hf-sync: mirror front-door from GitHub c4bc67a4

README.md

@@ -68,6 +68,23 @@ through the same five-part contract: **Purpose · Try · Evidence · Limits · R
 - `/.well-known/szl-source.json` exposes the declared GitHub base, measured HF
   revision, artifact-set digest, and the remaining GitHub-sync state.
 
+## v6 — alive-proof layer (ratchet 2026-07-21)
+
+The **⛬ alive-proof (v6)** control closes the loop between the map and the
+running substrate. It fetches the latest anatomy alive-harness run from the
+restored public sink ([`SZLHOLDINGS/test-results`](https://huggingface.co/datasets/SZLHOLDINGS/test-results)),
+verifies the run's DSSE (PAE v1) ECDSA-P256 signature **in the browser**
+against the pinned, committed org key
+([`hatun-mcp/PUBKEY_szlholdings-ec-p256.pem`](https://github.com/szl-holdings/hatun-mcp/blob/main/PUBKEY_szlholdings-ec-p256.pem)),
+and only then displays the run — verdict, live assertion counts, per-layer
+results, and the formula-gate pass rate, all **derived from the signed
+evidence**, never hand-typed. Runs are signed by the live Hatun MCP gateway
+(`dsse_sign`, keyid `szlholdings-ec-p256`) and published by a fail-closed
+publisher that verifies before and after upload. If the sink is unreachable or
+a signature fails, the panel says so — no fabricated green light. A signed
+GREEN run proves liveness, not doctrine upgrades: locked-proven stays exactly
+8 and Λ remains Conjecture 1.
+
 Machine-readable routes:
 
 | Route | Meaning |

index.html

@@ -1766,5 +1766,7 @@
   <script src="./v5_organs.js"></script>
   <!-- Evidence Bay: industrial proof boundary + five-part capability contract. Read-only, zero CDN. -->
   <script src="./frontier_anatomy.js"></script>
+  <!-- v6 alive-proof layer (ratchet 2026-07-21): latest alive-harness run fetched from the public DSSE-signed sink and ECDSA-P256 signature-verified IN THE BROWSER before display. Additive, fail-closed, zero-CDN. -->
+  <script src="./v6_alive.js"></script>
 </body>
 </html>

