Spaces:

SZLHOLDINGS
/

a11oy

Running

App Files Files Community

betterwithage Claude Opus 4.7 commited on 21 days ago

Commit

424636b

verified ·

1 Parent(s): cca3499

deploy(hf): sync szl-holdings/a11oy@main derived COPY set

Browse files

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy main.
Files: 1138 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Files changed (2) hide show

pages/hatun-mcp.html +67 -57
web/immune.html +134 -43

pages/hatun-mcp.html CHANGED Viewed

@@ -9,7 +9,7 @@ a{color:var(--gold);text-decoration:none}a:hover{text-decoration:underline}
 header{border-bottom:1px solid var(--line);padding:14px 22px;display:flex;align-items:center;gap:14px;background:linear-gradient(180deg,#10121b,#0a0b10)}
 header .brand{font-weight:700;letter-spacing:.5px;color:var(--gold);font-size:18px}
 header .tag{color:var(--mut);font-size:12px}
-nav{display:flex;flex-wrap:wrap;gap:8px;padding:10px 22px;border-bottom:1px solid var(--line);background:var(--panel)}
 nav a{font-size:12.5px;padding:4px 10px;border:1px solid var(--line);border-radius:999px;color:var(--mut)}
 nav a:hover{border-color:var(--gold);color:var(--gold);text-decoration:none}
 nav a.active{background:var(--gold);color:#0a0b10;border-color:var(--gold);font-weight:600}
@@ -22,6 +22,8 @@ h1{font-size:26px;margin:0 0 4px;color:#fff}h2{font-size:18px;margin:28px 0 10px
 .grid a.tile:hover{border-color:var(--gold);text-decoration:none}
 .grid a.tile .t{color:var(--gold);font-weight:600;margin-bottom:4px}.grid a.tile .d{color:var(--mut);font-size:12.5px}
 table{width:100%;border-collapse:collapse;margin:12px 0;font-size:13.5px}
 th,td{text-align:left;padding:8px 10px;border-bottom:1px solid var(--line);vertical-align:top}
 th{color:var(--mut);font-weight:600;font-size:12px;text-transform:uppercase;letter-spacing:.4px}
 code,pre{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12.5px}
@@ -35,12 +37,22 @@ footer{border-top:1px solid var(--line);color:var(--mut);font-size:11.5px;paddin
 .statline b{color:var(--ink)}
 .tag2{display:inline-block;background:#1c2030;color:var(--mut);border:1px solid var(--line);border-radius:6px;padding:1px 7px;font-size:11px;margin-left:6px}
 .st{color:var(--amb);font-weight:600}
 </style></head><body>
 <header><span class="brand">a11oy</span><span class="tag">Brand Orchestration Layer · the one place to see everything</span></header>
 <nav><a href="/hub">Hub</a><a href="/a11oy.code">a11oy.code</a><a href="/docs">Docs</a><a href="/pricing">Pricing</a><a href="/api-keys">API Keys</a><a href="/sdk">SDK</a><a href="/status">Status</a><a href="/hatun-mcp" class="active">Hatun-MCP</a><a href="/observability">Observability</a><a href="/security">Security</a><a href="/compliance">Compliance</a><a href="/cued-engagement">Cued Engagement</a><a href="/uds">UDS</a><a href="/counter-uas">Counter-UAS</a><a href="/evidence">Evidence</a><a href="/upgrades">Upgrades</a><a href="/audit">Audit</a><a href="/gap-report">Gap Report</a></nav>
 <main>
 <h1>Hatun-MCP — agentic MCP server</h1>
-<p class="sub"><b>Hatun</b> (Quechua: <i>great / sovereign</i>) is the Model Context Protocol gateway that exposes SZL's governed flagship capabilities to any MCP client (Claude Desktop, Cursor, custom agents). Every tool invocation passes the Yuyay-13 governance gate and emits a signed Khipu receipt. Anonymous calls are governed-but-declined (OWASP MCP07) — provide an SZL API key to execute. This tab probes the live server directly from your browser.</p>
 <div class="card">
   <div class="statline">
@@ -50,20 +62,20 @@ footer{border-top:1px solid var(--line);color:var(--mut);font-size:11.5px;paddin
     <span>Protocol: <b id="proto">—</b></span>
     <span>Probe latency: <b id="lat">—</b></span>
   </div>
-  <p class="sub" style="margin:12px 0 0">Endpoint: <code>https://szlholdings-a11oy.hf.space/mcp/</code> (canonical, live, same-origin) · Transport: JSON-RPC over Streamable HTTP (<code>POST /mcp/</code>) · MCP revision <code>2024-11-05</code><br><b>Note:</b> the standalone hatun-mcp Space is retired; a11oy now serves the canonical MCP directly at <code>/mcp/</code>.</p>
 </div>
-<h2>Tools exposed (<span id="toolcount">16</span>)</h2>
-<p class="sub">Loaded live from the canonical <code>GET /mcp/</code> discovery card on this Space. These are the real governed tools exposed by the live MCP (call them with <code>POST /mcp/</code> JSON-RPC <code>tools/call</code>).</p>
-<table><thead><tr><th>Tool</th><th>Backend flagship</th><th>Class</th></tr></thead><tbody id="tools"></tbody></table>
 <h2>Recent invocations</h2>
-<p class="sub">Each MCP call appends a Khipu receipt (continuum hash + DSSE signature) to the governance chain. Recent receipts are summarized here from the server's invocation feed; if the feed endpoint is unreachable cross-origin it shows the honest interim message below.</p>
-<table><thead><tr><th>Time (UTC)</th><th>Tool</th><th>Outcome</th><th>Continuum hash</th></tr></thead><tbody id="inv"><tr><td colspan="4" class="sub">loading…</td></tr></tbody></table>
