feat: add evidence-bound Council v2 and verifier contract

README.md

@@ -17,6 +17,8 @@ tags:
   - a11oy
   - slsa-l1
   - apache-2.0
+models:
+  - SZLHOLDINGS/szl-nemo
 ecosystem-stage: "operational"
 ---
 
@@ -115,6 +117,16 @@ curl -s https://a-11-oy.com/api/a11oy/v1/honest | jq .doctrine_lock.lambda
 | Live energy ledger | [a-11-oy.com/api/a11oy/v1/energy/ledger](https://a-11-oy.com/api/a11oy/v1/energy/ledger) |
 | Doctrine posture | [a-11-oy.com/api/a11oy/v1/honest](https://a-11-oy.com/api/a11oy/v1/honest) |
 | WILLAY classifiers | [a-11-oy.com/api/a11oy/v1/willay/classifiers](https://a-11-oy.com/api/a11oy/v1/willay/classifiers) |
+| Evidence-bound Council | [a-11-oy.com/api/a11oy/v1/ayllu/council/manifest](https://a-11-oy.com/api/a11oy/v1/ayllu/council/manifest) |
+| SZL-Nemo card | [a-11-oy.com/api/a11oy/v1/nemo/card](https://a-11-oy.com/api/a11oy/v1/nemo/card) |
+| Receipt verifier contract | [a-11-oy.com/api/a11oy/v1/verify/receipt](https://a-11-oy.com/api/a11oy/v1/verify/receipt) |
+
+Council v2 is proposal-only. It adds a signed Nemo routing trace, per-turn output
+digests, explicit limits, a deterministic replay key, and a required human
+checkpoint. Semantic consensus and Council effectiveness are labeled
+`NOT_MEASURED` until golden-case evaluation exists. The linked `szl-nemo` Hub
+artifact is currently a model card and Modelfile recipe; it contains no SZL-trained
+weights and is not described as a fine-tune.
 
 ### Persistent receipt storage (HF Space)
 

a11oy_ayllu.py

@@ -71,6 +71,10 @@ COUNCIL_MAX = 5                                     # hard cap on participants /
 COUNCIL_DEBATE_MAX = 3  # debate doubles model calls; tighter cap bounds cost
 COUNCIL_DEFAULT = ["Amaru", "Kamachiq", "Qhatuq"]  # architect · orchestrator · markets
 
+COUNCIL_CONTRACT_VERSION = "2.0"
+COUNCIL_SCHEMA = "szl.ayllu.evidence-bound-council/v2"
+NEMO_ARTIFACT = "https://huggingface.co/SZLHOLDINGS/szl-nemo"
+
 # One process-wide lounge (in-memory, honest source labels).
 _LOUNGE = Lounge()
 
@@ -109,13 +113,26 @@ def _receipt_sha(receipt: Optional[dict]) -> Optional[str]:
         return None
 
 
-def _make_receipt(payload: Dict[str, Any]) -> Dict[str, Any]:
+def _make_receipt(payload: Dict[str, Any], sign_fn=None) -> Dict[str, Any]:
     """Wrap payload in a DSSE envelope (honest UNSIGNED if no cosign key)."""
     body = json.dumps(payload, sort_keys=True, separators=(",", ":")).encode()
     honesty = "UNSIGNED — szl_dsse not present; no signature fabricated."
+    if callable(sign_fn):
+        try:
+            env = sign_fn(payload)
+            if isinstance(env, dict):
+                return env
+            honesty = "UNSIGNED - runtime signer returned a non-object; no signature fabricated."
+        except Exception as exc:
+            honesty = (f"UNSIGNED - runtime signer raised ({str(exc)[:80]}); "
+                       "no signature fabricated.")
     if _dsse is not None:
         try:
-            return _dsse.sign(payload)
+            # szl_dsse exposes sign_payload(); the former sign() call made every
+            # Ayllu receipt fall through to UNSIGNED even when the module existed.
+            if hasattr(_dsse, "sign_payload"):
+                return _dsse.sign_payload(
+                    payload, "application/vnd.szl.receipt+json")
         except Exception as exc:
             honesty = (f"UNSIGNED — szl_dsse.sign raised ({str(exc)[:80]}); "
                        "no signature fabricated.")
@@ -128,6 +145,213 @@ def _make_receipt(payload: Dict[str, Any]) -> Dict[str, Any]:
     }
 
