Expose bounded deployment-source attestation

Dockerfile

@@ -1605,7 +1605,7 @@ COPY szl_spend_cap.py ./szl_spend_cap.py
 # reads defensively — degrading honestly (an honest placeholder tile) if the endpoint is
 # unreachable at runtime. No backend module.
 # --- buildkit max-depth fix: per-file COPYs grouped into one layer (no file dropped; every source token preserved). ---
-COPY a11oy_model_intel.py a11oy_experimental_tier.py a11oy_markets.py szl_agent_tts.py szl_gated_delta.py szl_blocksparse.py szl_retrieval_attn.py szl_model_harness.py szl_agent_loop_governed.py szl_crypto_pipeline.py szl_confattest.py szl_agent_operate.py szl_agentloop_brain.py szl_governed_rag.py szl_sovereign_flywheel.py szl_brain_corpus.py szl_verify_transcript.py szl_frontier_index.py szl_whatsnew.py szl_honestywall.py szl_brainmemory.py szl_agentos.py szl_brainground.py szl_brainuncertainty.py szl_brainhealth.py szl_brainwatch.py szl_boot_preflight.py szl_guarded_surface.py szl_status_aggregate.py szl_brainconstitution.py szl_brainagent.py szl_surface_manifests.py ./
+COPY a11oy_model_intel.py a11oy_experimental_tier.py a11oy_markets.py szl_agent_tts.py szl_gated_delta.py szl_blocksparse.py szl_retrieval_attn.py szl_model_harness.py szl_agent_loop_governed.py szl_crypto_pipeline.py szl_confattest.py szl_agent_operate.py szl_agentloop_brain.py szl_governed_rag.py szl_sovereign_flywheel.py szl_brain_corpus.py szl_verify_transcript.py szl_frontier_index.py szl_whatsnew.py szl_honestywall.py szl_brainmemory.py szl_agentos.py szl_brainground.py szl_brainuncertainty.py szl_brainhealth.py szl_brainwatch.py szl_boot_preflight.py szl_guarded_surface.py szl_status_aggregate.py szl_brainconstitution.py szl_brainagent.py szl_surface_manifests.py szl_source_attestation.py ./
 COPY static/3d/surfaces/gateddelta.js static/3d/surfaces/blocksparse.js static/3d/surfaces/retrievalattn.js static/3d/surfaces/governedagent.js static/3d/surfaces/cryptopipeline.js static/3d/surfaces/confattest.js static/3d/surfaces/agentops.js static/3d/surfaces/frontierindex.js static/3d/surfaces/whatsnew.js static/3d/surfaces/opsdash.js ./static/3d/surfaces/
 
 # git_sha wireup (FORGE-INSTRUCTION-gitsha-quiet-window): surface the deployed commit

README.md

@@ -120,6 +120,11 @@ curl -s https://a-11-oy.com/api/a11oy/v1/honest | jq .doctrine_lock.lambda
 | Evidence-bound Council | [a-11-oy.com/api/a11oy/v1/ayllu/council/manifest](https://a-11-oy.com/api/a11oy/v1/ayllu/council/manifest) |
 | SZL-Nemo card | [a-11-oy.com/api/a11oy/v1/nemo/card](https://a-11-oy.com/api/a11oy/v1/nemo/card) |
 | Receipt verifier contract | [a-11-oy.com/api/a11oy/v1/verify/receipt](https://a-11-oy.com/api/a11oy/v1/verify/receipt) |
+| Deployment-source attestation | [HF Space `/.well-known/szl-source.json`](https://szlholdings-a11oy.hf.space/.well-known/szl-source.json) |
+
+The source attestation measures the deployed Hugging Face revision separately
+from its pinned GitHub reference. It reports `PENDING_GITHUB_SYNC` and explicitly
+does not claim Space/GitHub byte parity, a reproducible build, or build provenance.
 