v6_alive.js

@@ -0,0 +1,200 @@
+/* =====================================================================
+   v6_alive.js — SZL Living Anatomy · v6 ALIVE-PROOF LAYER (additive)
+   =====================================================================
+   The v6 ratchet: the map stops describing the substrate and starts
+   PROVING it. This layer fetches the latest anatomy alive-harness run
+   from the public DSSE-signed sink (SZLHOLDINGS/test-results), verifies
+   the ECDSA-P256 signature IN THE BROWSER (WebCrypto, DSSE PAE v1)
+   against the committed org public key, and only then displays the run.
+
+   FAIL-CLOSED DISCIPLINE (binding):
+     - No signature verification → the panel shows UNVERIFIED / UNREACHABLE.
+       We never display an unverified number as a verified one.
+     - The public key is pinned below AND cross-checked against the
+       committed copy at hatun-mcp/main/PUBKEY_szlholdings-ec-p256.pem.
+       A mismatch is displayed as a key-pin failure, not silently ignored.
+     - The Hatun MCP gateway chip goes LIVE only on a real 2xx server-card
+       fetch with a parseable tool inventory.
+     - Doctrine v11 LOCKED is unchanged: locked-proven stays EXACTLY 8
+       (F1 F4 F7 F11 F12 F18 F19 F22); Λ is Conjecture 1, never a theorem.
+       A signed GREEN harness run proves liveness, not doctrine upgrades.
+   Additive, read-only, zero-CDN. No key is sent; open surfaces only.
+   ===================================================================== */
+(function (root) {
+  'use strict';
+
+  var SINK = 'https://huggingface.co/datasets/SZLHOLDINGS/test-results';
+  var RUNS_URL = SINK + '/resolve/main/harness_runs.jsonl';
+  var PUBKEY_URL = 'https://raw.githubusercontent.com/szl-holdings/hatun-mcp/main/PUBKEY_szlholdings-ec-p256.pem';
+  var HATUN_CARD = 'https://szlholdings-hatun-mcp.hf.space/.well-known/mcp/server-card.json';
+
+  /* Pinned committed org public key (SPKI, P-256) — szlholdings-ec-p256 */
+  var PIN_PEM = '-----BEGIN PUBLIC KEY-----\n'
+    + 'MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEk+AEVaqvPGGBF/OAEpr7/3hcNHgF\n'
+    + 'bXn+bqq0egeockovraAuzkfbVf6kiH6wAy01iaBtv3j/1W2Amx/xbUnelQ==\n'
+    + '-----END PUBLIC KEY-----';
+
+  function el(tag, cls, html) { var e = document.createElement(tag); if (cls) e.className = cls; if (html != null) e.innerHTML = html; return e; }
+  function esc(s) { return String(s == null ? '' : s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;'); }
+  function b64ToBytes(b64) { var bin = atob(b64.replace(/\s+/g, '')); var out = new Uint8Array(bin.length); for (var i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i); return out; }
+  function pemToSpki(pem) { return b64ToBytes(pem.replace(/-----[^-]+-----/g, '').replace(/\s+/g, '')); }
+  function utf8(s) { return new TextEncoder().encode(s); }
+  function concatBytes(parts) { var n = 0, i; for (i = 0; i < parts.length; i++) n += parts[i].length; var out = new Uint8Array(n), o = 0; for (i = 0; i < parts.length; i++) { out.set(parts[i], o); o += parts[i].length; } return out; }
+
+  /* DSSE PAE v1: "DSSEv1 SP len(type) SP type SP len(payload) SP payload" */
+  function pae(payloadType, payloadBytes) {
+    var t = utf8(payloadType);
+    return concatBytes([utf8('DSSEv1 ' + t.length + ' '), t, utf8(' ' + payloadBytes.length + ' '), payloadBytes]);
+  }
+
+  /* ECDSA sig from gateway is ASN.1/DER; WebCrypto wants raw r||s (P1363). */
+  function derToP1363(der) {
+    var i = 2; /* SEQUENCE, len (assume short-form or 1-byte long-form) */
+    if (der[1] & 0x80) i = 2 + (der[1] & 0x7f);
+    function readInt() {
+      if (der[i] !== 0x02) throw new Error('bad DER');
+      var len = der[i + 1]; i += 2;
+      var v = der.slice(i, i + len); i += len;
+      while (v.length > 32 && v[0] === 0) v = v.slice(1);
+      var out = new Uint8Array(32); out.set(v, 32 - v.length); return out;
+    }
+    var r = readInt(), s = readInt();
+    return concatBytes([r, s]);
+  }
+
+  function verifyDsse(env) {
+    var payloadBytes = b64ToBytes(env.payload);
+    var msg = pae(env.payloadType, payloadBytes);
+    var sig = derToP1363(b64ToBytes(env.signatures[0].sig));
+    return crypto.subtle.importKey('spki', pemToSpki(PIN_PEM), { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify'])
+      .then(function (key) { return crypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, key, sig, msg); })
+      .then(function (ok) { return { ok: ok, payload: JSON.parse(new TextDecoder().decode(payloadBytes)) }; });
+  }
