fix(holographic): enforce same-origin bounded brain evidence

static/3d/brain.html

@@ -8,18 +8,19 @@
      /static/3d/vendor/... importmap below (see VENDOR_MANIFEST.md). System fonts only.
 
      This page is a SELF-CONTAINED, MOLDABLE 3D brain of the SZL Holdings estate.
-     Eight lobes are wired to eight LIVE public reads, fetched client-side on load:
+     Eight lobes are wired to one same-origin evidence contract. On each request the
+     server performs fixed-allowlist, read-only, timeout + byte-bounded public reads:
        · Models / Datasets / Spaces / Collections — Hugging Face Hub API (SZLHOLDINGS)
        · Repositories — GitHub REST API (org szl-holdings)
-       · Proved formulas — the ProvedFormulas.lean source file, fetched raw from the
-         szl-holdings/a11oy repository and its `theorem` declarations counted in-browser.
+       · Proved formulas — the ProvedFormulas.lean source file, fetched server-side from
+         szl-holdings/a11oy and its `theorem` declarations counted in that observation.
        · Fleet vitals — live /healthz probes of the organ Spaces (a11oy · killinchu ·
          anatomy · amaru · sentra), each answer is that organ's own, right now.
        · Open frontier — live Hub counts of the open-weights orgs the a11oy backbone
          is built to route to (DeepSeek · Qwen · Kimi/Moonshot) plus GLM/Z.ai (watched).
      Every number on screen is MEASURED from those live reads (a real 0 stays 0) or
      UNKNOWN where the source exposes none; an unreachable feed degrades to an honest
-     NO-LIVE-DATA state. Nothing is ever fabricated.
+     NO-LIVE-DATA state. There is no stale cache or hidden fallback. Nothing is fabricated.
 
      MOLDING is a local, display-only sculpt: dragging in Mold mode displaces mesh
      vertices on YOUR device only. It never changes, and can never change, any
@@ -125,7 +126,7 @@
 </div>
 <div id="surface-caption" title=""></div>
 <footer>Doctrine v11 · Λ = Conjecture 1 · eight lobes wired live: Hugging Face Hub (SZLHOLDINGS + open-frontier orgs) ·
- GitHub org (szl-holdings) · ProvedFormulas.lean counted in-browser from raw source · organ /healthz vitals ·
+ GitHub org (szl-holdings) · ProvedFormulas.lean counted through a same-origin bounded evidence route · organ /healthz vitals ·
  every count MEASURED or honestly UNKNOWN / NO-LIVE-DATA · sculpting is local + display-only ·
  0 runtime CDN (three.js vendored in-image) · trust &lt; 100%</footer>
 
@@ -136,16 +137,16 @@ import * as label from "/static/3d/szl3d/szl3d_label.js";
 import * as THREE from "three";
 
 // ---------------------------------------------------------------------------
-// Doctrine v11 (binding): WIRE TO LIVE DATA. Eight lobes = eight live public reads.
+// Doctrine v11 (binding): WIRE TO LIVE DATA. Eight lobes = one same-origin
+// evidence contract backed by fixed, bounded, read-only public observations.
 // Every value is MEASURED from a live read (a real 0 stays 0), or UNKNOWN where
 // the source exposes none. A failed feed shows NO-LIVE-DATA, never a guess.
 // Molding is a local display-only sculpt — it cannot alter any measured value.
 // ---------------------------------------------------------------------------
 
-const HF_API = "https://huggingface.co/api";
 const HF_ORG = "SZLHOLDINGS";
 const GH_ORG = "szl-holdings";
-const LEAN_RAW = "https://raw.githubusercontent.com/szl-holdings/a11oy/main/proofs/lutar-lean/Lutar/Puriq/Formulas/ProvedFormulas.lean";
+const BRAIN_EVIDENCE = "/api/a11oy/v1/holographic/brain/evidence";
 
 // Palette accents (doctrine-safe — NEVER purple). One per lobe.
 const COL = {
@@ -161,54 +162,57 @@ const COL = {
   wire: 0x2a8f86,
 };
 