 <h2>Connect a client</h2>
 <div class="card">
-<p style="margin:0 0 8px">Claude Desktop — add to <code>claude_desktop_config.json</code> (uses the <code>mcp-remote</code> bridge, pointing at a11oy's live canonical <code>/mcp/</code>):</p>
 <pre>{
   "mcpServers": {
     "szl-a11oy": {
@@ -72,63 +84,61 @@ footer{border-top:1px solid var(--line);color:var(--mut);font-size:11.5px;paddin
     }
   }
 }</pre>
-<p class="sub" style="margin:8px 0 0">Quick test: <code>curl -s https://szlholdings-a11oy.hf.space/mcp/</code> (discovery card) or <code>curl -s -X POST https://szlholdings-a11oy.hf.space/mcp/ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'</code> · public key: <a href="/cosign.pub" target="_blank" rel="noopener">/cosign.pub</a> · try the loop: <a href="/ask-and-act">/ask-and-act</a></p>
 </div>
-<div class="note">This tab probes a11oy's own canonical, same-origin <code>/mcp/</code> endpoint — no cross-origin CORS, no dead Space. The tool list and protocol version below are read live from <code>GET /mcp/</code>.</div>
-<p class="sub">Source: szl_agentic_loop.py (canonical MCP + governed loop) · live probe of <code>/mcp/</code></p>
 <script>
-const BASE="";  // same-origin: a11oy serves the canonical /mcp/ directly
-// Static authoritative tool list (mirrors server-card.json); refreshed live below when CORS permits.
-const TOOLS=[
- ["szl_a11oy_code_chat","a11oy.code","read"],
- ["szl_killinchu_detect","vessels / killinchu","read"],
- ["szl_killinchu_cue","vessels / killinchu","2-person"],
- ["szl_sentra_scan","sentra","read"],
- ["szl_rosie_reason","rosie","read"],
- ["szl_khipu_verify","governance","read"],
- ["szl_lean_verify","lean / formal-verification","read"],
- ["szl_puriq_evaluate","puriq","read"],
- ["szl_yachay_dome_predict","yachay-dome","read"],
- ["szl_wayra_recent","wayra","read"],
- ["szl_anatomy_3d_render","anatomy","read"],
- ["szl_doctrine_lookup","governance / doctrine","read"],
- ["szl_yuyay_score","yuyay-v3","read"],
- ["szl_thesis_query","thesis","read"],
- ["szl_drone_lookup","uds / counter-uas","read"],
- ["szl_formula_evaluate","puriq / formal math","read"]];
-function paintTools(list){const tb=document.getElementById('tools');tb.innerHTML='';
- list.forEach(([n,b,c])=>{const tr=document.createElement('tr');
-  const cls=c==='2-person'?'a':'n';
-  tr.innerHTML=`<td><code>${n}</code></td><td>${b}</td><td><span class="pill ${cls}">${c}</span></td>`;tb.appendChild(tr);});
  document.getElementById('toolcount').textContent=list.length;}
-paintTools(TOOLS);
-// Live probe of the canonical, same-origin /mcp/ discovery card
 const t0=performance.now();
-fetch(BASE+"/mcp/").then(r=>r.json().then(j=>({r,j}))).then(({r,j})=>{
- const ms=Math.round(performance.now()-t0);
- document.getElementById('lat').textContent=ms+' ms';
- document.getElementById('health').innerHTML=(r.ok&&j.canonical)?'<span class="pill g">LIVE</span>':'<span class="pill a">'+r.status+'</span>';
- document.getElementById('signer').textContent='in-image ECDSA-P256 (see /cosign.pub)';
- document.getElementById('chain').textContent='hash-chained receipts ✓';
- document.getElementById('proto').textContent=j.protocolVersion||'—';
- // refresh the tool table from the live card's real governed tools
- if(j&&Array.isArray(j.tools)&&j.tools.length){
-   paintTools(j.tools.map(t=>[t.name, (t.title||'governed tool'), 'governed']));
  }
-}).catch(()=>{document.getElementById('health').innerHTML='<span class="pill r">unreachable</span>';});
-// Recent invocations feed (optional endpoint; honest fallback if absent/blocked)
-fetch(BASE+"/api/hatun/invocations",{mode:'cors'}).then(r=>r.ok?r.json():Promise.reject()).then(rows=>{
- const tb=document.getElementById('inv');tb.innerHTML='';
- if(!rows||!rows.length){tb.innerHTML='<tr><td colspan="4" class="sub">No recent invocations recorded.</td></tr>';return;}
- rows.slice(0,12).forEach(x=>{const tr=document.createElement('tr');
-  const ok=x.outcome==='success';
-  tr.innerHTML=`<td>${x.ts||'—'}</td><td><code>${x.tool||'—'}</code></td><td><span class="pill ${ok?'g':'a'}">${x.outcome||'—'}</span></td><td><code>${(x.continuum_hash||'').slice(0,16)}</code></td>`;tb.appendChild(tr);});
-}).catch(()=>{document.getElementById('inv').innerHTML='<tr><td colspan="4" class="sub">Run a governed agent at <a href="/ask-and-act">/ask-and-act</a> — each run produces a signed, hash-chained receipt you can re-verify in the browser (chain + signature). The MCP <code>tools/call</code> path drives the same governed pipeline.</td></tr>';});
 </script>
 </main>
-<footer>Doctrine v12 (PURIQ) additive · v11/v12 LOCKED: 749 declarations · 14 axioms · 163 sorries · 13-axis yuyay_v3 · lutar-v18.0.0 @ c7c0ba17 · SLSA L1 (honest) · Khipu signature = DSSE/cosign PLACEHOLDER<br>HfApi direct push only · IP-HOLD a11oy#57 untouched · ADDITIVE / zero-regression · Khipu receipt on every action · Signed <b>Yachay</b> · Co-author Perplexity Computer Agent</footer>
 </body></html>

