fix: activate fail-safe public contracts

README.md

@@ -1,7 +1,7 @@
 ---
 title: "killinchu — Andean Drone Intelligence"
 emoji: "🦅"
-thumbnail: "https://killinchu.a-11-oy.com/og-card.png"
+thumbnail: "https://huggingface.co/spaces/SZLHOLDINGS/killinchu/resolve/main/static/og-card.png"
 colorFrom: gray
 colorTo: indigo
 sdk: docker
@@ -50,6 +50,8 @@ ecosystem-stage: "operational"
 - **Primary face — the full application:** https://szlholdings-killinchu.hf.space/elite
 - Space URL: https://szlholdings-killinchu.hf.space
 - Health: `curl -s https://szlholdings-killinchu.hf.space/api/killinchu/v1/honest | jq .kernel_commit` → `"c7c0ba17"`
+- Source/deployment attestation: https://szlholdings-killinchu.hf.space/.well-known/szl-source.json
+- OpenAPI: https://szlholdings-killinchu.hf.space/openapi.json
 - Docs: https://szl-holdings.github.io/docs-site/flagships/killinchu
 - Release: [v1.0.0](https://github.com/szl-holdings/killinchu/releases/tag/v1.0.0)
 

killinchu_public_contracts.py

@@ -6,6 +6,7 @@ or authority to actuate a defense system.
 """
 from __future__ import annotations
 
+import inspect
 import json
 import os
 import threading
@@ -17,11 +18,11 @@ from typing import Any
 
 GITHUB_REPOSITORY = "https://github.com/szl-holdings/killinchu"
 GITHUB_REPOSITORY_ID = "szl-holdings/killinchu"
-GITHUB_OBSERVED_REVISION = "dbb7ef1b20b941b299235d13dbd8404eb96cc0a4"
+GITHUB_OBSERVED_REVISION = "c2695a83e35ceecb6d2ffef8deaec69a9a1f5ed4"
 HF_SPACE_REPOSITORY = "https://huggingface.co/spaces/SZLHOLDINGS/killinchu"
 HF_SPACE_ID = "SZLHOLDINGS/killinchu"
-HF_OVERLAY_BASE_REVISION = "fce3a1a581d212119473756d4907a06ff5dc9f2f"
-REVISION_OBSERVED_AT = "2026-07-11T16:16:12.897595+00:00"
+HF_OVERLAY_BASE_REVISION = "a46d703a53f2efccd14da96226f46897ffcc65d0"
+REVISION_OBSERVED_AT = "2026-07-15T11:52:16.196467+00:00"
 _HF_HEAD_CACHE: dict[str, Any] = {"at": 0.0, "value": None}
 _HF_HEAD_LOCK = threading.Lock()
 
@@ -141,7 +142,19 @@ def source_attestation(force: bool = False) -> dict[str, Any]:
                 "repository": HF_SPACE_REPOSITORY,
                 "base_revision": HF_OVERLAY_BASE_REVISION,
                 "base_revision_semantics": (
-                    "Hugging Face revision on which this corrective overlay was based"
+                    "Exact Hugging Face parent revision of this corrective overlay"
+                ),
+                "state": "HF_ONLY_CORRECTIVE_OVERLAY",
+                "documented_paths": [
+                    {"path": "Dockerfile", "purpose": "copy the read-only public-contract module into the image"},
+                    {"path": "serve.py", "purpose": "register read-only source, status, MELT, and OpenAPI contracts"},
+                    {"path": "killinchu_public_contracts.py", "purpose": "emit fail-closed source/deployment evidence"},
+                    {"path": "tests/test_public_contracts.py", "purpose": "regress contract behavior and runtime packaging"},
+                    {"path": "README.md", "purpose": "publish stable discovery and thumbnail URLs"},
+                ],
+                "scope_limit": (
+                    "This list documents the corrective contract overlay only; it is not "
+                    "a complete GitHub/Hugging Face byte-parity assertion."
                 ),
             },
             "build_metadata": {
@@ -280,7 +293,7 @@ def runtime_status(app: Any, ns: str = "killinchu") -> dict[str, Any]:
 