-function numOr(x) {
-  if (x === null || x === undefined) return null;
-  const n = typeof x === "number" ? x : Number(x);
-  return Number.isFinite(n) ? n : null;
-}
-
 // Each lobe: a fixed anatomical direction on the cortex + one live read.
 // `fetchStat` returns { text, honesty, caption } — resolved independently so a
 // single failing feed only degrades its own lobe.
-const PAGE_CAP = 100;
-function capText(n) { return n >= PAGE_CAP ? PAGE_CAP + "+ (page cap — lower bound)" : String(n); }
-function capHonesty(n) { return n >= PAGE_CAP ? "STRUCTURAL-ONLY" : "MEASURED"; }
-
-async function getJSON(url) {
-  // 10s abort: a hung request must degrade to NO-LIVE-DATA, never hang at "…".
-  const r = await fetch(url, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(10000) });
+async function getEvidence() {
+  // One same-origin browser read. The server performs a fixed-allowlist, read-only,
+  // timeout + byte-bounded observation. There is no last-good or hidden fallback.
+  const r = await fetch(BRAIN_EVIDENCE, {
+    headers: { accept: "application/json" }, cache: "no-store",
+    signal: AbortSignal.timeout(12000),
+  });
   if (!r.ok) throw new Error("HTTP " + r.status);
   const j = await r.json();
-  if (!Array.isArray(j)) throw new Error("unexpected payload");
+  if (!j || j.schema !== "a11oy.holographic.brain-evidence.v1" || !j.lobes) {
+    throw new Error("unexpected evidence payload");
+  }
   return j;
 }
+const EVIDENCE = getEvidence();
+
+function requireLive(evidence, key) {
+  const lobe = evidence.lobes && evidence.lobes[key];
+  if (!lobe || lobe.state !== "LIVE") {
+    throw new Error((lobe && lobe.reason) || "source unavailable");
+  }
+  return lobe;
+}
+
+function countText(lobe) {
+  return lobe.lower_bound ? lobe.count + "+ (page cap — lower bound)" : String(lobe.count);
+}
 
