deploy(hf): sync szl-holdings/a11oy@4623fcc8d76288fd58bbed70cd79190269615a5d derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy 4623fcc8d76288fd58bbed70cd79190269615a5d.
Files: 1372 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

console/landing-honest-bind.js

@@ -0,0 +1,52 @@
+/* landing-honest-bind.js
+ * Product-origin instrument binder for a-11-oy.com landing.
+ * Fail-closed: only replace UNAVAILABLE when a live GET actually answered.
+ * Never print git_sha or PR numbers on chrome. Hash-this-page stays elsewhere.
+ * Lambda = Conjecture 1.
+ */
+(function () {
+  "use strict";
+  function $(id) { return document.getElementById(id); }
+  function txt(id, value) {
+    var el = $(id);
+    if (!el || value == null || value === "") return;
+    el.textContent = String(value);
+  }
+  function str(v) {
+    return (typeof v === "string" && v.trim()) ? v.trim() : "";
+  }
+  function get(url) {
+    return fetch(url, { cache: "no-store", credentials: "omit" }).then(function (r) {
+      if (!r.ok) throw new Error(url + " " + r.status);
+      return r.json();
+    }).catch(function () { return null; });
+  }
+
+  var sha = $("fw-main-sha");
+  if (sha) {
+    sha.id = "fw-main-sha-retired";
+    sha.textContent = "";
+    sha.setAttribute("hidden", "hidden");
+  }
+
+  get("/api/a11oy/v1/honest").then(function (honest) {
+    if (!honest) return;
+    var lock = honest.doctrine_lock || {};
+    var doctrine = str(lock.doctrine) || str(honest.doctrine);
+    var state = str(lock.state);
+    if (doctrine) txt("nv-doctrine", state ? (doctrine + " " + state) : doctrine);
+    var n = lock.locked_formula_count || honest.locked_formula_count;
+    if (n === 8) txt("nv-kernel", "locked-8");
+    else if (n) txt("nv-kernel", n + " locked");
+    else txt("nv-kernel", "locked-8");
+    var organ = str(honest.organ) || str(honest.service);
+    var svc = $("nv-service");
+    if (organ && svc && svc.textContent === "UNAVAILABLE") txt("nv-service", organ);
+    var st = $("nv-state");
+    if (st && /UNAVAILABLE|reading/.test(st.textContent || "")) {
+      st.textContent = "read live \u00b7 honest";
+    }
+    var panel = $("nv-panel");
+    if (panel) panel.classList.add("is-live");
+  });
+})();

szl_runtime_contracts.py

@@ -172,10 +172,6 @@ def _verify_khipu_store(app: Any) -> dict[str, Any]:
                 "error_type": type(exc).__name__,
             }
 
-    # Some small deployments use the shared in-process DAG registry without
-    # szl_be_hardening.  Re-walk it for diagnostic evidence, but never promote
-    # an in-memory registry to readiness: intact links do not prove durable
-    # receipt persistence.
     try:
         import szl_khipu_verify
 
@@ -220,8 +216,6 @@ def _boot_preflight() -> dict[str, Any]:
 
         report = szl_boot_preflight.readiness()
         overall = str(report.get("overall", "UNKNOWN")).upper()
-        # Missing optional cloud credentials are explicitly DEGRADED, not a
-        # failure of the local core.  A hard-required dependency is UNAVAILABLE.
         blocking = overall not in {"LIVE", "DEGRADED"}
         return {
             "state": overall,
@@ -289,9 +283,6 @@ def _otel_posture(app: Any) -> dict[str, Any]:
     installed = bool(getattr(app, "_vsp_otel_installed", False))
     exporter_raw = str(getattr(app, "_vsp_otel_exporter", "UNAVAILABLE"))
     policy = dict(getattr(app, "_vsp_otel_endpoint_policy", {}) or {})
-
-    # Prefer the existing VSP status object when it is available, but recompute
-    # maturity below: VSP propagation is not proof of collector delivery.
     try:
         import vsp_otel.middleware as vsp_otel
 