 header{border-bottom:1px solid var(--line);padding:14px 22px;display:flex;align-items:center;gap:14px;background:linear-gradient(180deg,#10121b,#0a0b10)}
 header .brand{font-weight:700;letter-spacing:.5px;color:var(--gold);font-size:18px}
 header .tag{color:var(--mut);font-size:12px}
+nav{display:flex;flex-wrap:nowrap;gap:8px;padding:10px 22px;border-bottom:1px solid var(--line);background:var(--panel);overflow-x:auto;overscroll-behavior-inline:contain;scrollbar-width:thin}
 nav a{font-size:12.5px;padding:4px 10px;border:1px solid var(--line);border-radius:999px;color:var(--mut)}
 nav a:hover{border-color:var(--gold);color:var(--gold);text-decoration:none}
 nav a.active{background:var(--gold);color:#0a0b10;border-color:var(--gold);font-weight:600}
 .grid a.tile:hover{border-color:var(--gold);text-decoration:none}
 .grid a.tile .t{color:var(--gold);font-weight:600;margin-bottom:4px}.grid a.tile .d{color:var(--mut);font-size:12.5px}
 table{width:100%;border-collapse:collapse;margin:12px 0;font-size:13.5px}
+.table-wrap{width:100%;overflow-x:auto;overscroll-behavior-inline:contain;-webkit-overflow-scrolling:touch}
+.table-wrap table{min-width:620px}
 th,td{text-align:left;padding:8px 10px;border-bottom:1px solid var(--line);vertical-align:top}
 th{color:var(--mut);font-weight:600;font-size:12px;text-transform:uppercase;letter-spacing:.4px}
 code,pre{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12.5px}
 .statline b{color:var(--ink)}
 .tag2{display:inline-block;background:#1c2030;color:var(--mut);border:1px solid var(--line);border-radius:6px;padding:1px 7px;font-size:11px;margin-left:6px}
 .st{color:var(--amb);font-weight:600}
+@media(max-width:700px){
+ header{padding:12px 14px;align-items:flex-start;flex-direction:column;gap:2px}
+ nav{padding:9px 14px}
+ main{padding:20px 14px 44px}
+ h1{font-size:23px;line-height:1.25}
+ .card{padding:15px}
+ .statline{display:grid;grid-template-columns:1fr;gap:8px}
+ pre{white-space:pre-wrap;overflow-wrap:anywhere}
+ footer{padding:16px 14px}
+}
 </style></head><body>
 <header><span class="brand">a11oy</span><span class="tag">Brand Orchestration Layer · the one place to see everything</span></header>
 <nav><a href="/hub">Hub</a><a href="/a11oy.code">a11oy.code</a><a href="/docs">Docs</a><a href="/pricing">Pricing</a><a href="/api-keys">API Keys</a><a href="/sdk">SDK</a><a href="/status">Status</a><a href="/hatun-mcp" class="active">Hatun-MCP</a><a href="/observability">Observability</a><a href="/security">Security</a><a href="/compliance">Compliance</a><a href="/cued-engagement">Cued Engagement</a><a href="/uds">UDS</a><a href="/counter-uas">Counter-UAS</a><a href="/evidence">Evidence</a><a href="/upgrades">Upgrades</a><a href="/audit">Audit</a><a href="/gap-report">Gap Report</a></nav>
 <main>
 <h1>Hatun-MCP — agentic MCP server</h1>
+<p class="sub"><b>Hatun</b> (Quechua: <i>great / sovereign</i>) is the Model Context Protocol gateway for SZL capabilities. This page separates a reachable runtime declaration from execution and receipt evidence. A listed tool is not proof that it has run. Receipt and signer fields remain <b>UNKNOWN</b> or <b>UNAVAILABLE</b> until the read-only evidence endpoint observes an actual governed-run receipt.</p>
 <div class="card">
   <div class="statline">
     <span>Protocol: <b id="proto">—</b></span>
     <span>Probe latency: <b id="lat">—</b></span>
   </div>
+  <p class="sub" style="margin:12px 0 0">Runtime path: <code>/mcp/</code> (same origin) · Transport: JSON-RPC over HTTP (<code>POST /mcp/</code>). Availability, protocol revision, signer evidence, and receipt-chain evidence are populated only from successful reads below.</p>
 </div>
+<h2>Tools declared (<span id="toolcount">—</span>) <span id="toolsource" class="pill a">STATIC FALLBACK</span></h2>
+<p class="sub">The initial rows are an explicitly labelled static fallback. A successful <code>GET /mcp/</code> replaces them with the runtime-declared catalog. Neither state is execution proof.</p>
+<div class="table-wrap"><table><thead><tr><th>Tool</th><th>Description</th><th>Evidence class</th></tr></thead><tbody id="tools"></tbody></table></div>
 <h2>Recent invocations</h2>
+<p class="sub">This bounded, ephemeral feed contains only summaries of governed agent runs for which this process actually created a receipt. It does not claim that every MCP discovery or tool call is signed, and reading it never mints a receipt.</p>
+<div class="table-wrap"><table><thead><tr><th>Time (UTC)</th><th>Observed tool</th><th>Outcome</th><th>Receipt evidence</th></tr></thead><tbody id="inv"><tr><td colspan="4" class="sub">loading…</td></tr></tbody></table></div>
 <h2>Connect a client</h2>
 <div class="card">
+<p style="margin:0 0 8px">Claude Desktop — deployment example using the <code>mcp-remote</code> bridge. Verify the target URL and authentication requirements in your environment before use:</p>
 <pre>{
   "mcpServers": {
     "szl-a11oy": {
     }
   }
 }</pre>
+<p class="sub" style="margin:8px 0 0">Same-origin checks: <code>GET /mcp/</code> for runtime discovery, <code>GET /api/hatun/evidence</code> for the no-mint evidence contract, and <code>GET /api/hatun/invocations</code> for observed receipt summaries. A public-key path alone is not proof that any receipt was signed.</p>
 </div>
+<div class="note">The page performs read-only same-origin probes. <code>GET /mcp/</code> supplies runtime declarations; <code>GET /api/hatun/evidence</code> supplies observed receipt state. Neither GET signs, appends, or upgrades evidence.</div>
+<p class="sub">Source: <code>szl_agentic_loop.py</code> · read-only probes of <code>/mcp/</code> and <code>/api/hatun/evidence</code></p>
 <script>
+const BASE="";
+const FALLBACK_TOOLS=[
+ {name:"retrieve_context",description:"Governance-corpus retrieval declaration"},
+ {name:"policy_check",description:"Deny-by-default policy declaration"},
+ {name:"trust_score",description:"Advisory trust-score declaration"},
+ {name:"sign_receipt",description:"Receipt-signing declaration"},
+ {name:"verify_receipt",description:"Receipt-verification declaration"}
+];
+function cell(text,tag){const el=document.createElement(tag||'td');el.textContent=text==null?'—':String(text);return el;}
+function pill(text,cls){const el=document.createElement('span');el.className='pill '+cls;el.textContent=text;return el;}
+function setStatus(id,text,cls){const host=document.getElementById(id);host.textContent='';host.appendChild(pill(text,cls));}
+function paintTools(list,evidenceClass){const tb=document.getElementById('tools');tb.textContent='';
+ list.forEach(tool=>{const tr=document.createElement('tr');const name=cell(tool.name,'td');
+  const code=document.createElement('code');code.textContent=tool.name||'—';name.textContent='';name.appendChild(code);
+  tr.appendChild(name);tr.appendChild(cell(tool.description||tool.title||'No description reported'));
+  const status=cell('','td');status.appendChild(pill(evidenceClass,evidenceClass==='RUNTIME DECLARED'?'n':'a'));tr.appendChild(status);tb.appendChild(tr);});
  document.getElementById('toolcount').textContent=list.length;}
+paintTools(FALLBACK_TOOLS,'STATIC FALLBACK');
 const t0=performance.now();
+fetch(BASE+"/mcp/",{cache:'no-store'}).then(r=>r.json().then(j=>({r,j}))).then(({r,j})=>{
+ document.getElementById('lat').textContent=Math.round(performance.now()-t0)+' ms';
+ setStatus('health',r.ok?'REACHABLE':'HTTP '+r.status,r.ok?'g':'a');
+ document.getElementById('proto').textContent=j.protocolVersion||'UNKNOWN';
+ if(r.ok&&j&&Array.isArray(j.tools)){
+   paintTools(j.tools,'RUNTIME DECLARED');
+   const source=document.getElementById('toolsource');source.className='pill n';source.textContent='RUNTIME DECLARED';
  }
+}).catch(()=>{setStatus('health','UNAVAILABLE','r');document.getElementById('lat').textContent='UNAVAILABLE';});
+fetch(BASE+"/api/hatun/evidence",{cache:'no-store'}).then(r=>r.ok?r.json():Promise.reject()).then(e=>{
+ const signer=e&&e.signer||{};const chain=e&&e.receipt_chain||{};
+ document.getElementById('signer').textContent=signer.status==='OBSERVED_VERIFIED'?(signer.label||'OBSERVED_VERIFIED'):(signer.status||'UNKNOWN');
+ document.getElementById('chain').textContent=chain.status||'UNKNOWN';
+}).catch(()=>{document.getElementById('signer').textContent='UNAVAILABLE';document.getElementById('chain').textContent='UNAVAILABLE';});
+function paintEmptyInvocation(message){const tb=document.getElementById('inv');tb.textContent='';const tr=document.createElement('tr');
+ const td=cell(message,'td');td.colSpan=4;td.className='sub';tr.appendChild(td);tb.appendChild(tr);}
+fetch(BASE+"/api/hatun/invocations",{cache:'no-store'}).then(r=>r.ok?r.json():Promise.reject()).then(feed=>{
+ const items=feed&&Array.isArray(feed.items)?feed.items:[];const tb=document.getElementById('inv');tb.textContent='';
+ if(!items.length){paintEmptyInvocation('UNKNOWN — no governed-run receipt has been observed in this process.');return;}
+ items.slice(0,12).forEach(x=>{const tr=document.createElement('tr');tr.appendChild(cell(x.ts));
+  const tool=cell('','td'),code=document.createElement('code');code.textContent=x.tool||'—';tool.appendChild(code);tr.appendChild(tool);
+  const outcome=cell('','td');outcome.appendChild(pill(x.outcome||'UNKNOWN',x.outcome==='DENY'?'r':'a'));tr.appendChild(outcome);
+  const ev=cell('','td'),evCode=document.createElement('code');evCode.textContent=(x.signature_status||'UNKNOWN')+' · '+(x.receipt_hash||'').slice(0,16);ev.appendChild(evCode);tr.appendChild(ev);tb.appendChild(tr);});
+}).catch(()=>{paintEmptyInvocation('UNAVAILABLE — the read-only invocation feed could not be read.');});
 </script>
 </main>
+<footer>Doctrine v11 honesty boundary · tool catalog = runtime declaration, not execution proof · signer and receipt-chain state remain UNKNOWN or UNAVAILABLE until observed evidence exists · GET reads never mint receipts</footer>
 </body></html>