 const LOBES = [
   {
     key: "formulas", name: "Frontal — proved formulas", color: COL.formulas,
     dir: [0, 0.55, 0.95], url: "https://github.com/" + GH_ORG + "/a11oy/blob/main/proofs/lutar-lean/Lutar/Puriq/Formulas/ProvedFormulas.lean",
     fetchStat: async () => {
-      // Count `theorem` declarations in the live source bytes — a real in-browser
-      // measurement of the file as it exists on main right now.
-      const r = await fetch(LEAN_RAW, { signal: AbortSignal.timeout(10000) });
-      if (!r.ok) throw new Error("HTTP " + r.status);
-      const src = await r.text();
-      const n = (src.match(/(^|\n)\s*theorem\s/g) || []).length;
+      const s = requireLive(await EVIDENCE, "formulas");
+      const n = s.theorem_count;
       return { text: n + " theorems", honesty: "MEASURED",
-        caption: "Frontal lobe · " + n + " `theorem` declarations counted in-browser from the live " +
-          "ProvedFormulas.lean source on main · MEASURED (raw.githubusercontent.com) · click to read the proofs" };
+        caption: "Frontal lobe · " + n + " `theorem` declarations counted server-side from the live " +
+          "ProvedFormulas.lean source on main · MEASURED via same-origin bounded evidence route · click to read the proofs" };
     },
   },
   {
     key: "models", name: "Parietal — models", color: COL.models,
     dir: [0.55, 0.85, -0.15], url: "https://huggingface.co/" + HF_ORG,
     fetchStat: async () => {
-      const j = await getJSON(HF_API + "/models?author=" + HF_ORG + "&limit=" + PAGE_CAP + "&full=false");
-      let dl = 0, dlKnown = true;
-      j.forEach((m) => { const d = numOr(m.downloads); if (d === null) dlKnown = false; else dl += d; });
-      return { text: capText(j.length), honesty: capHonesty(j.length),
-        caption: "Parietal lobe · " + capText(j.length) + " models on the live Hub · " +
-          (dlKnown ? "Σ " + dl.toLocaleString() + " downloads · MEASURED (live Hub)" : "some download counts UNKNOWN") +
+      const s = requireLive(await EVIDENCE, "models");
+      return { text: countText(s), honesty: s.lower_bound ? "STRUCTURAL-ONLY" : "MEASURED",
+        caption: "Parietal lobe · " + countText(s) + " models on the live Hub · " +
+          (s.downloads_sum_known ? "Σ " + s.downloads_sum.toLocaleString() + " downloads · MEASURED (live Hub)" : "some download counts UNKNOWN") +
           " · click to open " + HF_ORG + " on Hugging Face" };
     },
   },
@@ -216,12 +220,10 @@ const LOBES = [
     key: "datasets", name: "Temporal L — datasets", color: COL.datasets,
     dir: [-0.95, -0.05, 0.15], url: "https://huggingface.co/" + HF_ORG + "?tab=datasets" ,
     fetchStat: async () => {
-      const j = await getJSON(HF_API + "/datasets?author=" + HF_ORG + "&limit=" + PAGE_CAP + "&full=false");
-      let dl = 0, dlKnown = true;
-      j.forEach((d) => { const n = numOr(d.downloads); if (n === null) dlKnown = false; else dl += n; });
-      return { text: capText(j.length), honesty: capHonesty(j.length),
-        caption: "Left temporal lobe · " + capText(j.length) + " datasets on the live Hub · " +
-          (dlKnown ? "Σ " + dl.toLocaleString() + " downloads · MEASURED (live Hub)" : "some download counts UNKNOWN") +
+      const s = requireLive(await EVIDENCE, "datasets");
+      return { text: countText(s), honesty: s.lower_bound ? "STRUCTURAL-ONLY" : "MEASURED",
+        caption: "Left temporal lobe · " + countText(s) + " datasets on the live Hub · " +
+          (s.downloads_sum_known ? "Σ " + s.downloads_sum.toLocaleString() + " downloads · MEASURED (live Hub)" : "some download counts UNKNOWN") +
           " · click to open the datasets" };
     },
   },
@@ -229,12 +231,10 @@ const LOBES = [
     key: "spaces", name: "Temporal R — Spaces", color: COL.spaces,
     dir: [0.95, -0.05, 0.15], url: "https://huggingface.co/" + HF_ORG + "?tab=spaces",
     fetchStat: async () => {
-      const j = await getJSON(HF_API + "/spaces?author=" + HF_ORG + "&limit=" + PAGE_CAP + "&full=false");
-      let likes = 0, lKnown = true;
-      j.forEach((s) => { const n = numOr(s.likes); if (n === null) lKnown = false; else likes += n; });
-      return { text: capText(j.length), honesty: capHonesty(j.length),
-        caption: "Right temporal lobe · " + capText(j.length) + " live Spaces · " +
-          (lKnown ? "Σ " + likes.toLocaleString() + " likes · MEASURED (live Hub)" : "some like counts UNKNOWN") +
+      const s = requireLive(await EVIDENCE, "spaces");
+      return { text: countText(s), honesty: s.lower_bound ? "STRUCTURAL-ONLY" : "MEASURED",
+        caption: "Right temporal lobe · " + countText(s) + " live Spaces · " +
+          (s.likes_sum_known ? "Σ " + s.likes_sum.toLocaleString() + " likes · MEASURED (live Hub)" : "some like counts UNKNOWN") +
           " · Space downloads: UNKNOWN (Hub exposes none) · click to open the Spaces" };
     },
   },
@@ -242,9 +242,10 @@ const LOBES = [
     key: "collections", name: "Occipital — collections", color: COL.collections,
     dir: [0, 0.35, -1], url: "https://huggingface.co/" + HF_ORG,
     fetchStat: async () => {
-      const j = await getJSON(HF_API + "/collections?owner=" + HF_ORG + "&limit=" + PAGE_CAP);
-      return { text: capText(j.length), honesty: capHonesty(j.length),
-        caption: "Occipital lobe · " + capText(j.length) + " curated collections on the live Hub · " + capHonesty(j.length) + " · " +