 
+def _sha256_json(value: Any) -> str:
+    body = json.dumps(value, sort_keys=True, separators=(",", ":"),
+                      ensure_ascii=False).encode("utf-8")
+    return hashlib.sha256(body).hexdigest()
+
+
+def council_manifest(ns: str = "a11oy") -> Dict[str, Any]:
+    """Side-effect-free, investor-readable contract for the bounded council."""
+    base = f"/api/{ns}/v1/ayllu"
+    return {
+        "schema": "szl.ayllu.council-manifest/v1",
+        "contract_schema": COUNCIL_SCHEMA,
+        "contract_version": COUNCIL_CONTRACT_VERSION,
+        "purpose": (
+            "Produce a bounded, evidence-bearing advisory record from multiple "
+            "personas. The Council proposes; it never executes an external action."
+        ),
+        "try": {
+            "method": "POST",
+            "endpoint": base + "/council",
+            "body": {"prompt": "Review this proposed agent action",
+                     "personas": ["Amaru", "Yupaq", "Kamachiq"],
+                     "debate": True},
+        },
+        "evidence": [
+            "prompt SHA-256",
+            "persona/model/round/output digest per turn",
+            "Nemo governed-route decision and DSSE receipt",
+            "deterministic replay key over participants, mode, and output digests",
+            "in-process Khipu chain receipt (resets on process restart)",
+            "outer Council DSSE receipt",
+        ],
+        "limits": {
+            "prompt_chars": MAX_PROMPT_CHARS,
+            "participants": COUNCIL_MAX,
+            "debate_participants": COUNCIL_DEBATE_MAX,
+            "debate_rounds": 2,
+            "effectors": "none",
+            "decision_state": "PROPOSAL_ONLY",
+            "semantic_consensus": "NOT_MEASURED",
+            "chain_persistence": "IN_MEMORY_RESETS_ON_RESTART",
+        },
+        "reproduce": {
+            "manifest": base + "/council/manifest",
+            "verifier": f"/api/{ns}/v1/verify/receipt",
+            "public_key": "/cosign.pub",
+        },
+        "nemo": {
+            "artifact": NEMO_ARTIFACT,
+            "artifact_kind": "configuration-recipe",
+            "weights_present": False,
+            "training_state": "NOT_PERFORMED",
+            "honesty": (
+                "The current SZL-Nemo Hub artifact is a card and Modelfile recipe, "
+                "not SZL-trained weights. Council answers use the live A11OY router."
+            ),
+        },
+        "evaluation": {
+            "council_effectiveness": "NOT_MEASURED",
+            "required_next": (
+                "golden cases with decision-quality, calibration, dissent-recall, "
+                "cost, latency, and human-overturn outcomes"
+            ),
+        },
+    }
+
+
+def _nemo_council_route(prompt: str, sign_fn=None) -> Dict[str, Any]:
+    """Run the existing Nemo router and expose the evidence Council needs."""
+    try:
+        import a11oy_nemo_core as nemo
+        routed = nemo.govern_route(prompt, top_k=3, sign_fn=sign_fn)
+        experts = routed.get("experts") or []
+        return {
+            "state": routed.get("routing_evidence_state", "HEURISTIC"),
+            "source": "a11oy_nemo_core.govern_route",
+            "model": routed.get("model"),
+            "model_version": routed.get("model_version"),
+            "experts_selected": routed.get("experts_selected") or [],
+            "selection_basis": [e.get("selection_basis") for e in experts],
+            "overall_lambda_advisory": routed.get("overall_lambda_advisory"),
+            "below_advisory_floor": any(bool(e.get("below_advisory_floor"))
+                                        for e in experts),
+            "limits": routed.get("routing_limits"),
+            "receipt": routed.get("receipt"),
+        }
+    except Exception as exc:
+        return {
+            "state": "UNAVAILABLE",
+            "source": "a11oy_nemo_core.govern_route",
+            "error": type(exc).__name__,
+            "honesty": "Nemo routing unavailable; no route or score fabricated.",
+        }
+
+
+def _build_council_contract(prompt: str, result: Dict[str, Any],
+                            nemo_route: Dict[str, Any]) -> Dict[str, Any]:
+    rounds = result.get("rounds") or []
+    turn_evidence = []
+    for turn in rounds:
+        answer = turn.get("answer")
+        turn_evidence.append({
+            "persona": turn.get("persona"),
+            "round": turn.get("round"),
+            "model": turn.get("model"),
+            "stub": bool(turn.get("stub")),
+            "output_sha256": (hashlib.sha256(str(answer).encode("utf-8")).hexdigest()
+                              if answer is not None else None),
+            "energy_receipt_sha256": _receipt_sha(turn.get("energy_receipt")),
+        })
+    replay_material = {
+        "contract_version": COUNCIL_CONTRACT_VERSION,
+        "prompt_sha256": hashlib.sha256(prompt.encode("utf-8")).hexdigest(),
+        "participants": result.get("participants") or [],
+        "mode": result.get("mode"),
+        "turns": turn_evidence,
+    }
+    live_turns = sum(1 for t in turn_evidence if not t["stub"])
+    if not turn_evidence:
+        evidence_state = "UNAVAILABLE"
+    elif live_turns == len(turn_evidence):
+        evidence_state = "LIVE"
+    elif live_turns:
+        evidence_state = "MIXED"
+    else:
+        evidence_state = "STUB"
+    return {
+        "schema": COUNCIL_SCHEMA,
+        "contract_version": COUNCIL_CONTRACT_VERSION,
+        "purpose": "bounded multi-persona advisory deliberation",
+        "decision_state": "PROPOSAL_ONLY",
+        "approval_state": "HUMAN_REVIEW_REQUIRED",
+        "evidence_state": evidence_state,
+        "prompt_sha256": replay_material["prompt_sha256"],
+        "turn_evidence": turn_evidence,
+        "routing": nemo_route,
+        "formula_path": [
+            {"id": "lambda-aggregate", "state": "CONJECTURE_1_ADVISORY"},
+            {"id": "active-flux-crossover", "state": "MODELED"},
+            {"id": "dsse-pae", "state": "IMPLEMENTED"},
+        ],
+        "semantic_consensus": {
+            "state": "NOT_MEASURED",
+            "honesty": (
+                "Multiple answers do not prove consensus or correctness. Semantic "
+                "agreement, dissent recall, and decision quality require labeled evals."
+            ),
+        },
+        "limits": {
+            "participants_max": COUNCIL_MAX,
+            "debate_participants_max": COUNCIL_DEBATE_MAX,
+            "rounds_max": 2,
+            "model_calls_observed": len(turn_evidence),
+            "external_effectors": 0,
+            "automatic_commit": False,
+        },
+        "human_checkpoint": {
+            "required": True,
+            "satisfied": False,
+            "next_action": "Review evidence and explicitly approve, revise, or reject.",
+        },
+        "replay": {
+            "key": "sha256:" + _sha256_json(replay_material),
+            "material": replay_material,
+            "verifier": "/api/a11oy/v1/verify/receipt",
+            "public_key": "/cosign.pub",
+        },
+        "training": {
+            "artifact": NEMO_ARTIFACT,
+            "weights_present": False,
+            "state": "NOT_PERFORMED",
+        },
+    }
+
+
+def _mint_council_chain(contract: Dict[str, Any], ns: str = "a11oy") -> Dict[str, Any]:
+    """Append the proposal receipt to the shared in-process Khipu chain."""
+    try:
+        import szl_khipu
+        dag = szl_khipu.get_dag("ayllu_council", ns=ns)
+        receipt = dag.emit("ayllu.council.proposal", {
+            "contract_version": contract.get("contract_version"),
+            "decision_state": contract.get("decision_state"),
+            "evidence_state": contract.get("evidence_state"),
+            "prompt_sha256": contract.get("prompt_sha256"),
+            "replay_key": (contract.get("replay") or {}).get("key"),
+        })
+        chain = dag.verify_chain()
+        return {
+            "state": "LIVE",
+            "organ": "ayllu_council",
+            "receipt_id": receipt.get("digest"),
+            "seq": receipt.get("seq"),
+            "chain_verified": bool(chain.get("ok")),
+            "depth": dag.depth(),
+            "persistence": "IN_MEMORY_RESETS_ON_RESTART",
+        }
+    except Exception as exc:
+        return {
+            "state": "UNAVAILABLE",
+            "organ": "ayllu_council",
+            "receipt_id": None,
+            "error": type(exc).__name__,
+            "honesty": "Khipu append unavailable; no chain receipt fabricated.",
+        }
+
+
 # --- The /ayllu page: a working chat + council UI. 0-CDN (pure inline markup, no
 #     external assets). `__NS__`/`__VERSION__` are substituted at render time so the
 #     JS+CSS braces stay literal (no f-string brace-doubling). --------------------
@@ -172,6 +396,9 @@ font-size:11px;font-weight:800;color:var(--fg);border:1px solid var(--line);flex
 .arch{color:var(--dim);font-size:12px}
 .ans{margin-top:7px;white-space:pre-wrap}
 .rcpt{color:var(--dim);font-size:12px;margin-top:8px}
+.contract{border-left:3px solid var(--teal);padding:9px 11px;margin:10px 0;
+background:#071711;color:var(--dim);font-size:12px;line-height:1.6}
+.contract b{color:var(--fg)}
 .note{color:#da3;font-size:12px;margin-bottom:8px}
 .err{color:#e66}
 .stub{color:#da3;font-weight:700;font-size:11px}
@@ -230,6 +457,11 @@ section[id]{scroll-margin-top:72px}
 
