
+    var idsCanonical=canonicalLockedIds.every(function(id){ return lockedIds.indexOf(id)!==-1; });
+    var doctrineValid=doc.version==='v11'&&doc.state==='LOCKED'&&doc.locked_formula_count===8&&lockedIds.length===8&&
+      (new Set(lockedIds)).size===8&&lockedIds.every(function(id){ return typeof id==='string'; })&&idsCanonical;
+    var lockedCount=doctrineValid?String(doc.locked_formula_count):'UNAVAILABLE';
     H('tk-state',chip(st,st,'lab posture read from '+STATUS_URL+' this request'));
     var cells=[
       ['LAB POSTURE',chip(st,st)+' '+chip(st==='READY'?'probe resolved':'no live probe','')],
       ['PINNED GGUF sha256','<span class="tk-v">'+esc(pin.gguf_sha256||'UNKNOWN')+'</span> '+chip('SNAPSHOT','SNAPSHOT')],
       ['GPU INFERENCE ENDPOINT',chip(pin.gpu_inference_endpoint||'ROADMAP','ROADMAP')+' '+chip('CPU lab only today','')],
-      ['ENERGY ATTESTED RUNS','<span class="tk-v">'+esc(hon.energy_attested_runs||pin.energy_attested_runs||'8/8 SIMULATED')+'</span> '+chip('SIMULATED','SIMULATED')+chip('not MEASURED — no live meter','')],
+      ['ENERGY ATTESTED RUNS','<span class="tk-v">'+esc(energyRuns)+'</span> '+chip('UNAVAILABLE','UNAVAILABLE')],
       ['LOCKED LAB v1','<span class="tk-v">'+esc(pin.locked_lab_v1||LOCKED_LAB_V1)+'</span>'],
-      ['DOCTRINE','<span class="tk-v">locked-'+esc(doc.locked_formulas!=null?doc.locked_formulas:8)+' &middot; \u039b='+esc(doc.lambda||'Conjecture 1')+'</span> '+chip('Conjecture 1','')]
+      ['DOCTRINE','<span class="tk-v">locked formulas '+esc(lockedCount)+' &middot; \u039b='+esc(doc.lambda||'Conjecture 1')+'</span> '+chip('Conjecture 1','')]
     ];
     H('tk-pin',cells.map(function(c){
       return '<div class="tk-cell"><div class="tk-k">'+esc(c[0])+'</div><div>'+c[1]+'</div></div>';
@@ -17231,7 +17257,7 @@ window.a11oyInvestor = (function(){
     H('tk-honesty','Lab role: '+esc(hon.forge_lab||pin.forge_lab_role||'CPU inference lab \u2014 not a trainer, not Serve Studio')
       +'<br>Ask &amp; Act: '+esc(hon.ask_and_act||'not a live control plane')
       +'<br>Auth: the proxy calls the lab with the dummy header <code>Bearer not-a-secret</code>; no repo or user token reaches the browser.'
-      +'<br>Throughput: not reported \u2014 token counts below are the lab\u2019s own REPORTED usage, elapsed time is MEASURED server-side.');
+      +'<br>Throughput: not derived. Usage and elapsed render only with explicit REPORTED / MEASURED API evidence.');
   }
 
   function renderUnavailable(msg){
@@ -17243,7 +17269,7 @@ window.a11oyInvestor = (function(){
       +'<div class="tk-cell"><div class="tk-k">PINNED GGUF sha256</div><div>'+chip('SNAPSHOT','SNAPSHOT')
       +' '+chip('UNKNOWN','UNKNOWN')+'</div></div>'
       +'<div class="tk-cell"><div class="tk-k">GPU INFERENCE ENDPOINT</div><div>'+chip('ROADMAP','ROADMAP')+'</div></div>'
-      +'<div class="tk-cell"><div class="tk-k">ENERGY ATTESTED RUNS</div><div class="tk-v">8/8 SIMULATED</div></div>');
+      +'<div class="tk-cell"><div class="tk-k">ENERGY ATTESTED RUNS</div><div class="tk-v">UNAVAILABLE</div></div>');
     H('tk-honesty','Lab role: CPU inference lab \u2014 not a trainer, not Serve Studio.'
       +'<br>Ask &amp; Act: not a live control plane.'
       +'<br>Auth: dummy header <code>Bearer not-a-secret</code> is used server-side only.'
@@ -17254,7 +17280,9 @@ window.a11oyInvestor = (function(){
     try{
       var r=await fetch(STATUS_URL,{headers:{accept:'application/json'}});
       if(!r.ok) throw new Error('HTTP '+r.status);
-      renderPin(await r.json());
+      var statusPayload=await r.json();
+      if(!statusPayload||typeof statusPayload!=='object'||Array.isArray(statusPayload)) throw new Error('malformed status response');
+      renderPin(statusPayload);
     }catch(e){ renderUnavailable(String(e&&e.message||e)); }
   }
 