+      const s = requireLive(await EVIDENCE, "collections");
+      const honesty = s.lower_bound ? "STRUCTURAL-ONLY" : "MEASURED";
+      return { text: countText(s), honesty,
+        caption: "Occipital lobe · " + countText(s) + " curated collections on the live Hub · " + honesty + " · " +
           "click to open " + HF_ORG };
     },
   },
@@ -252,12 +253,10 @@ const LOBES = [
     key: "repos", name: "Cerebellum — repositories", color: COL.repos,
     dir: [0, -0.75, -0.75], url: "https://github.com/" + GH_ORG,
     fetchStat: async () => {
-      const j = await getJSON("https://api.github.com/orgs/" + GH_ORG + "/repos?per_page=" + PAGE_CAP + "&type=public");
-      let stars = 0, sKnown = true;
-      j.forEach((r) => { const n = numOr(r.stargazers_count); if (n === null) sKnown = false; else stars += n; });
-      return { text: capText(j.length), honesty: capHonesty(j.length),
-        caption: "Cerebellum · " + capText(j.length) + " public repositories in the live GitHub org · " +
-          (sKnown ? "Σ " + stars.toLocaleString() + " stars · MEASURED (GitHub API)" : "some star counts UNKNOWN") +
+      const s = requireLive(await EVIDENCE, "repos");
+      return { text: countText(s), honesty: s.lower_bound ? "STRUCTURAL-ONLY" : "MEASURED",
+        caption: "Cerebellum · " + countText(s) + " public repositories in the live GitHub org · " +
+          (s.stargazers_count_sum_known ? "Σ " + s.stargazers_count_sum.toLocaleString() + " stars · MEASURED (GitHub API)" : "some star counts UNKNOWN") +
           " · click to open github.com/" + GH_ORG };
     },
   },
@@ -265,23 +264,10 @@ const LOBES = [
     key: "fleet", name: "Brainstem — fleet vitals", color: COL.fleet,
     dir: [0, -0.92, 0.05], url: "https://huggingface.co/" + HF_ORG,
     fetchStat: async () => {
-      // Live /healthz probes of the organ Spaces — each value is that organ's OWN
-      // answer, fetched right now. A 404 means "no health endpoint exposed", which
-      // is reported as exactly that — never claimed as up OR down.
-      const ORGANS = ["a11oy", "killinchu", "anatomy", "amaru", "sentra"];
-      const results = await Promise.all(ORGANS.map(async (o) => {
-        try {
-          const r = await fetch("https://szlholdings-" + o + ".hf.space/healthz",
-            { headers: { accept: "application/json" }, signal: AbortSignal.timeout(10000) });
-          if (!r.ok) return { o, state: "no /healthz (HTTP " + r.status + ")", up: false };
-          const j = await r.json();
-          return { o, state: (j && j.status) ? String(j.status) : "unknown payload", up: !!(j && j.status === "ok") };
-        } catch (_) { return { o, state: "unreachable", up: false }; }
-      }));
-      const up = results.filter((r) => r.up).length;
-      return { text: up + "/" + ORGANS.length + " organs report ok", honesty: "MEASURED",
-        caption: "Brainstem · live /healthz probes made from your browser just now — " +
-          results.map((r) => r.o + ": " + (r.up ? "ok" : r.state)).join(" · ") +
+      const s = requireLive(await EVIDENCE, "fleet");
+      return { text: s.up_count + "/" + s.organ_count + " organs report ok", honesty: "MEASURED",
+        caption: "Brainstem · live /healthz probes made by the same-origin bounded evidence route — " +
+          s.organs.map((r) => r.organ + ": " + (r.up ? "ok" : r.health_state)).join(" · ") +
           " · MEASURED (each value is that organ's own live answer; a missing endpoint is said, not guessed)" };
     },
   },
@@ -289,22 +275,13 @@ const LOBES = [
     key: "frontier", name: "R frontal — open frontier", color: COL.frontier,
     dir: [0.7, 0.45, 0.62], url: "https://huggingface.co/deepseek-ai",
     fetchStat: async () => {
-      // The open-weights orgs the multi-provider backbone is built to route to
-      // (DeepSeek, Qwen, Kimi/Moonshot are wired providers; GLM/Z.ai is watched).
-      // Counted live from the public Hub — page cap makes totals honest lower bounds.
-      const ORGS = ["deepseek-ai", "Qwen", "moonshotai", "zai-org"];
-      const counts = await Promise.all(ORGS.map(async (a) => {
-        const j = await getJSON(HF_API + "/models?author=" + a + "&limit=" + PAGE_CAP + "&full=false");
-        return { a, n: j.length };
-      }));
-      let total = 0, capped = false;
-      counts.forEach((c) => { total += c.n; if (c.n >= PAGE_CAP) capped = true; });
-      return { text: (capped ? "\u2265 " + total : String(total)) + " open models",
-        honesty: capped ? "STRUCTURAL-ONLY" : "MEASURED",
+      const s = requireLive(await EVIDENCE, "frontier");
+      return { text: (s.lower_bound ? "\u2265 " + s.count : String(s.count)) + " open models",
+        honesty: s.data_label,
         caption: "Right frontal · the open-weights frontier harnessed by the a11oy backbone " +
           "(DeepSeek · Qwen · Kimi/Moonshot — wired providers · GLM/Z.ai — watched) · " +
-          counts.map((c) => c.a + ": " + (c.n >= PAGE_CAP ? PAGE_CAP + "+" : c.n)).join(" · ") +
-          " · counted live from the public Hub (page cap " + PAGE_CAP + "/org \u2014 lower bound)" };
+          s.sources.map((c) => c.org + ": " + c.count_display).join(" · ") +
+          " · counted live from the public Hub via same-origin bounded evidence (page cap 100/org — lower bound when capped)" };
     },
   },
 ];
@@ -586,8 +563,9 @@ function buildHud() {
 