 Council v2 is proposal-only. It adds a signed Nemo routing trace, per-turn output
 digests, explicit limits, a deterministic replay key, and a required human

serve.py

@@ -13245,6 +13245,35 @@ except Exception as _ws_e2:  # additive: never break the Space
 # ============================================================================
 
 
+# Bounded deployment-source attestation. Registered last and front-moved by the
+# module so the exact well-known JSON route wins over the SPA history fallback.
+# A pinned GitHub reference is evidence of a source observation only; it does
+# not assert byte parity, a reproducible Space build, or build provenance.
+try:
+    import szl_source_attestation as _szl_source_attestation
+
+    _a11oy_source_observation = {
+        "repository": "szl-holdings/a11oy",
+        "commit": "adac37574f88a30ff099f3ec7f548685d4166e6f",
+        "path": "",
+        "relation": "declared-source-with-hf-overlay",
+        "state": "VERIFIED_REFERENCE",
+        "evidence_url": "https://github.com/szl-holdings/a11oy/commit/adac37574f88a30ff099f3ec7f548685d4166e6f",
+    }
+    _szl_source_result = _szl_source_attestation.register(
+        app,
+        "SZLHOLDINGS/a11oy",
+        _a11oy_source_observation,
+        "PENDING_GITHUB_SYNC",
+    )
+    print(f"[a11oy] deployment-source attestation registered: {_szl_source_result}", file=sys.stderr)
+except Exception as _szl_source_error:  # additive: never take down the SPA
+    print(
+        f"[a11oy] deployment-source attestation NOT registered (non-fatal): {_szl_source_error!r}",
+        file=sys.stderr,
+    )
+
+
 if __name__ == "__main__":
     import uvicorn
     port = int(os.environ.get("PORT", "7860"))

szl_source_attestation.py

@@ -0,0 +1,118 @@
+"""Bounded deployment-source attestation for public SZL surfaces."""
+from __future__ import annotations
+
+import json
+import os
+import re
+import threading
+import time
+import urllib.request
+from datetime import datetime, timezone
+
+from fastapi.responses import JSONResponse
+
+
+_SHA = re.compile(r"^[0-9a-f]{40}$")
+_CACHE_LOCK = threading.Lock()
+_CACHE: dict[str, dict[str, object]] = {}
+
+
+def _now_iso() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _valid_sha(value: object) -> str | None:
+    candidate = str(value or "").strip().lower()
+    return candidate if _SHA.fullmatch(candidate) else None
+
+
+def measure_hf_revision(space_id: str, force: bool = False) -> dict[str, object]:
+    env_revision = _valid_sha(os.environ.get("SPACE_REPOSITORY_COMMIT"))
+    if env_revision:
+        return {
+            "hf_revision": env_revision,
+            "revision_state": "MEASURED",
+            "measurement_method": "SPACE_REPOSITORY_COMMIT",
+        }
+
+    now = time.monotonic()
+    with _CACHE_LOCK:
+        cached = _CACHE.get(space_id)
+        if not force and cached and now - float(cached["stored_at"]) < 60:
+            return dict(cached["measurement"])  # type: ignore[arg-type]
+
+    revision = None
+    error = None
+    request = urllib.request.Request(
+        f"https://huggingface.co/api/spaces/{space_id}?expand[]=sha",
+        headers={"Accept": "application/json", "User-Agent": "szl-source-attestation/1.0"},
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=4) as response:
+            revision = _valid_sha(json.load(response).get("sha"))
+    except Exception as exc:
+        error = type(exc).__name__
+
+    measurement: dict[str, object] = {
+        "hf_revision": revision,
+        "revision_state": "MEASURED" if revision else "UNAVAILABLE",
+        "measurement_method": "HUGGINGFACE_API" if revision else "UNAVAILABLE",
+    }
+    if error:
+        measurement["measurement_error"] = error
+    with _CACHE_LOCK:
+        _CACHE[space_id] = {"stored_at": time.monotonic(), "measurement": dict(measurement)}
+    return measurement
+
+
+def build_attestation(
+    space_id: str,
+    source: dict[str, object],
+    alignment_state: str,
+    force: bool = False,
+) -> dict[str, object]:
+    measurement = measure_hf_revision(space_id, force=force)
+    return {
+        "schema": "szl.deployment-source/v1",
+        "observed_at": _now_iso(),
+        "transport_state": "REACHABLE",
+        "evidence_state": "COMPUTED" if measurement["hf_revision"] else "UNAVAILABLE",
+        "verification_state": "STRUCTURAL_ONLY",
+        "authority_state": "READ_ONLY",
+        "source": dict(source),
+        "deployment": {"hf_space": space_id, **measurement},
+        "alignment_state": alignment_state,
+        "attestation_state": "UNSIGNED_STRUCTURAL",
+        "claims": {
+            "github_parity": "NOT_CLAIMED",
+            "reproducible_build": "NOT_CLAIMED",
+            "build_provenance": "NOT_CLAIMED",
+        },
+        "limits": [
+            "The Hugging Face revision is measured independently from the pinned source observation.",
+            "A GitHub reference does not establish deployed-artifact equivalence.",
+            "This unsigned structural attestation does not prove a reproducible build or build provenance.",
+        ],
+    }
+
+
+def register(app, space_id: str, source: dict[str, object], alignment_state: str) -> dict[str, object]:
+    async def source_attestation(refresh: int = 0):  # noqa: ANN202
+        payload = build_attestation(space_id, source, alignment_state, force=refresh == 1)
+        return JSONResponse(
+            payload,
+            headers={
+                "Cache-Control": "no-store",
+                "X-SZL-Transport-State": str(payload["transport_state"]),
+                "X-SZL-Evidence-State": str(payload["evidence_state"]),
+                "X-SZL-Verification-State": str(payload["verification_state"]),
+                "X-SZL-Authority-State": str(payload["authority_state"]),
+            },
+        )
+
+    existing = list(app.router.routes)
+    route = "/.well-known/szl-source.json"
+    app.add_api_route(route, source_attestation, methods=["GET"], include_in_schema=True)
+    added = list(app.router.routes[len(existing):])
+    app.router.routes[:] = added + existing
+    return {"ok": True, "route": route, "space": space_id, "position": 0}