+
+  function fetchText(url) { return fetch(url, { mode: 'cors', credentials: 'omit', cache: 'no-store' }).then(function (r) { if (!r.ok) throw new Error('HTTP ' + r.status); return r.text(); }); }
+
+  /* ---------------- styles ---------------- */
+  var css = [
+    '#v6panel{position:fixed;z-index:42;top:0;right:0;height:100%;width:min(460px,94vw);background:linear-gradient(180deg,rgba(8,14,22,.99),rgba(5,9,15,.98));border-left:1px solid rgba(255,255,255,.1);box-shadow:-8px 0 40px rgba(0,0,0,.5);transform:translateX(102%);transition:transform .32s cubic-bezier(.2,.7,.2,1);display:flex;flex-direction:column;pointer-events:auto}',
+    '#v6panel.open{transform:translateX(0)}',
+    '#v6panel .v6h{padding:20px 22px 14px;border-bottom:1px solid rgba(255,255,255,.1)}',
+    '#v6panel .v6h .eyebrow{font-family:var(--font-m,monospace);font-size:10px;letter-spacing:.16em;text-transform:uppercase;color:var(--text-dim,#8aa)}',
+    '#v6panel .v6h h2{font-size:20px;font-weight:700;margin:6px 0 0;line-height:1.15}',
+    '#v6panel .v6b{padding:16px 22px 90px;overflow:auto;font-size:12.5px;line-height:1.55;color:var(--text,#dfe)}',
+    '#v6panel .v6close{position:absolute;top:14px;right:14px;background:none;border:1px solid rgba(255,255,255,.18);color:var(--text,#dfe);border-radius:8px;width:30px;height:30px;cursor:pointer;font-size:16px;line-height:1}',
+    '.v6-chip{font-family:var(--font-m,monospace);font-size:9.5px;letter-spacing:.06em;border:1px solid currentColor;border-radius:6px;padding:1px 6px;white-space:nowrap}',
+    '.v6-chip.ok{color:#69f0ae}.v6-chip.bad{color:#ff7eb6}.v6-chip.wait{color:#9ea7c0}.v6-chip.warn{color:#ffd166}',
+    '.v6-card{border:1px solid rgba(255,255,255,.12);border-radius:12px;padding:13px 14px;margin:11px 0;background:rgba(255,255,255,.02)}',
+    '.v6-card .h{display:flex;align-items:center;gap:8px;justify-content:space-between;font-weight:700;font-size:13.5px}',
+    '.v6-mono{font-family:var(--font-m,monospace);font-size:11px;background:rgba(0,0,0,.34);border-left:2px solid #69f0ae;border-radius:6px;padding:8px 10px;margin-top:8px;white-space:pre-wrap;word-break:break-word;color:#e7ecff}',
+    '.v6-note{border:1px solid #ffd166;background:rgba(255,209,102,.07);border-radius:10px;padding:11px 13px;margin:12px 0;font-size:12px}',
+    '.v6-layers{display:grid;grid-template-columns:1fr 1fr;gap:6px;margin-top:8px}',
+    '.v6-layers .cell{border:1px solid rgba(255,255,255,.1);border-radius:8px;padding:6px 8px;font-family:var(--font-m,monospace);font-size:10.5px}'
+  ].join('\n');
+
+  /* ---------------- panel ---------------- */
+  var panel, body;
+  function buildPanel() {
+    var st = el('style'); st.textContent = css; document.head.appendChild(st);
+    panel = el('div'); panel.id = 'v6panel';
+    var h = el('div', 'v6h');
+    h.appendChild(el('div', 'eyebrow', 'v6 alive-proof layer · verify-then-display'));
+    h.appendChild(el('h2', null, 'Alive-Harness · DSSE-verified in this browser'));
+    var x = el('button', 'v6close', '×'); x.setAttribute('aria-label', 'Close'); x.addEventListener('click', close);
+    h.appendChild(x);
+    body = el('div', 'v6b', '<span class="v6-chip wait">FETCHING…</span> pulling the latest signed harness run…');
+    panel.appendChild(h); panel.appendChild(body);
+    document.body.appendChild(panel);
+  }
+  function open() { panel.classList.add('open'); refresh(); }
+  function close() { panel.classList.remove('open'); }
+
+  function render(state) {
+    body.innerHTML = '';
+    var run = state.run;
+    if (state.status !== 'VERIFIED') {
+      var chip = state.status === 'UNREACHABLE' ? 'bad' : 'warn';
+      body.appendChild(el('div', 'v6-note',
+        '<b><span class="v6-chip ' + chip + '">' + esc(state.status) + '</span></b> ' + esc(state.detail || '')
+        + '<br><br>Fail-closed: nothing is displayed as verified without an in-browser '
+        + 'ECDSA-P256 signature check against the committed org key. '
+        + '<a href="' + SINK + '" target="_blank" rel="noopener" style="color:#5ad1ff">Inspect the sink directly →</a>'));
+      return;
+    }
+    var c1 = el('div', 'v6-card');
+    c1.appendChild(el('div', 'h', 'Latest harness run <span class="v6-chip ' + (run.verdict === 'GREEN' ? 'ok' : 'warn') + '">' + esc(run.verdict) + ' · SIGNATURE VERIFIED</span>'));
+    c1.appendChild(el('p', null,
+      esc(run.assertions_passed + '/' + run.assertions_total) + ' live assertions · formula gates '
+      + esc(run.formula_gates_passed + '/' + run.formula_gates_total)