   const note = document.createElement("div");
   note.className = "note";
-  note.textContent = "Each lobe is one live public read (Hugging Face Hub, GitHub API, the raw " +
-    "ProvedFormulas.lean source counted in-browser, or the organs' own /healthz answers). " +
+  note.textContent = "Each lobe is one live public observation (Hugging Face Hub, GitHub API, the raw " +
+    "ProvedFormulas.lean source, or the organs' own /healthz answers), exposed to this page through one " +
+    "same-origin, fixed-allowlist, bounded read-only evidence contract with no stale fallback. " +
     "Every count is MEASURED from that read (a real 0 stays 0); " +
     "UNKNOWN where the source exposes none; NO-LIVE-DATA if a feed is unreachable. Molding the cortex is a " +
     "local, display-only sculpt — it never changes a measured number. Nothing is fabricated. \u039b = Conjecture 1.";

szl3d_holographic.py

@@ -25,9 +25,15 @@ Mirrors the existing in-image static-serve pattern (serve.py /static/shared/{fna
 """
 from __future__ import annotations
 
+import asyncio
+import json
 import os
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from datetime import datetime, timezone
 from pathlib import Path
-from typing import Any, Dict, List
+from typing import Any, Callable, Dict, List
+from urllib.error import HTTPError
+from urllib.request import Request, urlopen
 
 # Surface slots (id, human title) — the frontier tier + the 9 estate surfaces.
 SURFACES: List[Dict[str, str]] = [
@@ -236,6 +242,226 @@ def no_cdn_violations(base: Path):
                     break
 