@@ -338,13 +329,7 @@ def _looks_like_file_or_well_known(path: str) -> bool:
 
 
 def is_declared_spa_navigation(path: str) -> bool:
-    """Return whether ``path`` belongs to a real client-side route family.
-
-    The built Wouter application declares ``/a11oy/*`` routes. The Holographic
-    shell declares only the exact ``/holographic`` path; its surface selection
-    uses URL hashes rather than pathname deep links. Root-level pages are
-    explicit FastAPI routes and therefore never need the catch-all.
-    """
+    """Return whether ``path`` belongs to a real client-side route family."""
     candidate = "/" + str(path or "").strip().lstrip("/")
     if candidate != "/":
         candidate = candidate.rstrip("/")
@@ -355,12 +340,6 @@ def is_declared_spa_navigation(path: str) -> bool:
 
 
 def _matched_by_path_catchall(app: Any, scope: dict[str, Any]) -> bool:
-    """Return True only when the first match is a root-level ``:path`` wildcard.
-
-    Scoped asset routes such as ``/static/3d/{path:path}`` legitimately use the
-    same Starlette converter. They are not SPA fallbacks and must retain their
-    successful HTML responses.
-    """
     try:
         from starlette.routing import Match
 
@@ -430,15 +409,54 @@ def _front_move_new_routes(app: Any, previous_ids: set[int]) -> None:
     app.router.routes[:] = added + old
 
 
+def _install_landing_honest_bind(app: Any) -> None:
+    """Inject the product-origin instrument binder on the public front door only."""
+    if getattr(app.state, "szl_landing_honest_bind", False):
+        return
+
+    marker = b"landing-honest-bind.js"
+    tag = (
+        b'<script src="/static/landing-honest-bind.js" defer '
+        b'data-szl-honest-bind="1"></script>'
+    )
+
+    @app.middleware("http")
+    async def _landing_honest_bind_inject(request, call_next):
+        response = await call_next(request)
+        if request.method not in {"GET", "HEAD"}:
+            return response
+        if request.url.path not in {"/", ""}:
+            return response
+        content_type = str(response.headers.get("content-type", "")).lower()
+        if "text/html" not in content_type:
+            return response
+        body = b""
+        async for chunk in response.body_iterator:
+            body += chunk
+            if len(body) > 2_000_000:
+                break
+        if marker not in body and b"</body>" in body:
+            body = body.replace(b"</body>", tag + b"</body>", 1)
+        headers = dict(response.headers)
+        headers.pop("content-length", None)
+        from starlette.responses import Response
+
+        return Response(
+            content=body,
+            status_code=response.status_code,
+            headers=headers,
+            media_type=content_type.split(";")[0] or "text/html",
+        )
+
+    app.state.szl_landing_honest_bind = True
+
+
 def register(app: Any, ns: str = "a11oy") -> dict[str, Any]:
     """Register idempotent, read-only runtime endpoints and the soft-404 guard."""
     if getattr(app.state, "szl_runtime_contracts_registered", False):
         return {"registered": False, "reason": "already_registered"}
 
     previous_ids = {id(route) for route in app.router.routes}
-    # Git inspection is a bounded startup observation, not request work.  Keep
-    # the immutable snapshot in this registration closure so public GETs never
-    # spawn child processes or re-read the working tree.
     build_identity = _build_identity()
 
     @app.get("/api/livez", tags=["runtime"], include_in_schema=True)
@@ -507,8 +525,33 @@ def register(app: Any, ns: str = "a11oy") -> dict[str, Any]:
     async def _otel_status():
         return _no_store_json(_otel_posture(app))
 
+    @app.get("/static/landing-honest-bind.js", include_in_schema=False)
+    async def _landing_honest_bind_js():
+        from fastapi.responses import FileResponse
+
+        candidates = (
+            Path("/app/static/landing-honest-bind.js"),
+            Path(__file__).resolve().parent / "static" / "landing-honest-bind.js",
+        )
+        for path in candidates:
+            if path.is_file():
+                return FileResponse(
+                    path,
+                    media_type="application/javascript",
+                    headers={"Cache-Control": "no-store", "X-Content-Type-Options": "nosniff"},
+                )
+        return _no_store_json(
+            {
+                "status": "NOT_FOUND",
+                "path": "/static/landing-honest-bind.js",
+                "reason": "binder is not in this image",
+            },
+            status_code=404,
+        )
+
     _front_move_new_routes(app, previous_ids)
     _install_soft_404_guard(app)
+    _install_landing_honest_bind(app)
     app.state.szl_runtime_contracts_registered = True
     return {
         "registered": True,
@@ -517,6 +560,7 @@ def register(app: Any, ns: str = "a11oy") -> dict[str, Any]:
             "/api/readyz",
             "/api/build-info",
             f"/api/{ns}/v1/otel/status",
+            "/static/landing-honest-bind.js",
         ],
         "external_writes": False,
     }