test/test_source_attestation.py

@@ -0,0 +1,64 @@
+import os
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+from fastapi import FastAPI
+from fastapi.responses import HTMLResponse
+from fastapi.testclient import TestClient
+
+import szl_source_attestation as source
+
+
+ROOT = Path(__file__).resolve().parents[1]
+SOURCE_OBSERVATION = {
+    "repository": "szl-holdings/a11oy",
+    "commit": "adac37574f88a30ff099f3ec7f548685d4166e6f",
+    "path": "",
+    "relation": "declared-source-with-hf-overlay",
+    "state": "VERIFIED_REFERENCE",
+    "evidence_url": "https://github.com/szl-holdings/a11oy/commit/adac37574f88a30ff099f3ec7f548685d4166e6f",
+}
+
+
+class SourceAttestationTests(unittest.TestCase):
+    def setUp(self):
+        self.app = FastAPI()
+
+        @self.app.get("/{full_path:path}")
+        async def spa_fallback(full_path: str):  # noqa: ARG001
+            return HTMLResponse("<html>SPA</html>")
+
+        source.register(
+            self.app,
+            "SZLHOLDINGS/a11oy",
+            SOURCE_OBSERVATION,
+            "PENDING_GITHUB_SYNC",
+        )
+        self.client = TestClient(self.app)
+
+    def test_exact_route_precedes_spa_and_returns_bounded_json(self):
+        paths = [getattr(route, "path", None) for route in self.app.router.routes]
+        self.assertLess(paths.index("/.well-known/szl-source.json"), paths.index("/{full_path:path}"))
+        with patch.dict(os.environ, {"SPACE_REPOSITORY_COMMIT": "a" * 40}):
+            response = self.client.get("/.well-known/szl-source.json")
+        self.assertEqual(200, response.status_code)
+        self.assertEqual("application/json", response.headers["content-type"])
+        self.assertEqual("no-store", response.headers["cache-control"])
+        self.assertEqual("COMPUTED", response.headers["x-szl-evidence-state"])
+        self.assertEqual("STRUCTURAL_ONLY", response.headers["x-szl-verification-state"])
+        self.assertEqual("READ_ONLY", response.headers["x-szl-authority-state"])
+        body = response.json()
+        self.assertEqual("a" * 40, body["deployment"]["hf_revision"])
+        self.assertEqual("PENDING_GITHUB_SYNC", body["alignment_state"])
+        self.assertEqual("VERIFIED_REFERENCE", body["source"]["state"])
+        for claim in ("github_parity", "reproducible_build", "build_provenance"):
+            self.assertEqual("NOT_CLAIMED", body["claims"][claim])
+
+    def test_docker_runtime_includes_module(self):
+        dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
+        self.assertIn("szl_source_attestation.py", dockerfile)
+
+
+if __name__ == "__main__":
+    unittest.main()