 
+# The Brain surface is a browser-side part of the sovereign 0-CDN tree.  It must
+# never call third-party hosts directly.  These URLs are therefore fixed here,
+# server-side, with no caller-controlled target (and thus no open proxy / SSRF
+# surface).  GET /.../brain/evidence performs one bounded, read-only observation
+# and returns explicit LIVE / DEGRADED / UNAVAILABLE states.  There is deliberately
+# no stale cache and no silent fallback.
+_BRAIN_PAGE_CAP = 100
+_BRAIN_TIMEOUT_S = 4.0
+_BRAIN_MAX_BYTES = 5 * 1024 * 1024
+_BRAIN_SOURCES: Dict[str, str] = {
+    "formulas": "https://raw.githubusercontent.com/szl-holdings/a11oy/main/proofs/lutar-lean/Lutar/Puriq/Formulas/ProvedFormulas.lean",
+    "models": "https://huggingface.co/api/models?author=SZLHOLDINGS&limit=100&full=false",
+    "datasets": "https://huggingface.co/api/datasets?author=SZLHOLDINGS&limit=100&full=false",
+    "spaces": "https://huggingface.co/api/spaces?author=SZLHOLDINGS&limit=100&full=false",
+    "collections": "https://huggingface.co/api/collections?owner=SZLHOLDINGS&limit=100",
+    "repos": "https://api.github.com/orgs/szl-holdings/repos?per_page=100&type=public",
+    "organ:a11oy": "https://szlholdings-a11oy.hf.space/healthz",
+    "organ:killinchu": "https://szlholdings-killinchu.hf.space/healthz",
+    "organ:anatomy": "https://szlholdings-anatomy.hf.space/healthz",
+    "organ:amaru": "https://szlholdings-amaru.hf.space/healthz",
+    "organ:sentra": "https://szlholdings-sentra.hf.space/healthz",
+    "frontier:deepseek-ai": "https://huggingface.co/api/models?author=deepseek-ai&limit=100&full=false",
+    "frontier:Qwen": "https://huggingface.co/api/models?author=Qwen&limit=100&full=false",
+    "frontier:moonshotai": "https://huggingface.co/api/models?author=moonshotai&limit=100&full=false",
+    "frontier:zai-org": "https://huggingface.co/api/models?author=zai-org&limit=100&full=false",
+}
+
+
+def _brain_read(url: str) -> bytes:
+    """Read one allowlisted public source with a hard time and byte bound."""
+    req = Request(url, headers={"Accept": "application/json, text/plain;q=0.9",
+                                "User-Agent": "a11oy-holographic-evidence/1.0"})
+    with urlopen(req, timeout=_BRAIN_TIMEOUT_S) as response:  # nosec B310: fixed allowlist
+        data = response.read(_BRAIN_MAX_BYTES + 1)
+    if len(data) > _BRAIN_MAX_BYTES:
+        raise ValueError("response_too_large")
+    return data
+
+
+def _brain_json(url: str) -> Any:
+    return json.loads(_brain_read(url).decode("utf-8"))
+
+
+def _brain_text(url: str) -> str:
+    return _brain_read(url).decode("utf-8")
+
+
+def _brain_health(url: str) -> Dict[str, Any]:
+    """Observe an organ health endpoint.  An HTTP response is itself a measured
+    observation; a missing endpoint is not rewritten into either UP or DOWN."""
+    try:
+        payload = _brain_json(url)
+        status = str(payload.get("status", "unknown payload")) if isinstance(payload, dict) else "unknown payload"
+        return {"read_state": "LIVE", "health_state": status, "up": status == "ok"}
+    except HTTPError as exc:
+        return {"read_state": "LIVE", "health_state": f"no /healthz (HTTP {exc.code})", "up": False}
+
+
+def _brain_error(exc: BaseException) -> str:
+    if isinstance(exc, HTTPError):
+        return f"upstream_http_{exc.code}"
+    if isinstance(exc, (TimeoutError, OSError)):
+        return "upstream_unreachable_or_timeout"
+    if isinstance(exc, (UnicodeError, json.JSONDecodeError)):
+        return "upstream_invalid_payload"
+    if isinstance(exc, ValueError) and str(exc) == "response_too_large":
+        return "upstream_response_too_large"
+    return "upstream_read_failed"
+
+
+def _unavailable(source_url: str, exc: BaseException) -> Dict[str, Any]:
+    return {"state": "UNAVAILABLE", "data_label": "UNAVAILABLE",
+            "source_url": source_url, "reason": _brain_error(exc)}
+
+
+def _count_payload(items: Any, source_url: str, sum_field: str | None = None) -> Dict[str, Any]:
+    if not isinstance(items, list):
+        raise ValueError("unexpected_payload_shape")
+    n = len(items)
+    result: Dict[str, Any] = {
+        "state": "LIVE", "data_label": "MEASURED", "source_url": source_url,
+        "count": n, "count_display": f"{n}+" if n >= _BRAIN_PAGE_CAP else str(n),
+        "page_cap": _BRAIN_PAGE_CAP, "lower_bound": n >= _BRAIN_PAGE_CAP,
+    }
+    if sum_field:
+        values = [item.get(sum_field) for item in items if isinstance(item, dict)]
+        known = len(values) == n and all(isinstance(value, (int, float)) for value in values)
+        result[f"{sum_field}_sum"] = sum(values) if known else None
+        result[f"{sum_field}_sum_known"] = known
+    return result
+
+
+def brain_evidence(
+    fetch_json: Callable[[str], Any] = _brain_json,
+    fetch_text: Callable[[str], str] = _brain_text,
+    fetch_health: Callable[[str], Dict[str, Any]] = _brain_health,
+) -> Dict[str, Any]:
+    """Build one honest Brain observation from fixed public sources.
+
+    All reads run concurrently under fixed worker, timeout, and response-size
+    bounds.  Partial results remain visible, but an incomplete composite lobe is
+    UNAVAILABLE rather than being presented as a complete count.
+    """
+    observed_at = datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+    raw: Dict[str, Any] = {}
+    errors: Dict[str, BaseException] = {}
+
+    def read(key: str) -> Any:
+        url = _BRAIN_SOURCES[key]
+        if key == "formulas":
+            return fetch_text(url)
+        if key.startswith("organ:"):
+            return fetch_health(url)
+        return fetch_json(url)
+
+    with ThreadPoolExecutor(max_workers=8, thread_name_prefix="brain-evidence") as pool:
+        futures = {pool.submit(read, key): key for key in _BRAIN_SOURCES}