web/immune.html CHANGED Viewed

@@ -4,7 +4,7 @@
 <meta charset="UTF-8"/>
 <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
 <title>Immune (Hukulla) — fail-closed egress gate · SZL Holdings</title>
-<meta name="description" content="Live, honest view of the Immune organ (Quechua role 'Hukulla') — a fail-closed, deny-by-default egress gate. Real threat-signature scan + 1 MB size guard + Lambda-gate floor, every verdict signed into the shared Khipu chain. Lean backing: ImmuneNeymanPearsonOpt + FrontierWelfordVariance. Lambda = Conjecture 1; Khipu = Conjecture 2; trust never 100%."/>
 <!-- 0 runtime CDN (doctrine v11): system fonts only — no Google Fonts, no external assets. -->
 <style>
 :root{
@@ -26,7 +26,9 @@ a{color:inherit;text-decoration:none;}
 .topbar{position:sticky;top:0;z-index:60;display:flex;align-items:center;gap:1rem;flex-wrap:wrap;padding:.5rem 1.1rem;background:rgba(10,10,10,.92);backdrop-filter:blur(10px);border-bottom:1px solid var(--gold-line);font-family:var(--mono);font-size:10.5px;letter-spacing:.1em;text-transform:uppercase;color:var(--gold);}
 .topbar .sep{color:var(--dim);}
 .topbar .live{display:inline-flex;align-items:center;gap:.4rem;color:var(--cream);}
-.live-dot{width:6px;height:6px;border-radius:50%;background:var(--live);box-shadow:0 0 6px var(--live);animation:pulse 2.2s ease-in-out infinite;}
 @keyframes pulse{0%,100%{opacity:1;}50%{opacity:.35;}}
 .switcher{margin-left:auto;display:flex;align-items:center;gap:.3rem;}
 .flag{padding:.22rem .55rem;border-radius:6px;border:1px solid transparent;color:var(--muted);transition:.15s;}
@@ -37,12 +39,13 @@ h1{font-size:1.7rem;font-weight:600;margin:.2rem 0 .3rem;letter-spacing:-.01em;}
 .badge{display:inline-block;font-family:var(--mono);font-size:10px;letter-spacing:.08em;text-transform:uppercase;color:var(--teal);border:1px solid var(--teal-line);background:var(--teal-soft);padding:.25rem .6rem;border-radius:5px;margin-left:.4rem;vertical-align:middle;}
 .lede{color:var(--paragraph);font-size:.95rem;line-height:1.65;max-width:1180px;margin:.6rem 0 1rem;}
 .lede b{color:var(--cream);font-weight:600;}
-.cards{display:grid;grid-template-columns:repeat(4,1fr);gap:.8rem;margin:0 0 1.2rem;}
 .card{border:1px solid var(--gold-line);background:var(--panel);border-radius:8px;padding:.85rem 1rem;}
 .card .lbl{font-family:var(--mono);font-size:9.5px;letter-spacing:.1em;text-transform:uppercase;color:var(--dim);}
 .card .big{font-size:1.5rem;font-weight:600;margin:.35rem 0 .15rem;color:var(--teal);}
 .card .sub{font-family:var(--mono);font-size:10.5px;color:var(--muted);}
-.grid2{display:grid;grid-template-columns:1fr 1fr;gap:1rem;}
 .panel{border:1px solid var(--gold-line);background:var(--panel);border-radius:10px;padding:1rem 1.1rem;margin-bottom:1rem;}
 .panel h2{font-size:1.05rem;font-weight:600;margin:0 0 .2rem;display:flex;align-items:center;justify-content:space-between;}
 .panel h2 .meta{font-family:var(--mono);font-size:10px;color:var(--dim);text-transform:uppercase;letter-spacing:.06em;}
@@ -56,6 +59,8 @@ h1{font-size:1.7rem;font-weight:600;margin:.2rem 0 .3rem;letter-spacing:-.01em;}
 .pill.dim{color:var(--muted);}
 .simnote{border:1px solid var(--warn);background:rgba(201,160,95,.06);border-radius:8px;padding:.7rem .9rem;margin-top:.8rem;font-family:var(--mono);font-size:11px;color:#d8c39a;line-height:1.65;}
 table{width:100%;border-collapse:collapse;font-family:var(--mono);font-size:11.5px;margin-top:.5rem;}
 th,td{text-align:left;padding:.34rem .5rem;border-bottom:1px solid var(--gold-soft);color:var(--paragraph);vertical-align:top;}
 th{color:var(--dim);text-transform:uppercase;letter-spacing:.06em;font-size:9.5px;}
 td.deny{color:var(--red);}td.allow{color:var(--green);}
@@ -63,6 +68,7 @@ textarea,input{width:100%;background:var(--panel2);border:1px solid var(--gold-l
 textarea:focus,input:focus{outline:none;border-color:var(--teal-line);}
 button.run{margin-top:.6rem;padding:.55rem 1.1rem;border-radius:7px;border:1px solid var(--teal-line);background:var(--teal-soft);color:var(--teal);font-family:var(--mono);font-size:12px;letter-spacing:.06em;text-transform:uppercase;cursor:pointer;transition:.15s;}
 button.run:hover{background:rgba(95,179,163,.18);color:var(--cream);}
 .preset{display:inline-block;margin:.3rem .3rem 0 0;padding:.2rem .5rem;border-radius:5px;border:1px solid var(--gold-line);color:var(--muted);font-family:var(--mono);font-size:10.5px;cursor:pointer;}
 .preset:hover{color:var(--cream);border-color:var(--teal-line);}
 .verdict-box{margin-top:.8rem;border:1px solid var(--gold-line);border-radius:8px;padding:.85rem 1rem;background:var(--panel2);font-family:var(--mono);font-size:12px;line-height:1.8;}
@@ -72,12 +78,33 @@ button.run:hover{background:rgba(95,179,163,.18);color:var(--cream);}
 .digest{color:var(--gold);word-break:break-all;}
 code{font-family:var(--mono);color:var(--teal);}
 .footnote{font-family:var(--mono);font-size:10px;color:var(--dim);margin-top:1.6rem;line-height:1.7;}
 </style>
 </head>
 <body>
 <div class="topbar">
   <span>SZL HOLDINGS</span><span class="sep">/</span><span>a11oy</span>
-  <span class="live"><span class="live-dot"></span><span id="liveTag">IMMUNE · LIVE</span></span>
   <span class="switcher">
     <a class="flag active" href="/immune">Immune</a>
     <a class="flag" href="/energy">Energy</a>
@@ -88,12 +115,13 @@ code{font-family:var(--mono);color:var(--teal);}
 </div>
 <div class="wrap">
-  <h1>Immune (Hukulla) — fail-closed egress gate<span class="badge" id="organBadge">deny-by-default · real inspection · Khipu-signed</span></h1>
   <p class="lede">
     The <b>Immune</b> organ (Quechua role <b>Hukulla</b>) is a <b>fail-closed, deny-by-default</b> egress gate.
-    Every action is inspected against a real threat-signature corpus, a 1&nbsp;MB size guard and a
-    <b>&Lambda;-gate floor</b> (MIN of supplied trust axes &lt; 0.5 &rarr; deny). Each verdict is signed into the
-    <b>shared Khipu chain</b> (<code>SZL.Immune.Verdict.v1</code>). Proven Lean backing:
     <code>ImmuneNeymanPearsonOpt.lean</code> (Neyman&ndash;Pearson-optimal egress) and
     <code>FrontierWelfordVariance.lean</code> (Welford online variance). These back the gate but are
     <b>not</b> folded into the locked-8 proven set. &Lambda; = <b>Conjecture&nbsp;1</b> (not a theorem);
@@ -111,7 +139,7 @@ code{font-family:var(--mono);color:var(--teal);}
     <div class="panel">
       <h2>Inspect an action <span class="meta" id="verdictEp">POST /api/a11oy/v1/immune/verdict</span></h2>