 <section class="card" id="sec-council">
   <h2>Convene a council</h2>
+  <div class="contract"><b>Evidence-bound Council v2.</b> Every run carries a
+  Nemo route receipt, per-turn output digests, a replay key, explicit limits, and a
+  human checkpoint. State is always <code>PROPOSAL_ONLY</code>; semantic consensus and
+  Council effectiveness remain <code>NOT_MEASURED</code> until labeled evaluation exists.
+  <a href="/api/__NS__/v1/ayllu/council/manifest">machine-readable contract</a></div>
   <p class="hint">Defaults to 3 core personas; select up to 5 (⌘/Ctrl-click). Fan-out is
   capped to protect cost. Debate mode runs exactly two bounded rounds
   (after arXiv:2305.14325) and is capped to 3 personas.</p>
@@ -370,10 +602,19 @@ document.getElementById('councilbtn').onclick=async()=>{
     headers:{'content-type':'application/json'},body:JSON.stringify(body)});
   if(!ok){out.innerHTML='<span class="err">'+esc(data.error||('HTTP '+status))+'</span>'
     +(data.retry_after_s?(' (retry in '+data.retry_after_s+'s)'):'');return;}
-  const res=data.result||{}, rounds=res.rounds||[];
+  const res=data.result||{}, rounds=res.rounds||[], c=data.contract||{};
   const cap=res.cap_note?('<div class="note">'+esc(res.cap_note)+'</div>'):'';
   const r1=rounds.filter(t=>(t.round||1)===1), r2=rounds.filter(t=>t.round===2);
-  let html=cap;
+  const route=c.routing||{}, outer=data.receipt||{};
+  const contract=`<div class="contract"><b>${esc(c.decision_state||'PROPOSAL_ONLY')}</b>`
+    +` · evidence ${esc(c.evidence_state||'UNKNOWN')}`
+    +` · human review ${c.human_checkpoint&&c.human_checkpoint.required?'REQUIRED':'UNKNOWN'}`
+    +`<br>Nemo: ${esc((route.experts_selected||[]).join(' + ')||route.state||'unavailable')}`
+    +` · route ${esc(route.state||'UNKNOWN')} · outer receipt ${outer.signed?'SIGNED':'UNSIGNED'}`
+    +`<br>replay ${esc((c.replay&&c.replay.key)||'unavailable')}`
+    +`<br>semantic consensus: ${esc((c.semantic_consensus&&c.semantic_consensus.state)||'NOT_MEASURED')}`
+    +`</div>`;
+  let html=cap+contract;
   if(r2.length){
     html+='<div class="roundhdr">Round 1 — opening positions</div>'+r1.map(renderTurn).join('');
     html+='<div class="roundhdr">Round 2 — debate &amp; converge (final)</div>'+r2.map(renderTurn).join('');
@@ -465,6 +706,14 @@ def register(app, ns: str = "a11oy") -> str:
     from fastapi import Request
     from fastapi.responses import HTMLResponse, JSONResponse
 