+        for future in as_completed(futures):
+            key = futures[future]
+            try:
+                raw[key] = future.result()
+            except BaseException as exc:  # each source degrades independently
+                errors[key] = exc
+
+    lobes: Dict[str, Dict[str, Any]] = {}
+    try:
+        if "formulas" in errors:
+            raise errors["formulas"]
+        source = raw["formulas"]
+        theorem_count = len(_re.findall(r"(^|\n)\s*theorem\s", source))
+        lobes["formulas"] = {
+            "state": "LIVE", "data_label": "MEASURED",
+            "source_url": _BRAIN_SOURCES["formulas"], "theorem_count": theorem_count,
+        }
+    except BaseException as exc:
+        lobes["formulas"] = _unavailable(_BRAIN_SOURCES["formulas"], exc)
+
+    for key, sum_field in (("models", "downloads"), ("datasets", "downloads"),
+                           ("spaces", "likes"), ("collections", None),
+                           ("repos", "stargazers_count")):
+        try:
+            if key in errors:
+                raise errors[key]
+            lobes[key] = _count_payload(raw[key], _BRAIN_SOURCES[key], sum_field)
+        except BaseException as exc:
+            lobes[key] = _unavailable(_BRAIN_SOURCES[key], exc)
+
+    organ_keys = [key for key in _BRAIN_SOURCES if key.startswith("organ:")]
+    organs: List[Dict[str, Any]] = []
+    fleet_complete = True
+    for key in organ_keys:
+        name = key.split(":", 1)[1]
+        if key in errors:
+            fleet_complete = False
+            organs.append({"organ": name, **_unavailable(_BRAIN_SOURCES[key], errors[key]), "up": False})
+        else:
+            health = raw[key]
+            if health.get("read_state") != "LIVE":
+                fleet_complete = False
+            organs.append({"organ": name, "state": health.get("read_state", "UNAVAILABLE"),
+                           "data_label": "MEASURED" if health.get("read_state") == "LIVE" else "UNAVAILABLE",
+                           "source_url": _BRAIN_SOURCES[key], "health_state": health.get("health_state"),
+                           "up": bool(health.get("up"))})
+    lobes["fleet"] = {
+        "state": "LIVE" if fleet_complete else "UNAVAILABLE",
+        "data_label": "MEASURED" if fleet_complete else "UNAVAILABLE",
+        "organs": organs, "up_count": sum(1 for organ in organs if organ["up"]),
+        "organ_count": len(organs),
+        "reason": None if fleet_complete else "one_or_more_health_reads_unavailable",
+    }
+
+    frontier_keys = [key for key in _BRAIN_SOURCES if key.startswith("frontier:")]
+    frontier_sources: List[Dict[str, Any]] = []
+    frontier_complete = True
+    frontier_total = 0
+    frontier_capped = False
+    for key in frontier_keys:
+        org = key.split(":", 1)[1]
+        try:
+            if key in errors:
+                raise errors[key]
+            item = _count_payload(raw[key], _BRAIN_SOURCES[key])
+            frontier_total += item["count"]
+            frontier_capped = frontier_capped or item["lower_bound"]
+            frontier_sources.append({"org": org, **item})
+        except BaseException as exc:
+            frontier_complete = False
+            frontier_sources.append({"org": org, **_unavailable(_BRAIN_SOURCES[key], exc)})
+    lobes["frontier"] = {
+        "state": "LIVE" if frontier_complete else "UNAVAILABLE",
+        "data_label": "MEASURED" if frontier_complete and not frontier_capped else
+                      ("STRUCTURAL-ONLY" if frontier_complete else "UNAVAILABLE"),
+        "count": frontier_total if frontier_complete else None,
+        "lower_bound": frontier_capped if frontier_complete else None,
+        "sources": frontier_sources,
+        "reason": None if frontier_complete else "one_or_more_frontier_reads_unavailable",
+    }
+
+    available = sum(1 for lobe in lobes.values() if lobe["state"] == "LIVE")
+    overall = "LIVE" if available == len(lobes) else ("DEGRADED" if available else "UNAVAILABLE")
+    overall_label = ("MEASURED" if overall == "LIVE" and
+                     all(lobe["data_label"] == "MEASURED" for lobe in lobes.values()) else
+                     ("STRUCTURAL-ONLY" if overall == "LIVE" else overall))
+    return {
+        "schema": "a11oy.holographic.brain-evidence.v1",
+        "state": overall,
+        "data_label": overall_label,
+        "observed_at": observed_at,
+        "lobe_count": len(lobes), "live_lobes": available,
+        "lobes": lobes,
+        "limits": {
+            "read_only": True, "same_origin_browser_read": True,
+            "fixed_allowlist": True, "timeout_seconds_per_source": _BRAIN_TIMEOUT_S,
+            "response_byte_cap": _BRAIN_MAX_BYTES, "page_cap": _BRAIN_PAGE_CAP,
+            "cache_or_last_good_fallback": False,
+            "note": "Every request is a fresh bounded observation. Missing sources remain UNAVAILABLE.",
+        },
+    }
+
+
 def shell_html(ns: str = "a11oy") -> str:
     """Read the holographic shell HTML off disk (single source of truth:
     static/3d/holographic.html). Falls back to a minimal honest stub if missing."""
@@ -268,6 +494,7 @@ def info(ns: str = "a11oy") -> Dict[str, Any]:
         },
         "surfaces": SURFACES,
         "shell": {"page": "/holographic", "alias": "/a11oy/holographic"},
+        "brain_evidence": f"/api/{ns}/v1/holographic/brain/evidence",
         "selftest": "/static/3d/selftest/index.html",
         "doctrine": {"locked_proven": 8, "lambda": "Conjecture 1", "khipu_bft": "Conjecture 2",
                      "runtime_cdn": 0, "webgpu": "attempt-then-WebGL2-fallback"},
@@ -311,9 +538,15 @@ def register(app, ns: str = "a11oy") -> Dict[str, Any]:
     async def _info():
         return JSONResponse(info(ns))
 