       <p class="lede" style="margin:.2rem 0 .6rem;font-size:.86rem;">
-        Submit a real action payload. The gate runs the live inspection and signs a Khipu receipt.
         Optionally include <code>axes</code> (a JSON array of trust scores) to exercise the &Lambda;-gate floor.
       </p>
       <div>
@@ -129,7 +157,7 @@ code{font-family:var(--mono);color:var(--teal);}
     <div class="panel">
       <h2>Live status <span class="meta" id="statusEp">GET /api/a11oy/v1/immune/status</span></h2>
-      <div class="kv" id="statusKv"><span class="k">loading…</span></div>
       <div class="simnote" id="honestyNote">
         Λ = Conjecture 1 (NOT a theorem). Khipu = Conjecture 2. Trust never 100%. Effectors simulated.
         Decision feed is in-memory (resets on restart) — empty means IDLE, never faked.
@@ -139,12 +167,12 @@ code{font-family:var(--mono);color:var(--teal);}
   <div class="panel">
     <h2>Gates <span class="meta" id="gatesEp">GET /api/a11oy/v1/immune/gates</span></h2>
-    <table id="gatesTable"><thead><tr><th>id</th><th>name</th><th>label</th><th>category</th><th>sample → expected</th></tr></thead><tbody><tr><td class="mono" colspan="5">loading…</td></tr></tbody></table>
   </div>
   <div class="panel">
     <h2>Decision feed <span class="meta" id="feedEp">GET /api/a11oy/v1/immune/feed</span></h2>
-    <table id="feedTable"><thead><tr><th>time</th><th>decision</th><th>signals</th><th>Λ</th><th>receipt</th></tr></thead><tbody><tr><td class="mono" colspan="5">loading…</td></tr></tbody></table>
   </div>
   <div class="footnote" id="leanFoot">
@@ -156,45 +184,96 @@ code{font-family:var(--mono);color:var(--teal);}
 <script>
 const BASE = "/api/a11oy/v1/immune";
-async function getJSON(u,opt){try{const r=await fetch(u,opt);if(!r.ok)return null;return await r.json();}catch(e){return null;}}
 function esc(s){return String(s).replace(/[&<>"']/g,function(c){return({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]||c);});}
 async function loadStatus(){
-  const s = await getJSON(BASE + "/status");
   const kv = document.getElementById("statusKv");
-  if(!s){kv.innerHTML='<span class="k">status</span><span class="v">unreachable — retrying</span>';return;}
-  document.getElementById("cVerdicts").textContent = (s.verdicts_this_process ?? 0);
   document.getElementById("cDenyRate").textContent = (s.deny_rate==null?"—":(Math.round(s.deny_rate*1000)/10)+"%");
-  document.getElementById("cDenySub").textContent = (s.deny ?? 0)+" deny / "+(s.allow ?? 0)+" allow";
   document.getElementById("cCorpus").textContent = (s.signature_corpus_size ?? "—");
-  document.getElementById("cCorpusSub").textContent = (s.threats_corpus_total ?? 0)+" STIX/MITRE in corpus";
   const k = s.khipu||{};
   document.getElementById("cChain").textContent = (k.chain_depth ?? "—");
-  document.getElementById("cChainSub").textContent = (k.chain_verified? "chain verified":"unverified");
   kv.innerHTML =
-    '<div><span class="k">organ</span><span class="v">'+esc(s.organ||"Immune (Hukulla)")+'</span></div>'+
-    '<div><span class="k">role</span><span class="v">'+esc(s.role||"")+'</span></div>'+
-    '<div><span class="k">Λ-gate floor</span><span class="v">'+esc(s.lambda_gate_floor)+'</span></div>'+
-    '<div><span class="k">size guard</span><span class="v">'+esc(s.size_guard_bytes)+' bytes</span></div>'+
-    '<div><span class="k">signatures</span><span class="v">'+esc((s.signatures||[]).join(", "))+'</span></div>'+
-    '<div><span class="k">last receipt</span><span class="v digest">'+esc(s.last_receipt_digest||"(none yet)")+'</span></div>'+
-    '<div><span class="k">khipu head</span><span class="v digest">'+esc((k.head_digest||"").slice(0,32))+'…</span></div>'+
-    '<div><span class="k">status</span><span class="pill green">'+esc(s.status||"REAL")+'</span></div>';
 }
 async function loadGates(){
-  const g = await getJSON(BASE + "/gates");
   const tb = document.querySelector("#gatesTable tbody");
-  if(!g || !g.gates){tb.innerHTML='<tr><td class="mono" colspan="5">unreachable</td></tr>';return;}
   tb.innerHTML = g.gates.map(x=>
     '<tr><td class="mono">'+esc(x.id)+'</td><td>'+esc(x.name)+'</td><td>'+esc(x.label)+'</td><td>'+esc(x.category)+'</td>'+
     '<td><code>'+esc(String(x.sampleInput).slice(0,46))+'</code> → <b>'+esc(x.expectedDecision)+'</b></td></tr>').join("");
 }
 async function loadFeed(){
-  const f = await getJSON(BASE + "/feed?limit=20");
   const tb = document.querySelector("#feedTable tbody");
-  if(!f || !f.verdicts || !f.verdicts.length){tb.innerHTML='<tr><td class="mono" colspan="5">IDLE — no verdicts buffered (resets on restart)</td></tr>';return;}
   tb.innerHTML = f.verdicts.map(v=>
     '<tr><td>'+esc((v.timestamp||"").slice(11,19))+'</td>'+
     '<td class="'+esc(v.decision)+'">'+esc(v.decision)+'</td>'+
@@ -209,21 +288,33 @@ async function runVerdict(){
   try{ body = JSON.parse(document.getElementById("actionInput").value); }
   catch(e){ out.innerHTML='<div class="verdict-box deny">Invalid JSON: '+esc(e.message)+'</div>'; return; }
   out.innerHTML='<div class="verdict-box">inspecting…</div>';
-  const v = await getJSON(BASE + "/verdict", {method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(body)});
-  if(!v){ out.innerHTML='<div class="verdict-box deny">endpoint unreachable — retry</div>'; return; }
-  const cls = v.decision==="deny"?"deny":"allow";
-  const pill = v.decision==="deny"?'<span class="pill red">DENY</span>':'<span class="pill green">ALLOW</span>';
-  const sigs = (v.signals||[]).map(s=>'<span class="sig">'+esc(s)+'</span>').join("") || '<span class="pill dim">no signal</span>';
   const rec = v.khipu_receipt||{};
   out.innerHTML =
     '<div class="verdict-box '+cls+'">'+
-      '<div>decision '+pill+' &nbsp; <span style="color:var(--dim)">Λ='+esc(v.lambda_value)+' (floor '+esc(v.lambda_floor)+')</span></div>'+
-      '<div style="margin:.4rem 0;color:var(--paragraph)">'+esc(v.reason)+'</div>'+
       '<div style="margin:.3rem 0;">signals: '+sigs+'</div>'+
-      '<div><span style="color:var(--dim)">verdict hash</span> <span class="digest">'+esc(v.receipt_hash)+'</span></div>'+
-      '<div><span style="color:var(--dim)">Khipu receipt</span> <span class="digest">'+esc(rec.digest||"")+'</span> '+
-        '<span style="color:var(--dim)">seq '+esc(rec.seq)+' · '+esc(rec.receipt_type||"SZL.Immune.Verdict.v1")+'</span></div>'+
-      '<div style="color:var(--dim);margin-top:.3rem">fail-closed='+esc(v.fail_closed)+' · doctrine '+esc(v.doctrine)+'</div>'+
     '</div>';
   loadStatus(); loadFeed();
 }

