chore(sync): mirror backend .py + Dockerfile to Space (hf-sync-backend)

Automated backend sync from szl-holdings/a11oy main via hf-sync-backend.
Updated (differed from the Space): Dockerfile, a11oy_nav_wireup.py, serve.py
Deleted (gone from the repo + Dockerfile COPY set): (none)

Keeps the Space-built backend (serve.py + the Dockerfile-COPY'd .py
modules) identical to GitHub main so the Space never rebuilds from a
stale backend, new endpoints don't 404 there, and orphaned modules
removed from the repo don't linger in the Space tree.

Dockerfile

@@ -364,6 +364,15 @@ COPY web/holo.html ./web/holo.html
 COPY web/constitution.html ./web/constitution.html
 COPY web/quant.html ./web/quant.html
 COPY web/estate-hologram.html ./web/estate-hologram.html
+# WARHACKER SHOWCASE PAGES (demo lane, 2026-06-14): two PUBLIC companion pages served
+# at /signature-is-not-proof and /defense-readiness (+ /a11oy/* aliases) via _ptg_serve.
+# System fonts, 0 runtime CDN, no external scripts; live claims fetch real a11oy
+# endpoints with an honest NO-LIVE-DATA fallback. image-only like the other web/*.html
+# demo pages (declared in copy-sync-lockstep.json image_only_assets; baked into the
+# GitHub-built image, live after a factory rebuild + direct Space push). Without these
+# COPYs the routes 404 to the SPA shell.
+COPY web/signature-is-not-proof.html ./web/signature-is-not-proof.html
+COPY web/defense-readiness.html ./web/defense-readiness.html
 # ADDITIVE (Lane A AGENTIC CORE, Dev A, 2026-06-14; QA9 restore 2026-06): the
 # resumable ReAct agent-loop core module. Per-file COPY (this Dockerfile uses no
 # COPY . .). a11oy_react_core.py is imported by serve.py (try/except guarded) and

a11oy_nav_wireup.py

@@ -53,6 +53,10 @@ _SURFACES = [
     # ladder) + its two-arm benchmark. Honest labels; no codenames.
     ("/restraint",       "\u27C2", "Restraint (Governed Frugality)"),  # ⟂ (perp)
     ("/restraint-bench", "\u2696", "Restraint Benchmark"),            # ⚖
+    # WarHacker showcase (demo lane, 2026-06-14): two PUBLIC companion pages.
+    # Honest labels; no codenames; 0 CDN. Served via _ptg_serve in serve.py.
+    ("/signature-is-not-proof", "\u26A0", "Signature ≠ Proof (case study)"),  # ⚠
+    ("/defense-readiness",      "\u2691", "Defense Readiness"),                 # ⚑
 ]
 
 # Idempotency marker for the nav-group injection.

serve.py

@@ -1197,6 +1197,25 @@ try:
     app.add_api_route("/restraint-bench", _ptg_serve("restraint-bench.html"), methods=["GET"], include_in_schema=False)
     app.add_api_route("/a11oy/restraint-bench", _ptg_serve("restraint-bench.html"), methods=["GET"], include_in_schema=False)
 
+    # WARHACKER SHOWCASE PAGES (demo lane, 2026-06-14): two PUBLIC companion pages for
+    # the June 16-19 WarHacker demo. Standalone sovereign pages (system fonts, 0 runtime
+    # CDN, no external scripts). Where a claim can be proven LIVE they fetch a real
+    # a11oy production endpoint (/api/a11oy/v1/{pinn/certificate,compliance,pnt/limits},
+    # /elite, /elite-console) with an HONEST NO-LIVE-DATA fallback — never a fabricated
+    # value. Every maturity claim is labelled LIVE-today vs MODELED/ROADMAP (doctrine v11).
+    #   /signature-is-not-proof — the "A Signature Is Not Proof of Safety" case study
+    #                             (Mini Shai-Hulud May 2026; the 5 a11oy mechanisms).
+    #   /defense-readiness      — federal/allied pathway FIT + honest maturity summary
+    #                             (DARPA PINPOINT, JIATF 401, NATO DIANA, AFWERX); no
+    #                             private submission content exposed.
+    # image-only like the other web/*.html demo pages (per-file Dockerfile COPY +
+    # copy-sync-lockstep.json image_only_assets); pushed direct-to-Space so they are
+    # live immediately. Without the COPYs the routes 404 to the SPA shell.
+    app.add_api_route("/signature-is-not-proof", _ptg_serve("signature-is-not-proof.html"), methods=["GET"], include_in_schema=False)
+    app.add_api_route("/a11oy/signature-is-not-proof", _ptg_serve("signature-is-not-proof.html"), methods=["GET"], include_in_schema=False)
+    app.add_api_route("/defense-readiness", _ptg_serve("defense-readiness.html"), methods=["GET"], include_in_schema=False)
+    app.add_api_route("/a11oy/defense-readiness", _ptg_serve("defense-readiness.html"), methods=["GET"], include_in_schema=False)
+
     # /chat + /a11oy/chat -> /code consolidation (founder-directed; the only removal).
     async def _ptg_chat_to_code() -> Response:
         return _PTG_Redirect(url="/code", status_code=302)