+    async def _brain_evidence():
+        payload = await asyncio.to_thread(brain_evidence)
+        return JSONResponse(payload, headers={"Cache-Control": "no-store"})
+
     for prefix in (f"/api/{ns}/v1/holographic", "/v1/holographic"):
         app.add_api_route(f"{prefix}/info", _info, methods=["GET"], include_in_schema=False)
+        app.add_api_route(f"{prefix}/brain/evidence", _brain_evidence, methods=["GET"], include_in_schema=False)
     registered.append(f"GET /api/{ns}/v1/holographic/info")
+    registered.append(f"GET /api/{ns}/v1/holographic/brain/evidence")
 
     return {"registered": registered, "count": len(registered),
             "capability": "szl3d toolkit + holographic shell", "surfaces": len(SURFACES),

test/test_holographic_zero_cdn.py

@@ -0,0 +1,97 @@
+"""Zero-CDN and honest same-origin evidence contract regressions."""
+from __future__ import annotations
+
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+import szl3d_holographic as holographic
+
+
+class HolographicZeroCdnTests(unittest.TestCase):
+    def _json(self, url: str):
+        if "api/models" in url:
+            return [{"downloads": 3}, {"downloads": 7}]
+        if "api/datasets" in url:
+            return [{"downloads": 11}]
+        if "api/spaces" in url:
+            return [{"likes": 5}]
+        if "api/collections" in url:
+            return [{"slug": "governed-estate"}]
+        if "api.github.com" in url:
+            return [{"stargazers_count": 2}]
+        raise AssertionError(f"unexpected test URL: {url}")
+
+    @staticmethod
+    def _health(_url: str):
+        return {"read_state": "LIVE", "health_state": "ok", "up": True}
+
+    def test_authored_3d_tree_has_no_external_runtime_fetch(self):
+        violations = list(holographic.no_cdn_violations(holographic._base_dir()))
+        self.assertEqual(violations, [])
+        brain = (Path(__file__).parents[1] / "static" / "3d" / "brain.html").read_text(encoding="utf-8")
+        self.assertIn('fetch(BRAIN_EVIDENCE', brain)
+        self.assertIn('const BRAIN_EVIDENCE = "/api/a11oy/v1/holographic/brain/evidence"', brain)
+        self.assertNotIn('fetch("https://', brain)
+        self.assertNotIn("fetch('https://", brain)
+
+    def test_complete_observation_is_live_and_measured(self):
+        payload = holographic.brain_evidence(
+            fetch_json=self._json,
+            fetch_text=lambda _url: "theorem one : True := by trivial\n  theorem two : True := by trivial\n",
+            fetch_health=self._health,
+        )
+        self.assertEqual(payload["state"], "LIVE")
+        self.assertEqual(payload["live_lobes"], payload["lobe_count"])
+        self.assertEqual(payload["lobes"]["formulas"]["theorem_count"], 2)
+        self.assertEqual(payload["lobes"]["models"]["downloads_sum"], 10)
+        self.assertEqual(payload["lobes"]["fleet"]["up_count"], 5)
+        self.assertFalse(payload["limits"]["cache_or_last_good_fallback"])
+        self.assertTrue(payload["limits"]["fixed_allowlist"])
+
+    def test_failed_composite_source_is_not_hidden_by_partial_count(self):
+        def partial_json(url: str):
+            if "author=zai-org" in url:
+                raise TimeoutError("test timeout")
+            return self._json(url)
+
+        payload = holographic.brain_evidence(
+            fetch_json=partial_json,
+            fetch_text=lambda _url: "theorem one : True := by trivial\n",
+            fetch_health=self._health,
+        )
+        frontier = payload["lobes"]["frontier"]
+        self.assertEqual(payload["state"], "DEGRADED")
+        self.assertEqual(frontier["state"], "UNAVAILABLE")
+        self.assertIsNone(frontier["count"])
+        failed = next(row for row in frontier["sources"] if row["org"] == "zai-org")
+        self.assertEqual(failed["reason"], "upstream_unreachable_or_timeout")
+
+    def test_route_is_get_only_no_store_and_same_contract(self):
+        app = FastAPI()
+        expected = {
+            "schema": "a11oy.holographic.brain-evidence.v1",
+            "state": "UNAVAILABLE",
+            "lobes": {},
+        }
+        with patch.object(holographic, "brain_evidence", return_value=expected):
+            holographic.register(app, ns="a11oy")
+            client = TestClient(app)
+            response = client.get("/api/a11oy/v1/holographic/brain/evidence")
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json(), expected)
+        self.assertEqual(response.headers["cache-control"], "no-store")
+        methods = {
+            method
+            for route in app.routes
+            if getattr(route, "path", None) == "/api/a11oy/v1/holographic/brain/evidence"
+            for method in route.methods
+        }
+        self.assertEqual(methods, {"GET"})
+
+
+if __name__ == "__main__":
+    unittest.main()