 <meta charset="UTF-8"/>
 <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
 <title>Immune (Hukulla) — fail-closed egress gate · SZL Holdings</title>
+<meta name="description" content="Honest operational view of the Immune organ (Quechua role 'Hukulla') — a fail-closed, deny-by-default egress gate. Status, trace, signature, and Khipu-chain evidence are shown only when returned by the live backend. Lambda = Conjecture 1; Khipu = Conjecture 2; trust never 100%."/>
 <!-- 0 runtime CDN (doctrine v11): system fonts only — no Google Fonts, no external assets. -->
 <style>
 :root{
 .topbar{position:sticky;top:0;z-index:60;display:flex;align-items:center;gap:1rem;flex-wrap:wrap;padding:.5rem 1.1rem;background:rgba(10,10,10,.92);backdrop-filter:blur(10px);border-bottom:1px solid var(--gold-line);font-family:var(--mono);font-size:10.5px;letter-spacing:.1em;text-transform:uppercase;color:var(--gold);}
 .topbar .sep{color:var(--dim);}
 .topbar .live{display:inline-flex;align-items:center;gap:.4rem;color:var(--cream);}
+.live-dot{width:6px;height:6px;border-radius:50%;background:var(--warn);box-shadow:0 0 6px var(--warn);animation:pulse 2.2s ease-in-out infinite;}
+.live-dot.ready{background:var(--live);box-shadow:0 0 6px var(--live);}
+.live-dot.error{background:var(--err);box-shadow:0 0 6px var(--err);animation:none;}
 @keyframes pulse{0%,100%{opacity:1;}50%{opacity:.35;}}
 .switcher{margin-left:auto;display:flex;align-items:center;gap:.3rem;}
 .flag{padding:.22rem .55rem;border-radius:6px;border:1px solid transparent;color:var(--muted);transition:.15s;}
 .badge{display:inline-block;font-family:var(--mono);font-size:10px;letter-spacing:.08em;text-transform:uppercase;color:var(--teal);border:1px solid var(--teal-line);background:var(--teal-soft);padding:.25rem .6rem;border-radius:5px;margin-left:.4rem;vertical-align:middle;}
 .lede{color:var(--paragraph);font-size:.95rem;line-height:1.65;max-width:1180px;margin:.6rem 0 1rem;}
 .lede b{color:var(--cream);font-weight:600;}
+.cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,220px),1fr));gap:.8rem;margin:0 0 1.2rem;}
 .card{border:1px solid var(--gold-line);background:var(--panel);border-radius:8px;padding:.85rem 1rem;}
 .card .lbl{font-family:var(--mono);font-size:9.5px;letter-spacing:.1em;text-transform:uppercase;color:var(--dim);}
 .card .big{font-size:1.5rem;font-weight:600;margin:.35rem 0 .15rem;color:var(--teal);}
 .card .sub{font-family:var(--mono);font-size:10.5px;color:var(--muted);}
+.grid2{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:1rem;}
+.grid2>*{min-width:0;}
 .panel{border:1px solid var(--gold-line);background:var(--panel);border-radius:10px;padding:1rem 1.1rem;margin-bottom:1rem;}
 .panel h2{font-size:1.05rem;font-weight:600;margin:0 0 .2rem;display:flex;align-items:center;justify-content:space-between;}
 .panel h2 .meta{font-family:var(--mono);font-size:10px;color:var(--dim);text-transform:uppercase;letter-spacing:.06em;}
 .pill.dim{color:var(--muted);}
 .simnote{border:1px solid var(--warn);background:rgba(201,160,95,.06);border-radius:8px;padding:.7rem .9rem;margin-top:.8rem;font-family:var(--mono);font-size:11px;color:#d8c39a;line-height:1.65;}
 table{width:100%;border-collapse:collapse;font-family:var(--mono);font-size:11.5px;margin-top:.5rem;}
+.table-scroll{max-width:100%;overflow-x:auto;overscroll-behavior-inline:contain;-webkit-overflow-scrolling:touch;}
+.table-scroll table{min-width:680px;}
 th,td{text-align:left;padding:.34rem .5rem;border-bottom:1px solid var(--gold-soft);color:var(--paragraph);vertical-align:top;}
 th{color:var(--dim);text-transform:uppercase;letter-spacing:.06em;font-size:9.5px;}
 td.deny{color:var(--red);}td.allow{color:var(--green);}
 textarea:focus,input:focus{outline:none;border-color:var(--teal-line);}
 button.run{margin-top:.6rem;padding:.55rem 1.1rem;border-radius:7px;border:1px solid var(--teal-line);background:var(--teal-soft);color:var(--teal);font-family:var(--mono);font-size:12px;letter-spacing:.06em;text-transform:uppercase;cursor:pointer;transition:.15s;}
 button.run:hover{background:rgba(95,179,163,.18);color:var(--cream);}
+button.run:focus-visible,.preset:focus-visible,.flag:focus-visible{outline:2px solid var(--teal);outline-offset:2px;}
 .preset{display:inline-block;margin:.3rem .3rem 0 0;padding:.2rem .5rem;border-radius:5px;border:1px solid var(--gold-line);color:var(--muted);font-family:var(--mono);font-size:10.5px;cursor:pointer;}
 .preset:hover{color:var(--cream);border-color:var(--teal-line);}
 .verdict-box{margin-top:.8rem;border:1px solid var(--gold-line);border-radius:8px;padding:.85rem 1rem;background:var(--panel2);font-family:var(--mono);font-size:12px;line-height:1.8;}
 .digest{color:var(--gold);word-break:break-all;}
 code{font-family:var(--mono);color:var(--teal);}
 .footnote{font-family:var(--mono);font-size:10px;color:var(--dim);margin-top:1.6rem;line-height:1.7;}
+@media(max-width:760px){
+  .topbar{position:static;padding:.55rem .8rem;gap:.55rem;}
+  .switcher{order:3;width:100%;margin-left:0;flex-wrap:nowrap;overflow-x:auto;overscroll-behavior-inline:contain;padding-bottom:.15rem;}
+  .flag{flex:0 0 auto;min-height:44px;display:inline-flex;align-items:center;}
+  .wrap{padding:1.15rem .85rem 3rem;}
+  h1{font-size:1.4rem;line-height:1.25;}
+  .badge{display:block;width:max-content;max-width:100%;margin:.55rem 0 0;white-space:normal;}
+  .grid2{grid-template-columns:minmax(0,1fr);}
+  .panel{padding:.85rem;}
+  .panel h2{align-items:flex-start;gap:.5rem;flex-direction:column;}
+  .kv .k{min-width:130px;}
+  button.run{min-height:44px;width:100%;}