+    def _runtime_signer(request: "Request"):
+        """Resolve the host signer lazily: Ayllu registers before serve.py creates it."""
+        try:
+            signer = getattr(request.app.state, "szl_sign_receipt", None)
+            return signer if callable(signer) else None
+        except Exception:
+            return None
+
     async def _roster(request: "Request") -> "JSONResponse":
         return JSONResponse({
             "count": len(ROSTER),
@@ -477,6 +726,9 @@ def register(app, ns: str = "a11oy") -> str:
             "version": __version__,
         })
 
+    async def _council_manifest(request: "Request") -> "JSONResponse":
+        return JSONResponse(council_manifest(ns))
+
     async def _ask(request: "Request") -> "JSONResponse":
         ok, retry = _ASK_BUCKET.check()
         if not ok:
@@ -523,7 +775,7 @@ def register(app, ns: str = "a11oy") -> str:
             "stub": turn.get("stub"),
             "energy_receipt_sha256": _receipt_sha(turn.get("energy_receipt")),
             "honesty": turn.get("honesty"),
-        })
+        }, sign_fn=_runtime_signer(request))
         _LOUNGE.post(
             p.name, turn.get("answer") or turn.get("honesty"),
             source=("brain" if turn.get("answer") is not None else "persona-fallback"))
@@ -579,15 +831,33 @@ def register(app, ns: str = "a11oy") -> str:
         if cap_note:
             result["cap_note"] = cap_note
         council_id = str(uuid.uuid4())
-        receipt = _make_receipt({
+        signer = _runtime_signer(request)
+        nemo_route = _nemo_council_route(prompt, sign_fn=signer)
+        contract = _build_council_contract(prompt, result, nemo_route)
+        contract["chain"] = _mint_council_chain(contract, ns=ns)
+        receipt_body = {
             "council_id": council_id,
             "prompt_sha256": hashlib.sha256(prompt.encode()).hexdigest(),
             "participants": result["participants"],
             "mode": result.get("mode"),
             "models": [r.get("model") for r in result.get("rounds", [])],
-        })
+            "decision_state": contract["decision_state"],
+            "evidence_state": contract["evidence_state"],
+            "replay_key": contract["replay"]["key"],
+            "turn_evidence": contract["turn_evidence"],
+            "nemo_route_receipt_sha256": _receipt_sha(
+                (contract.get("routing") or {}).get("receipt")),
+            "human_checkpoint": contract["human_checkpoint"],
+            "chain": contract["chain"],
+        }
+        receipt = _make_receipt({
+            "schema": "szl.ayllu.council-receipt/v2",
+            "body": receipt_body,
+            "payload_digest": _sha256_json(receipt_body),
+            "receipt_id": contract["chain"].get("receipt_id"),
+        }, sign_fn=signer)
         return JSONResponse({"council_id": council_id, "result": result,
-                             "receipt": receipt})
+                             "contract": contract, "receipt": receipt})
 
     async def _lounge_feed(request: "Request") -> "JSONResponse":
         return JSONResponse({"count": len(_LOUNGE.feed),
@@ -602,6 +872,9 @@ def register(app, ns: str = "a11oy") -> str:
     app.add_api_route(f"/api/{ns}/v1/ayllu/ask", _ask, methods=["POST"],
                       tags=["ayllu"],
                       summary="Ask one persona — bounded, honest, receipted")
+    app.add_api_route(f"/api/{ns}/v1/ayllu/council/manifest", _council_manifest,
+                      methods=["GET"], tags=["ayllu"],
+                      summary="Evidence-bound Council contract, limits, and reproduce path")
     app.add_api_route(f"/api/{ns}/v1/ayllu/council", _council, methods=["POST"],
                       tags=["ayllu"],
                       summary="Bounded multi-persona deliberation (capped fan-out; optional 2-round debate mode after arXiv:2305.14325)")

a11oy_nemo_core.py

@@ -70,6 +70,17 @@ from datetime import datetime, timezone
 # ---------------------------------------------------------------------------
 NEMO_NAME = "SZL-Nemo"
 NEMO_VERSION = "0.1.0-skeleton"
+NEMO_ARTIFACT = {
+    "repo_id": "SZLHOLDINGS/szl-nemo",
+    "url": "https://huggingface.co/SZLHOLDINGS/szl-nemo",
+    "kind": "configuration-recipe",
+    "weights_present": False,
+    "training_state": "NOT_PERFORMED",
+    "honesty": (
+        "The Hub artifact currently contains a model card and Modelfile recipe, "
+        "not SZL-trained weights. It must not be described as a fine-tuned model."
+    ),
+}
 