@@ -17268,27 +17296,42 @@ window.a11oyInvestor = (function(){
       var r=await fetch(CHAT_URL,{method:'POST',headers:{'content-type':'application/json',accept:'application/json'},
         body:JSON.stringify({prompt:prompt,max_tokens:32,temperature:0})});
       var d={}; try{ d=await r.json(); }catch(e){ d={}; }
-      var st=d.lab_status||(r.ok?'READY':'FAILED');
-      var sig=d.signature||'UNSIGNED';
-      var rec=d.record_sha256||'UNKNOWN';
-      var usage=d.usage||{};
-      var el=(d.elapsed_ms!=null?d.elapsed_ms+' ms':'UNKNOWN');
-      var body=(d.ok&&d.text)?('<pre>'+esc(d.text)+'</pre>')
+      if(!d||typeof d!=='object'||Array.isArray(d)) d={};
+      var rawStatus=d.lab_status;
+      var st=(rawStatus==='READY'||rawStatus==='FAILED'||rawStatus==='UNAVAILABLE')?rawStatus:(r.ok?'UNAVAILABLE':'FAILED');
+      var responseOK=r.ok&&d.ok===true&&st==='READY';
+      var reportedSig=(responseOK&&(d.signature==='SIGNED'||d.signature==='UNSIGNED'))?d.signature:'UNAVAILABLE';
+      var sig=reportedSig==='UNSIGNED'?'UNSIGNED':'UNAVAILABLE';
+      var recordReported=responseOK&&typeof d.record_sha256==='string'&&/^[0-9a-f]{64}$/i.test(d.record_sha256);
+      var rec=recordReported?d.record_sha256:'UNAVAILABLE';
+      var recordLabel=recordReported?'REPORTED':'UNAVAILABLE';
+      var usage=(d.usage&&typeof d.usage==='object'&&!Array.isArray(d.usage))?d.usage:{};
+      function validTokenCount(v){ return typeof v==='number'&&Number.isFinite(v)&&v>=0&&Number.isInteger(v); }
+      var usageAvailable=responseOK&&d.usage_label==='REPORTED'&&validTokenCount(usage.prompt_tokens)&&
+        validTokenCount(usage.completion_tokens)&&validTokenCount(usage.total_tokens);
+      var usageLabel=usageAvailable?'REPORTED':'UNAVAILABLE';
+      var elapsedMeasured=responseOK&&d.elapsed_ms_label==='MEASURED'&&d.elapsed_ms_source==='PROXY_WALL'&&
+        typeof d.elapsed_ms==='number'&&Number.isFinite(d.elapsed_ms)&&d.elapsed_ms>=0;
+      var elapsedLabel=elapsedMeasured?'MEASURED':'UNAVAILABLE';
+      var el=elapsedMeasured?d.elapsed_ms+' ms':'UNAVAILABLE';
+      var body=(responseOK&&typeof d.text==='string'&&d.text)?('<pre>'+esc(d.text)+'</pre>')
         :('<p class="tk-note">No completion returned \u2014 shown honestly as '+esc(st)+', nothing fabricated.'
           +(d.error?(' Lab detail: '+esc(String(d.error).slice(0,200))):'')+'</p>');
       H('tk-out',body
         +'<div class="tk-grid">'
-        +'<div class="tk-cell"><div class="tk-k">LAB RESULT</div><div>'+chip(st,st)+' '+chip(d.ok?'ok':'no completion','')+'</div></div>'
-        +'<div class="tk-cell"><div class="tk-k">SIGNATURE</div><div>'+chip(sig,sig==='UNSIGNED'?'UNAVAILABLE':sig)
-        +'<div class="tk-v">'+(sig==='UNSIGNED'?'no in-image signing key in this runtime \u2014 honest UNSIGNED':'as returned by the lab')+'</div></div></div>'
-        +'<div class="tk-cell"><div class="tk-k">record_sha256</div><div class="tk-v">'+esc(rec)+'</div></div>'
+        +'<div class="tk-cell"><div class="tk-k">LAB RESULT</div><div>'+chip(st,st)+' '+chip(responseOK?'ok':'no completion','')+'</div></div>'
+        +'<div class="tk-cell"><div class="tk-k">SIGNATURE</div><div>'+chip(sig,'UNAVAILABLE')
+        +'<div class="tk-v">'+(sig==='UNSIGNED'?'upstream reports UNSIGNED; receipt verification remains unavailable':'no verified signature evidence returned')+'</div></div></div>'
+        +'<div class="tk-cell"><div class="tk-k">RECORD HASH FIELD</div><div class="tk-v">'+esc(rec)+'</div>'
+        +'<div>'+chip(recordLabel,recordLabel,'upstream-reported and format-checked only; not cryptographically verified')+'</div></div>'
         +'<div class="tk-cell"><div class="tk-k">ELAPSED</div><div class="tk-v">'+esc(el)+'</div>'
-        +'<div>'+chip(d.elapsed_ms_label||'MEASURED','MEASURED','server-side wall clock for this request')+'</div></div>'
+        +'<div>'+chip(elapsedMeasured?'MEASURED ELAPSED':'ELAPSED UNAVAILABLE',elapsedLabel,'proxy wall clock for this request')
+        +chip('RECEIPT UNAVAILABLE','UNAVAILABLE','no payload, verification key, or chain proof is available to this proxy')+'</div></div>'
         +'<div class="tk-cell"><div class="tk-k">USAGE (LAB-REPORTED)</div><div class="tk-v">prompt '
-        +esc(usage.prompt_tokens!=null?usage.prompt_tokens:'\u2014')+' &middot; completion '
-        +esc(usage.completion_tokens!=null?usage.completion_tokens:'\u2014')+' &middot; total '
-        +esc(usage.total_tokens!=null?usage.total_tokens:'\u2014')+'</div><div>'
-        +chip(d.usage_label||'REPORTED','')+chip('no throughput number derived','')+'</div></div>'
+        +esc(usageAvailable?usage.prompt_tokens:'\u2014')+' &middot; completion '
+        +esc(usageAvailable?usage.completion_tokens:'\u2014')+' &middot; total '
+        +esc(usageAvailable?usage.total_tokens:'\u2014')+'</div><div>'
+        +chip(usageLabel,usageLabel)+chip('no throughput number derived','')+'</div></div>'
         +'<div class="tk-cell"><div class="tk-k">\u039b</div><div>'+chip((d.honesty&&d.honesty.lambda)||'Conjecture 1','')
         +'<div class="tk-v">advisory \u2014 gray, never green, never a theorem</div></div></div>'
         +'</div>');
@@ -17342,4 +17385,3 @@ window.a11oyInvestor = (function(){
   <script src="/assets/szl-holo-v2.js" defer data-szl-holo-asset="script-v2"></script>
 </body>
 </html>
-