+  .preset{min-height:44px;display:inline-flex;align-items:center;}
+}
+@media(max-width:420px){
+  .cards{grid-template-columns:minmax(0,1fr);}
+  .kv>div{display:grid;grid-template-columns:minmax(0,.7fr) minmax(0,1.3fr);gap:.5rem;}
+  .kv .k{min-width:0;}
+  .kv .v,.digest{overflow-wrap:anywhere;word-break:break-word;}
+}
+@media(prefers-reduced-motion:reduce){.live-dot{animation:none;}}
 </style>
 </head>
 <body>
 <div class="topbar">
   <span>SZL HOLDINGS</span><span class="sep">/</span><span>a11oy</span>
+  <span class="live"><span class="live-dot" id="liveDot"></span><span id="liveTag" aria-live="polite">IMMUNE · PROBING</span></span>
   <span class="switcher">
     <a class="flag active" href="/immune">Immune</a>
     <a class="flag" href="/energy">Energy</a>
 </div>
 <div class="wrap">
+  <h1>Immune (Hukulla) — fail-closed egress gate<span class="badge" id="organBadge">deny-by-default · evidence pending</span></h1>
   <p class="lede">
     The <b>Immune</b> organ (Quechua role <b>Hukulla</b>) is a <b>fail-closed, deny-by-default</b> egress gate.
+    Submitted actions are sent to the live threat-signature, size, and
+    <b>&Lambda;-gate</b> inspection path (MIN of supplied trust axes &lt; 0.5 &rarr; deny). When the backend
+    returns a Khipu receipt, its digest, sequence, signature, chain result, and trace context are shown below.
+    No receipt or signature state is inferred by this page. Proven Lean backing:
     <code>ImmuneNeymanPearsonOpt.lean</code> (Neyman&ndash;Pearson-optimal egress) and
     <code>FrontierWelfordVariance.lean</code> (Welford online variance). These back the gate but are
     <b>not</b> folded into the locked-8 proven set. &Lambda; = <b>Conjecture&nbsp;1</b> (not a theorem);
     <div class="panel">
       <h2>Inspect an action <span class="meta" id="verdictEp">POST /api/a11oy/v1/immune/verdict</span></h2>
       <p class="lede" style="margin:.2rem 0 .6rem;font-size:.86rem;">
+        Submit an action payload to the live inspection endpoint. Returned receipt and signing evidence is shown without inference.
         Optionally include <code>axes</code> (a JSON array of trust scores) to exercise the &Lambda;-gate floor.
       </p>
       <div>
     <div class="panel">
       <h2>Live status <span class="meta" id="statusEp">GET /api/a11oy/v1/immune/status</span></h2>
+      <div class="kv" id="statusKv" aria-live="polite"><span class="k">status</span><span class="v">PROBING</span></div>
       <div class="simnote" id="honestyNote">
         Λ = Conjecture 1 (NOT a theorem). Khipu = Conjecture 2. Trust never 100%. Effectors simulated.
         Decision feed is in-memory (resets on restart) — empty means IDLE, never faked.
   <div class="panel">
     <h2>Gates <span class="meta" id="gatesEp">GET /api/a11oy/v1/immune/gates</span></h2>
+    <div class="table-scroll" role="region" aria-label="Immune gates" tabindex="0"><table id="gatesTable"><thead><tr><th>id</th><th>name</th><th>label</th><th>category</th><th>sample → expected</th></tr></thead><tbody><tr><td class="mono" colspan="5">loading…</td></tr></tbody></table></div>
   </div>
   <div class="panel">
     <h2>Decision feed <span class="meta" id="feedEp">GET /api/a11oy/v1/immune/feed</span></h2>
+    <div class="table-scroll" role="region" aria-label="Immune decision feed" tabindex="0"><table id="feedTable"><thead><tr><th>time</th><th>decision</th><th>signals</th><th>Λ</th><th>receipt</th></tr></thead><tbody><tr><td class="mono" colspan="5">loading…</td></tr></tbody></table></div>
   </div>
   <div class="footnote" id="leanFoot">
 <script>
 const BASE = "/api/a11oy/v1/immune";
+async function requestJSON(u,opt){
+  try{
+    const r=await fetch(u,opt);
+    const text=await r.text();
+    let data=null;
+    if(text){
+      try{data=JSON.parse(text);}
+      catch(e){return {ok:false,status:r.status,error:"invalid JSON response",data:null};}
+    }
+    if(!r.ok){
+      const detail=data&&(data.detail||data.error||data.message);
+      return {ok:false,status:r.status,error:detail||("HTTP "+r.status),data:data};
+    }
+    return {ok:true,status:r.status,error:null,data:data};
+  }catch(e){
+    return {ok:false,status:null,error:(e&&e.message)||String(e),data:null};
+  }
+}
 function esc(s){return String(s).replace(/[&<>"']/g,function(c){return({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]||c);});}
+function evidenceValue(v){
+  if(typeof v==="string")return v;
+  try{return JSON.stringify(v);}catch(e){return String(v);}
+}
+function present(v){return v!==undefined&&v!==null&&v!=="";}
+function row(label,value,cls){
+  if(!present(value))return "";
+  return '<div><span class="k">'+esc(label)+'</span><span class="v '+(cls||'')+'">'+esc(evidenceValue(value))+'</span></div>';
+}
+function connectionState(state,reachable){
+  const normalized=present(state)?String(state).trim().toUpperCase():"UNKNOWN";
+  const ready=reachable&&["LIVE","REAL","READY","OPERATIONAL","MEASURED"].includes(normalized);
+  const dot=document.getElementById("liveDot");
+  dot.className="live-dot"+(ready?" ready":reachable?"":" error");
+  document.getElementById("liveTag").textContent="IMMUNE · "+(reachable?normalized:"UNAVAILABLE");
+  document.getElementById("organBadge").textContent=ready?"deny-by-default · backend reported "+normalized.toLowerCase():"deny-by-default · evidence "+(reachable?normalized.toLowerCase():"unavailable");
+  return {normalized,ready};
+}
+function requestFailure(result){
+  const status=result.status==null?"network error":"HTTP "+result.status;