 # The honest base options (open weights, cited). We pick Qwen3-32B (Apache-2.0) as
 # the DEFAULT sovereign-local base because it fits the 2-GPU plan (TP=2). GLM (MIT)
@@ -360,11 +371,34 @@ def _select_experts(query: str, top_k: int = 2):
     and select the top_k as the active experts. Deterministic, transparent."""
     q = (query or "").lower()
     scored = []
+    # When a prompt carries no domain keyword, the old alphabetical tie-break
+    # silently selected code + counter-UAS. That was deterministic but not a
+    # defensible default for a governed council. The fallback is now explicit:
+    # governance first (policy/evidence review), then code (implementation
+    # feasibility). It remains a transparent heuristic, never a learned claim.
+    fallback_priority = {
+        "governance": 0,
+        "code": 1,
+        "finance": 2,
+        "maritime": 3,
+        "counter-uas": 4,
+    }
     for e in NEMO_EXPERTS:
         hits = [k for k in e["keywords"] if k in q]
         score = len(hits) + (0.01 * len(q))  # tiny length tiebreak; deterministic
         scored.append({"expert": e, "score": score, "matched": hits})
-    scored.sort(key=lambda r: (-r["score"], r["expert"]["id"]))
+    has_domain_signal = any(r["matched"] for r in scored)
+    if has_domain_signal:
+        scored.sort(key=lambda r: (-r["score"],
+                                   fallback_priority.get(r["expert"]["id"], 99),
+                                   r["expert"]["id"]))
+        basis = "matched-domain-keywords"
+    else:
+        scored.sort(key=lambda r: (fallback_priority.get(r["expert"]["id"], 99),
+                                   r["expert"]["id"]))
+        basis = "explicit-governance-first-fallback"
+    for row in scored:
+        row["selection_basis"] = basis
     chosen = scored[:max(1, top_k)]
     return scored, chosen
 
@@ -455,6 +489,7 @@ def govern_route(query: str, top_k: int = 2, pi_bandwidth_hz: float = 12.0,
         experts_out.append({
             "expert_id": e["id"], "title": e["title"], "desc": e["desc"],
             "matched_keywords": c["matched"], "selection_score": round(c["score"], 4),
+            "selection_basis": c.get("selection_basis"),
             "lambda_advisory": lam, "lambda_axes": axis,
             "lambda_status": DOCTRINE["lambda"],
             "below_advisory_floor": below_floor,
@@ -478,7 +513,15 @@ def govern_route(query: str, top_k: int = 2, pi_bandwidth_hz: float = 12.0,
         "experts": experts_out,
         "all_expert_scores": [{"expert_id": s["expert"]["id"],
                                "score": round(s["score"], 4),
-                               "matched": s["matched"]} for s in scored],
+                               "matched": s["matched"],
+                               "selection_basis": s.get("selection_basis")}
+                              for s in scored],
+        "routing_evidence_state": "HEURISTIC",
+        "routing_limits": (
+            "Deterministic keyword routing with an explicit governance-first "
+            "fallback; not learned, not a quality guarantee, and not a substitute "
+            "for human approval."
+        ),
         "overall_lambda_advisory": overall_lambda,
         "thompson_posteriors": _thompson_view(),
         "doctrine": DOCTRINE,
@@ -898,6 +941,7 @@ def model_card():
         "one_liner": ("SZL-Nemo — a sovereign, governed, self-improving AGENT model "
                       "built ON an open base (default Qwen3-32B, Apache-2.0)."),
         "base": NEMO_BASE,
+        "hub_artifact": NEMO_ARTIFACT,
         "what_is_ours": [
             "Governed-MoE DOMAIN-EXPERT router (Λ-governed, signed every selection) — the differentiator.",
             "MTP / speculative decoding as the inference default (app-layer; box ROADMAP→Forge).",