szl3d_holographic.py

@@ -627,6 +627,14 @@ def register(app, ns: str = "a11oy") -> Dict[str, Any]:
         )
         _front_move(route)
         registered.append(f"GET,HEAD {route}")
+        app.add_api_route(
+            route + "/",
+            _shell,
+            methods=["GET", "HEAD"],
+            include_in_schema=False,
+        )
+        _front_move(route + "/")
+        registered.append(f"GET,HEAD {route}/")
 
     async def _info():
         return JSONResponse(info(ns))

szl_elite_console.py

@@ -4,7 +4,7 @@
 # Co-Authored-By: Perplexity Computer Agent <agent@perplexity.ai>
 # Signed-off-by: Stephen P. Lutar Jr. <stephenlutar2@gmail.com>
 """
-szl_elite_console — New endpoints backing the 20-tab a11oy Elite Console.
+szl_elite_console — Backend endpoints plus a quarantined frontend route.
 
 Adds 8 new backend surfaces (ADDITIVE, no existing routes touched):
 
@@ -17,10 +17,9 @@ Adds 8 new backend surfaces (ADDITIVE, no existing routes touched):
   GET  /api/a11oy/v1/console/verdict-theater — last-N multi-party witnessed verdicts
   GET  /api/a11oy/v1/console/policy-canvas   — full 46-gate policy canvas for drag-n-drop viz
 
-All endpoints are REAL: they read live in-process state (audit ring, DAG, gate manifest,
-formula index). No fixture data is injected.
-
-Doctrine v11 LOCKED — 749/14/163 — c7c0ba17 · Λ = Conjecture 1 (NEVER a theorem).
+The dormant HTML frontend is not release-ready and /elite-console fails closed. API
+responses retain their own in-band labels; importing this module does not prove runtime
+freshness, source binding, or receipt validity. Λ = Conjecture 1 (NEVER a theorem).
 """
 from __future__ import annotations
 
@@ -476,19 +475,18 @@ def register(app: FastAPI, gates_list: list[dict], gates_by_name: dict[str, dict
             "note": "All 46 gates from the canonical gates_manifest.json. Drag-n-drop grouping for the Policy Canvas tab.",
         })
 
-    # ── /console route ────────────────────────────────────────────────────────
+    # ── /elite-console route ──────────────────────────────────────────────────
 
     @app.get("/elite-console")
-    async def elite_console_html() -> HTMLResponse:
-        """Serve the 20-tab elite console HTML."""
-        p = os.path.join(os.path.dirname(__file__), "web", "elite_console.html")
-        if not os.path.exists(p):
-            p = "/app/web/elite_console.html"
-        if os.path.exists(p):
-            with open(p, "r", encoding="utf-8") as fh:
-                content = fh.read()
-            return HTMLResponse(content)
-        return HTMLResponse("<h1>elite_console.html not found</h1>", status_code=404)
+    async def elite_console_unavailable() -> HTMLResponse:
+        """Fail closed while the dormant frontend lacks release-grade contracts."""
+        return HTMLResponse(
+            "<h1>Elite Console: UNAVAILABLE</h1>"
+            "<p>This quarantined surface is not release-ready. "
+            '<a href="/command">Open the reviewed Command Center</a>.</p>',
+            status_code=503,
+            headers={"Cache-Control": "no-store"},
+        )
 
     return {
         "module": "szl_elite_console",