+      + ' · harness ' + esc(run.harness_version) + '<br>finished ' + esc(run.finishedAt)));
+    c1.appendChild(el('div', 'v6-mono',
+      'keyid: ' + esc(state.keyid) + '\npin: committed PUBKEY_szlholdings-ec-p256.pem '
+      + (state.pinMatch === true ? '(cross-check MATCH)' : state.pinMatch === false ? '(CROSS-CHECK MISMATCH!)' : '(cross-check unreachable)')
+      + '\nevidence sha256: ' + esc(run.evidence_sha256).slice(0, 32) + '…\nverified: in THIS browser via WebCrypto, DSSE PAE v1'));
+    body.appendChild(c1);
+
+    if (state.layers) {
+      var c2 = el('div', 'v6-card');
+      c2.appendChild(el('div', 'h', 'Layers (from the signed evidence)'));
+      var grid = el('div', 'v6-layers');
+      Object.keys(state.layers).forEach(function (k) {
+        var v = state.layers[k];
+        grid.appendChild(el('div', 'cell', esc(k) + ' · <span class="v6-chip ' + (v.fail ? 'warn' : 'ok') + '">' + v.pass + ' pass' + (v.fail ? ' · ' + v.fail + ' fail' : '') + '</span>'));
+      });
+      c2.appendChild(grid);
+      body.appendChild(c2);
+    }
+
+    var c3 = el('div', 'v6-card');
+    c3.appendChild(el('div', 'h', 'Hatun MCP gateway <span class="v6-chip ' + (state.hatun ? 'ok' : 'bad') + '">' + (state.hatun ? 'LIVE · ' + state.hatun + ' tools' : 'UNREACHABLE') + '</span>'));
+    c3.appendChild(el('p', null, 'The signer of this record: the live MCP gateway (dsse_sign, ECDSA-P256). Runs are published fail-closed — the publisher verifies before and after upload.'));
+    body.appendChild(c3);
+
+    body.appendChild(el('div', 'v6-note',
+      '<b>Doctrine boundary (unchanged):</b> a signed GREEN run proves the substrate is ALIVE '
+      + 'and its gates execute — it upgrades NO proof claim. Locked-proven stays exactly 8; '
+      + 'Λ remains Conjecture 1. '
+      + '<a href="' + SINK + '" target="_blank" rel="noopener" style="color:#5ad1ff">Sink + reproduce-it-yourself instructions →</a>'));
+  }
+
+  function refresh() {
+    var state = { status: 'UNREACHABLE', detail: '', hatun: 0, pinMatch: null };
+    var pHatun = fetchText(HATUN_CARD).then(function (t) {
+      var card = JSON.parse(t);
+      var tools = (card.tools && card.tools.length) || (card.capabilities && card.capabilities.tools && card.capabilities.tools.count) || 0;
+      state.hatun = tools || 'yes';
+    }).catch(function () { state.hatun = 0; });
+    var pPin = fetchText(PUBKEY_URL).then(function (t) {
+      state.pinMatch = t.replace(/\s+/g, '') === PIN_PEM.replace(/\s+/g, '');
+    }).catch(function () { state.pinMatch = null; });
+    var pRun = fetchText(RUNS_URL).then(function (txt) {
+      var lines = txt.trim().split('\n');
+      var rec = JSON.parse(lines[lines.length - 1]);
+      return verifyDsse(rec.dsse).then(function (v) {
+        if (!v.ok) { state.status = 'UNVERIFIED'; state.detail = 'Signature did NOT verify against the pinned org key. Refusing to display the run as verified.'; return; }
+        state.status = 'VERIFIED';
+        state.run = v.payload;
+        state.keyid = rec.dsse.signatures[0].keyid || 'szlholdings-ec-p256';
+        var stamp = (v.payload.finishedAt || '').replace(/[:\-]/g, '');
+        return fetchText(SINK + '/resolve/main/runs/' + stamp + '.evidence.json')
+          .then(function (ev) { state.layers = JSON.parse(ev).layers; }).catch(function () { /* layers optional */ });
+      });
+    }).catch(function (e) { state.status = 'UNREACHABLE'; state.detail = 'Could not fetch the signed sink (' + e.message + ').'; });
+    Promise.all([pHatun, pPin, pRun]).then(function () { render(state); });
+  }
+
+  /* ---------------- button (injected next to the v5 cluster) ---------------- */
+  function init() {
+    buildPanel();
+    var anchor = document.getElementById('btn-v5-stack') || document.getElementById('btn-v5-willay');
+    var btn = el('button', 'btn', '⛬ alive-proof (v6)');
+    btn.id = 'btn-v6-alive';
+    btn.title = 'v6 alive-proof layer: latest harness run fetched from the public DSSE-signed sink and signature-verified IN THIS BROWSER (WebCrypto, pinned org key) before display · fail-closed, never a fabricated green light';
+    btn.setAttribute('aria-controls', 'v6panel');
+    btn.addEventListener('click', function () { if (panel.classList.contains('open')) close(); else open(); });
+    if (anchor && anchor.parentNode) anchor.parentNode.appendChild(btn);
+    else document.body.appendChild(btn);
+  }
+  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', init); else init();
+
+})(window);