serve.py

@@ -2489,7 +2489,7 @@ try:
         return None
 
     @app.get("/api/a11oy/v1/readiness/tab-matrix")
-    async def _a11oy_readiness_tab_matrix(view: str = "full"):  # noqa: ANN202
+    async def _a11oy_readiness_tab_matrix():  # noqa: ANN202
         matrix = _rd_load((
             _rd_os.environ.get("SZL_TAB_MATRIX_PATH", ""),
             _rd_os.path.join(_RD_HARNESS_DIR, "tabs.json"),
@@ -2504,50 +2504,24 @@ try:
                 "layer": "a11oy readiness tab-matrix",
                 "honest": True,
                 "available": False,
-                "state": "UNAVAILABLE",
-                "contract_version": None,
                 "note": ("tabs.json not bundled with this deploy; generate it with "
                          "tools/readiness-harness/gen_tabs_matrix.py"),
                 "checked_at": _now,
-            }, status_code=200, headers={
-                "Cache-Control": "no-store",
-                "X-A11OY-Data-State": "UNAVAILABLE",
-            })
+            }, status_code=200)
         if verdict is not None:
             verdict = dict(verdict)
             verdict["available"] = True
-        _matrix_summary = {
-            "version": matrix.get("version"),
-            "doctrine": matrix.get("doctrine"),
-            "organ": matrix.get("organ"),
-            "generatedAt": matrix.get("generatedAt"),
-            "summary": matrix.get("summary", {}),
-            "stateVocabulary": matrix.get("stateVocabulary", {}),
-        }
-        _payload = {
+        return _RDJSON({
             "layer": "a11oy readiness tab-matrix",
             "honest": True,
             "available": True,
-            # The contract is a shipped snapshot.  The HTTP read is reachable,
-            # but that must not be presented as proof that every referenced
-            # organ or tab is live.
-            "state": "SNAPSHOT",
-            "transport_state": "REACHABLE",
-            "evidence_state": "SNAPSHOT",
-            "contract_version": matrix.get("version"),
-            "summary": _matrix_summary,
-            "matrix": matrix if view != "summary" else None,
+            "matrix": matrix,
             "verdict": verdict or {
                 "available": False,
                 "note": "probe not yet run on this deploy (no readiness-verdict.json)",
             },
             "checked_at": _now,
-        }
-        return _RDJSON(_payload, status_code=200, headers={
-            "Cache-Control": "no-store",
-            "X-A11OY-Data-State": "SNAPSHOT",
-            "X-A11OY-Transport-State": "REACHABLE",
-        })
+        }, status_code=200)
     print("[a11oy] Readiness tab-matrix registered: /api/a11oy/v1/readiness/tab-matrix",
           file=__import__("sys").stderr)
 except Exception as _rd_tm_e:  # pragma: no cover
@@ -8046,6 +8020,13 @@ def _a11oy_sign_receipt(payload_obj) -> dict:
     return env
 
 
+# Ayllu registers earlier in this module, before the ephemeral signer exists.
+# Expose the signer through app.state so its request handlers can resolve it
+# lazily after startup. This removes the previous always-UNSIGNED Council path
+# without re-registering duplicate routes or committing any key material.
+app.state.szl_sign_receipt = _a11oy_sign_receipt
+
+
 def _a11oy_pubkey_fpr() -> str:
     if not _A11OY_PUB_PEM:
         return "—"
@@ -11606,6 +11587,11 @@ try:
     def _a11oy_loop_pubpem():
         return _A11OY_PUB_PEM or ""
 
+    # Public verifier routes are registered earlier; resolve this callback from
+    # app.state at request time so per-boot A11OY receipts verify against the
+    # matching /cosign.pub key instead of the unrelated organization key.
+    app.state.szl_verify_receipt = _a11oy_loop_verify
+
     _loop_status = _szl_loop.register(
         app, "a11oy",
         _a11oy_sign_receipt,

szl_public_verify.py

@@ -149,7 +149,7 @@ def _norm_digest(v: Optional[str]) -> Optional[str]:
 # ---------------------------------------------------------------------------
 # Check 1 — signature (reuse szl_dsse.verify_envelope; honest labels)
 # ---------------------------------------------------------------------------
-def _check_signature(env: dict[str, Any]) -> dict[str, Any]:
+def _check_signature(env: dict[str, Any], runtime_verify_fn=None) -> dict[str, Any]:
     out: dict[str, Any] = {"check": "signature",
                            "algo": "ECDSA-P256-SHA256 over DSSE PAE"}
     try:
@@ -170,6 +170,28 @@ def _check_signature(env: dict[str, Any]) -> dict[str, Any]:
         return {**out, "status": UNSIGNED_LOCAL,
                 "detail": ("envelope has no signatures[]; nothing to verify "
                            "(honest UNSIGNED-LOCAL — no signature fabricated)")}
+    keyids = [str(s.get("keyid") or "") for s in sigs if isinstance(s, dict)]
+    if "a11oy-inimage-ecdsa-p256" in keyids:
+        # Live Nemo/Council receipts use the per-boot key served at
+        # /cosign.pub, not the long-lived organization key embedded in
+        # szl_dsse. The old static-key-only path falsely marked them MISMATCH.
+        if not callable(runtime_verify_fn):
+            return {**out, "status": UNAVAILABLE,
+                    "verify_key_url": "/cosign.pub",
+                    "keyid_expected": "a11oy-inimage-ecdsa-p256",
+                    "detail": "in-image verifier callback unavailable in this context"}
+        try:
+            runtime_verdict = runtime_verify_fn(env)
+        except Exception as e:
+            return {**out, "status": UNAVAILABLE,
+                    "verify_key_url": "/cosign.pub",
+                    "detail": f"in-image verify error: {type(e).__name__}"}
+        return {**out,
+                "status": (VERIFIED if runtime_verdict.get("signature_valid")
+                           else MISMATCH),
+                "verify_key_url": "/cosign.pub",
+                "keyid_expected": "a11oy-inimage-ecdsa-p256",
+                "detail": runtime_verdict.get("detail")}
     try:
         verdict = szl_dsse.verify_envelope(env)
     except Exception as e:
@@ -330,7 +352,7 @@ def _overall(checks: list[dict[str, Any]]) -> str:
 
 
 def verify_receipt(envelope: Any = None, receipt_id: Optional[str] = None,
-                   organ: Optional[str] = None) -> dict[str, Any]:
+                   organ: Optional[str] = None, runtime_verify_fn=None) -> dict[str, Any]:
     """Public verify. Accepts a DSSE envelope OR a receipt_id (chain lookup).
 