+  return status+(present(result.error)?" · "+result.error:result.ok?" · required evidence unavailable":"");
+}
 async function loadStatus(){
+  const result = await requestJSON(BASE + "/status");
   const kv = document.getElementById("statusKv");
+  if(!result.ok||!result.data){
+    connectionState(null,false);
+    kv.innerHTML=row("status","UNAVAILABLE")+row("evidence",requestFailure(result));
+    return;
+  }
+  const s=result.data;
+  const state=connectionState(s.status,true);
+  document.getElementById("cVerdicts").textContent = (s.verdicts_this_process ?? "—");
   document.getElementById("cDenyRate").textContent = (s.deny_rate==null?"—":(Math.round(s.deny_rate*1000)/10)+"%");
+  document.getElementById("cDenySub").textContent = (s.deny ?? "—")+" deny / "+(s.allow ?? "—")+" allow";
   document.getElementById("cCorpus").textContent = (s.signature_corpus_size ?? "—");
+  document.getElementById("cCorpusSub").textContent = (s.threats_corpus_total ?? "—")+" STIX/MITRE in corpus";
   const k = s.khipu||{};
   document.getElementById("cChain").textContent = (k.chain_depth ?? "—");
+  document.getElementById("cChainSub").textContent = (typeof k.chain_verified==="boolean"?(k.chain_verified?"chain verified":"chain not verified"):"verification unavailable");
+  const observed=s.observed_at||s.observedAt||s.timestamp;
   kv.innerHTML =
+    row("organ",s.organ)+
+    row("role",s.role)+
+    row("Λ-gate floor",s.lambda_gate_floor)+
+    row("size guard",present(s.size_guard_bytes)?s.size_guard_bytes+" bytes":null)+
+    row("signatures",Array.isArray(s.signatures)?s.signatures.join(", "):s.signatures)+
+    row("last receipt",s.last_receipt_digest,"digest")+
+    row("khipu head",k.head_digest,"digest")+
+    row("chain verified",typeof k.chain_verified==="boolean"?String(k.chain_verified):null)+
+    row("observed at",observed)+
+    '<div><span class="k">status</span><span class="pill '+(state.ready?'green':'yellow')+'">'+esc(state.normalized)+'</span></div>';
 }
 async function loadGates(){
+  const result = await requestJSON(BASE + "/gates");
   const tb = document.querySelector("#gatesTable tbody");
+  if(!result.ok||!result.data||!Array.isArray(result.data.gates)){tb.innerHTML='<tr><td class="mono" colspan="5">'+esc(requestFailure(result))+'</td></tr>';return;}
+  const g=result.data;
   tb.innerHTML = g.gates.map(x=>
     '<tr><td class="mono">'+esc(x.id)+'</td><td>'+esc(x.name)+'</td><td>'+esc(x.label)+'</td><td>'+esc(x.category)+'</td>'+
     '<td><code>'+esc(String(x.sampleInput).slice(0,46))+'</code> → <b>'+esc(x.expectedDecision)+'</b></td></tr>').join("");
 }
 async function loadFeed(){
+  const result = await requestJSON(BASE + "/feed?limit=20");
   const tb = document.querySelector("#feedTable tbody");
+  if(!result.ok||!result.data||!Array.isArray(result.data.verdicts)){tb.innerHTML='<tr><td class="mono" colspan="5">'+esc(requestFailure(result))+'</td></tr>';return;}
+  const f=result.data;
+  if(!f.verdicts.length){tb.innerHTML='<tr><td class="mono" colspan="5">IDLE — no verdicts buffered (resets on restart)</td></tr>';return;}
   tb.innerHTML = f.verdicts.map(v=>
     '<tr><td>'+esc((v.timestamp||"").slice(11,19))+'</td>'+
     '<td class="'+esc(v.decision)+'">'+esc(v.decision)+'</td>'+
   try{ body = JSON.parse(document.getElementById("actionInput").value); }
   catch(e){ out.innerHTML='<div class="verdict-box deny">Invalid JSON: '+esc(e.message)+'</div>'; return; }
   out.innerHTML='<div class="verdict-box">inspecting…</div>';
+  const result = await requestJSON(BASE + "/verdict", {method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(body)});
+  if(!result.ok||!result.data){ out.innerHTML='<div class="verdict-box deny">'+esc(requestFailure(result))+'</div>'; return; }
+  const v=result.data;
+  const decision=String(v.decision||"UNKNOWN").toLowerCase();
+  const cls = decision==="deny"?"deny":decision==="allow"?"allow":"";
+  const pill = decision==="deny"?'<span class="pill red">DENY</span>':decision==="allow"?'<span class="pill green">ALLOW</span>':'<span class="pill yellow">UNKNOWN</span>';
+  const sigs = Array.isArray(v.signals)?(v.signals.map(s=>'<span class="sig">'+esc(s)+'</span>').join("")||'<span class="pill dim">no signals returned</span>'):'<span class="pill dim">signals unavailable</span>';
   const rec = v.khipu_receipt||{};
+  const observed=v.observed_at||v.observedAt||v.timestamp||rec.observed_at||rec.timestamp;
+  const lambdaEvidence=present(v.lambda_value)?' &nbsp; <span style="color:var(--dim)">Λ='+esc(v.lambda_value)+(present(v.lambda_floor)?' (floor '+esc(v.lambda_floor)+')':'')+'</span>':'';
+  const reasonEvidence=present(v.reason)?'<div style="margin:.4rem 0;color:var(--paragraph)">'+esc(v.reason)+'</div>':'';
+  const policyEvidence=row("fail closed",v.fail_closed)+row("doctrine",v.doctrine);
+  const receiptEvidence=
+    row("verdict hash",v.receipt_hash,"digest")+
+    row("receipt digest",rec.digest,"digest")+
+    row("receipt sequence",rec.seq)+
+    row("receipt type",rec.receipt_type)+
+    row("signature",rec.signature,"digest")+
+    row("chain verified",typeof rec.chain_verified==="boolean"?String(rec.chain_verified):null)+
+    row("traceparent",v.traceparent,"digest")+
+    row("observed at",observed);
   out.innerHTML =
     '<div class="verdict-box '+cls+'">'+
+      '<div>decision '+pill+lambdaEvidence+'</div>'+
+      reasonEvidence+
       '<div style="margin:.3rem 0;">signals: '+sigs+'</div>'+
+      '<div class="kv">'+receiptEvidence+policyEvidence+'</div>'+
     '</div>';
   loadStatus(); loadFeed();
 }