Update HONEST_DISCLOSURE.md — honest org card / scrub dead-organ refs

HONEST_DISCLOSURE.md

@@ -1,11 +1,25 @@
 # What is honest right now — Doctrine v11
 
-**lutar-lean @ tag `lutar-v18.0.0` / c7c0ba17:**
-
-- **749 declarations · 14 unique axioms (15 raw, 1 dup) · 163 tracked sorries** (112 baseline + 51 Putnam). `lake build` clean.
-- **Λ uniqueness is a Conjecture**, not a closed theorem — depends on the open CAUCHY_ND sorry (`Uniqueness.lean:120`) + a missing symmetry axiom.
-- **Wires:** Wire B (a11oy↔sentra immune) and Wire C (a11oy↔rosie receipt stream) are **LIVE on main**; Wire D (W3C traceparent across the mesh) is **NOT YET IMPLEMENTED**.
-- **SLSA: L1 (honest)** — previously mis-claimed as L3; corrected in platform PR #235.
-- **Receipts:** DSSE envelopes ship from the amaru tick endpoint today; Sigstore CI signing is **PENDING** — signatures labeled "PLACEHOLDER — signing not yet wired into CI".
-- **Axioms:** A2 = `IsHomogeneous` (positive homogeneity deg 1); A4 = `IsBounded` (bounded by max axis). v3 Zenodo proofs (10.5281/zenodo.19983066) do NOT carry over.
-- Aligned with **EU AI Act Article 12** + **NIST AI RMF (MANAGE)**.
+This is the standing honesty disclosure for SZL Holdings. We surface only machine-checked facts as fact; everything else is labeled experimental, conditional, or conjectured.
+
+**lutar-lean @ tag `lutar-v18.0.0` / `c7c0ba17`:**
+
+- **749 declarations · 14 unique axioms · 163 tracked sorries** (112 baseline + 51 Putnam). `lake build` clean.
+- **Locked proven set = 5 formulas** (Lean, sorry-free): **F1, F11, F12, F18, F19**. These are the only formulas we surface as "proven."
+- **Λ (the trust aggregator) is Conjecture 1.** It is unique *only conditionally* — under a block-consistency axiom (Csató 2018), CI-green on `lutar-lean` main. **Unconditional** uniqueness is machine-checked **false** (`unconditional_lambda_is_false`). Λ is never stated as an unconditional theorem.
+- **Experimental waves** (proof waves 3/5/6/7 + the agentic loop) live in experimental Lean scopes, are **CI-green** but **excluded** from the locked v11 baseline. They are labeled experimental, never folded into the locked proven set.
+
+**Supply chain:**
+- **SLSA Build L2** on all service images (cosign + `slsa.dev/provenance/v0.2` attestation on GHCR). **No** L3 / FedRAMP / Iron Bank / CMMC is claimed.
+- The `szl-mesh` UDS bundle is **cosign-signed** (keyless OIDC). The GitHub attestation for the bundle itself was not minted (token scope); the per-image SLSA L2 attestations are separate and intact.
+
+**Receipts:**
+- Decision receipts are **DSSE envelopes over a SHA-256 hash chain**. Where a signing key is present (the killinchu engagement surface carries a real ECDSA-P256 cosign key), receipts are **genuinely signed** and verifiable offline. Where no key is present, receipts are **honestly marked unsigned** — never fabricated.
+
+**Data honesty:**
+- Maritime AIS on the field surface uses a clearly-labeled **sample/replay** dataset, not a live production feed.
+- Live public feeds (CVE/NVD, CISA KEV, MITRE ATT&CK, USGS) are honestly attributed where shown.
+
+**Compliance posture:** Aligned with **EU AI Act Article 12** (record-keeping) + **NIST AI RMF (MANAGE)**. These are alignment statements, not certifications.
+
+*Built by Stephen P. Lutar Jr. · stephenlutar2@gmail.com · Doctrine v11 LOCKED.*