     Returns a structured, honestly-labelled verdict. NEVER raises into the request
@@ -392,7 +414,7 @@ def verify_receipt(envelope: Any = None, receipt_id: Optional[str] = None,
     rid = (str(receipt_id).strip().lower() if receipt_id
            else _receipt_id_from_env(env, payload_obj))
 
-    sig = _check_signature(env)
+    sig = _check_signature(env, runtime_verify_fn=runtime_verify_fn)
     dig = _check_payload_digest(env)
     chain = _check_hash_chain(rid, organ)
     checks = [sig, dig, chain]
@@ -425,6 +447,30 @@ def _shareable_link(env: dict[str, Any], rid: Optional[str]) -> dict[str, Any]:
 # Registered BEFORE the SPA catch-all (mirrors szl_khipu_verify).
 # ---------------------------------------------------------------------------
 def register(app, ns: str = "a11oy") -> dict:
+    async def _verify_manifest():  # noqa: ANN202
+        return JSONResponse({
+            "schema": "szl.public-receipt-verifier/manifest/v1",
+            "state": "LIVE",
+            "purpose": "Independently verify a pasted DSSE receipt or receipt id.",
+            "try": {
+                "method": "POST",
+                "endpoint": f"/api/{ns}/v1/verify/receipt",
+                "body": {"envelope": {"payloadType": "...", "payload": "...",
+                                      "signatures": []}},
+            },
+            "evidence": ["signature", "payload_digest", "hash_chain"],
+            "limits": (
+                "PASS means every check that could run passed and none mismatched; "
+                "it does not prove the model output is factually correct."
+            ),
+            "reproduce": {
+                "public_key": "/cosign.pub",
+                "human_ui": "/verify",
+                "shareable_get": f"/api/{ns}/v1/verify/receipt/{{receipt_id}}",
+            },
+            "doctrine": _DOCTRINE,
+        })
+
     async def _verify_post(request: Request):  # noqa: ANN202
         try:
             body = await request.json()
@@ -435,7 +481,9 @@ def register(app, ns: str = "a11oy") -> dict:
         envelope = body.get("envelope")
         receipt_id = body.get("receipt_id") or body.get("receipt")
         organ = body.get("organ")
-        result = verify_receipt(envelope=envelope, receipt_id=receipt_id, organ=organ)
+        runtime_verify = getattr(request.app.state, "szl_verify_receipt", None)
+        result = verify_receipt(envelope=envelope, receipt_id=receipt_id, organ=organ,
+                                runtime_verify_fn=runtime_verify)
         status = 200 if result.get("ok") else 400
         return JSONResponse(result, status_code=status,
                             headers={"x-szl-verify-verdict": str(result.get("verdict", ""))})
@@ -445,14 +493,23 @@ def register(app, ns: str = "a11oy") -> dict:
         return JSONResponse(result, status_code=200,
                             headers={"x-szl-verify-verdict": str(result.get("verdict", ""))})
 
+    # Capture the pre-existing routes because callers may register this module
+    # after a generic /api/{ns}/{path:path} proxy. We front-move the exact
+    # verifier routes after creation so ordered Starlette matching is stable.
+    existing_routes = list(app.router.routes)
     prefixes = [f"/api/{ns}/v1/verify", "/v1/verify"]
     routes: list[str] = []
     for p in prefixes:
+        app.add_api_route(f"{p}/receipt", _verify_manifest, methods=["GET"],
+                          include_in_schema=True)
         app.add_api_route(f"{p}/receipt", _verify_post, methods=["POST"],
                           include_in_schema=True)
         app.add_api_route(f"{p}/receipt/{{receipt_id}}", _verify_get_path,
                           methods=["GET"], include_in_schema=True)
-        routes.extend([f"{p}/receipt (POST)", f"{p}/receipt/{{receipt_id}} (GET)"])
+        routes.extend([f"{p}/receipt (GET manifest)", f"{p}/receipt (POST)",
+                       f"{p}/receipt/{{receipt_id}} (GET)"])
+    added_routes = list(app.router.routes[len(existing_routes):])
+    app.router.routes[:] = added_routes + existing_routes
     print(f"[{ns}] szl_public_verify routes registered "
           f"(PUBLIC verify-a-receipt, {len(routes)} routes)", flush=True)
     return {"ok": True, "ns": ns, "routes": routes}

test/test_council_contract.py

@@ -0,0 +1,82 @@
+import unittest
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+import a11oy_ayllu as ayllu
+import a11oy_nemo_core as nemo
+
+
+class CouncilContractTests(unittest.TestCase):
+    def _result(self):
+        return {
+            "participants": ["Amaru", "Yupaq"],
+            "mode": "single-round",
+            "rounds": [
+                {"persona": "Amaru", "round": 1, "model": "test-model",
+                 "stub": False, "answer": "Architecture proposal."},
+                {"persona": "Yupaq", "round": 1, "model": "test-model",
+                 "stub": False, "answer": "Evidence gap."},
+            ],
+        }
+
+    def test_generic_nemo_route_is_governance_first(self):
+        route = nemo.govern_route("Review a high-consequence agent action", top_k=2)
+        self.assertEqual(route["experts_selected"], ["governance", "code"])
+        self.assertEqual(route["routing_evidence_state"], "HEURISTIC")
+        self.assertEqual(route["experts"][0]["selection_basis"],
+                         "explicit-governance-first-fallback")
+
+    def test_contract_is_proposal_only_and_replay_is_deterministic(self):
+        routing = {"state": "HEURISTIC", "experts_selected": ["governance"]}
+        one = ayllu._build_council_contract("review this", self._result(), routing)
+        two = ayllu._build_council_contract("review this", self._result(), routing)
+        self.assertEqual(one["schema"], ayllu.COUNCIL_SCHEMA)
+        self.assertEqual(one["decision_state"], "PROPOSAL_ONLY")
+        self.assertEqual(one["semantic_consensus"]["state"], "NOT_MEASURED")
+        self.assertTrue(one["human_checkpoint"]["required"])
+        self.assertEqual(one["evidence_state"], "LIVE")
+        self.assertEqual(one["replay"]["key"], two["replay"]["key"])
+
+    def test_runtime_signer_is_preferred(self):
+        def signer(payload):
+            return {"signed": True, "payload": "encoded", "signatures": [{"sig": "x"}]}
+
+        receipt = ayllu._make_receipt({"decision": "proposal"}, sign_fn=signer)
+        self.assertTrue(receipt["signed"])
+        self.assertEqual(receipt["payload"], "encoded")
+
+    def test_manifest_discloses_no_trained_weights(self):
+        manifest = ayllu.council_manifest()
+        self.assertFalse(manifest["nemo"]["weights_present"])
+        self.assertEqual(manifest["nemo"]["training_state"], "NOT_PERFORMED")
+        self.assertEqual(manifest["limits"]["decision_state"], "PROPOSAL_ONLY")
+
+    def test_http_council_emits_signed_contract(self):
+        app = FastAPI()
+        app.state.szl_sign_receipt = lambda payload: {
+            "signed": True, "payload": "encoded", "signatures": [{"sig": "test"}]}
+        ayllu.register(app)
+
+        async def fake_complete(system, prompt, **kwargs):
+            return {"text": "bounded answer", "model": "test-model", "stub": False}
+
+        original = ayllu._backend.model_complete
+        ayllu._backend.model_complete = fake_complete
+        try:
+            response = TestClient(app).post(
+                "/api/a11oy/v1/ayllu/council",
+                json={"prompt": "Review this proposal", "personas": ["Amaru"]})
+        finally:
+            ayllu._backend.model_complete = original
+        self.assertEqual(response.status_code, 200)
+        body = response.json()
+        self.assertEqual(body["contract"]["decision_state"], "PROPOSAL_ONLY")
+        self.assertTrue(body["receipt"]["signed"])
+        self.assertEqual(body["contract"]["routing"]["state"], "HEURISTIC")
+        self.assertEqual(body["contract"]["chain"]["state"], "LIVE")
+        self.assertTrue(body["contract"]["chain"]["chain_verified"])
+
+
+if __name__ == "__main__":
+    unittest.main()

test/test_public_verify_routes.py

@@ -0,0 +1,56 @@
+import base64
+import json
+import unittest
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+import szl_public_verify
+
+
+class PublicVerifyRouteTests(unittest.TestCase):
+    def setUp(self):
+        self.app = FastAPI()
+
+        @self.app.api_route("/api/a11oy/{path:path}", methods=["GET", "POST"])
+        async def proxy_catch_all(path: str):
+            return {"caught_by": "proxy", "path": path}
+
+        szl_public_verify.register(self.app, ns="a11oy")
+        self.client = TestClient(self.app)
+
+    def test_exact_routes_are_before_proxy(self):
+        paths = [getattr(route, "path", None) for route in self.app.router.routes]
+        self.assertLess(paths.index("/api/a11oy/v1/verify/receipt"),
+                        paths.index("/api/a11oy/{path:path}"))
+
+    def test_get_exact_path_returns_manifest(self):
+        response = self.client.get("/api/a11oy/v1/verify/receipt")
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json()["schema"],
+                         "szl.public-receipt-verifier/manifest/v1")
+
+    def test_post_exact_path_reaches_verifier(self):
+        response = self.client.post("/api/a11oy/v1/verify/receipt", json={})
+        self.assertEqual(response.status_code, 400)
+        self.assertNotIn("caught_by", response.json())
+
+    def test_in_image_receipt_uses_runtime_verifier(self):
+        self.app.state.szl_verify_receipt = lambda envelope: {
+            "signature_valid": True, "detail": "verified by test runtime key"}
+        payload = base64.b64encode(json.dumps({"decision": "proposal"}).encode()).decode()
+        envelope = {
+            "payloadType": "application/vnd.szl.receipt+json",
+            "payload": payload,
+            "signatures": [{"keyid": "a11oy-inimage-ecdsa-p256", "sig": "test"}],
+        }
+        response = self.client.post("/api/a11oy/v1/verify/receipt",
+                                    json={"envelope": envelope})
+        self.assertEqual(response.status_code, 200)
+        signature = response.json()["checks"][0]
+        self.assertEqual(signature["status"], "VERIFIED")
+        self.assertEqual(signature["verify_key_url"], "/cosign.pub")
+
+
+if __name__ == "__main__":
+    unittest.main()