 
 def register(app: Any, ns: str = "killinchu") -> dict[str, Any]:
-    from starlette.responses import JSONResponse
+    from starlette.responses import JSONResponse, Response
     from starlette.routing import Route
 
     async def _health(_request):
@@ -314,7 +327,31 @@ def register(app: Any, ns: str = "killinchu") -> dict[str, Any]:
             headers={"Cache-Control": "no-store", "X-Content-Type-Options": "nosniff"},
         )
 
+    async def _openapi_alias(_request):
+        """Delegate discovery aliases to the existing fail-safe organ schema."""
+        organ_path = f"/api/{ns}/openapi.json"
+        for route in app.router.routes:
+            if getattr(route, "path", None) != organ_path:
+                continue
+            endpoint = getattr(route, "endpoint", None)
+            if not callable(endpoint):
+                continue
+            try:
+                payload = endpoint()
+                if inspect.isawaitable(payload):
+                    payload = await payload
+                if isinstance(payload, Response):
+                    payload.headers.setdefault("Cache-Control", "no-store")
+                    payload.headers.setdefault("X-Content-Type-Options", "nosniff")
+                    return payload
+                return JSONResponse(payload, headers={"Cache-Control": "no-store", "X-Content-Type-Options": "nosniff"})
+            except Exception as exc:
+                return JSONResponse({"schema": "szl.openapi-unavailable/v1", "state": "UNAVAILABLE", "error_type": type(exc).__name__}, status_code=503, headers={"Cache-Control": "no-store"})
+        return JSONResponse({"schema": "szl.openapi-unavailable/v1", "state": "UNAVAILABLE", "detail": f"{organ_path} is not registered"}, status_code=503, headers={"Cache-Control": "no-store"})
+
     routes = [
+        Route("/openapi.json", _openapi_alias, methods=["GET"], name="killinchu_public_openapi"),
+        Route(f"/api/{ns}/v1/openapi.json", _openapi_alias, methods=["GET"], name="killinchu_v1_openapi"),
         Route("/health", _health, methods=["GET"], name="killinchu_public_health"),
         Route(
             f"/api/{ns}/v1/status",
@@ -353,6 +390,6 @@ if __name__ == "__main__":
         "/api/killinchu/v1/mesh/state", lambda: {}, methods=["GET"]
     )
     result = register(candidate)
-    assert len(result["routes"]) == 4
+    assert len(result["routes"]) == 6
     assert runtime_status(candidate)["transport_state"] == "REACHABLE"
     print("SELFTEST OK")

serve.py

@@ -5537,6 +5537,20 @@ except Exception as _kc_wave_e:  # pragma: no cover — never break SPA/other or
 # ============================================================================
 
 
+
+# ============================================================================
+# READ-ONLY PUBLIC CONTRACTS -- source/deployment attestation, runtime status,
+# MELT summary, and fail-safe OpenAPI discovery. Registered last and inserted at
+# the front so explicit machine-readable routes beat the SPA history fallback.
+# No targeting, collection, decision, or effector behavior is changed here.
+# ============================================================================
+try:
+    import killinchu_public_contracts as _kc_public_contracts
+    _kc_public_contract_status = _kc_public_contracts.register(app, ns="killinchu")
+    print(f"[killinchu] public contracts registered: {_kc_public_contract_status}", file=sys.stderr)
+except Exception as _kc_public_contract_error:  # pragma: no cover
+    print(f"[killinchu] public contracts NOT registered: {_kc_public_contract_error!r}", file=sys.stderr)
+
 if __name__ == "__main__":
     import uvicorn
     port = int(os.environ.get("PORT", "7860"))

tests/test_public_contracts.py

@@ -1,4 +1,5 @@
 import unittest
+from pathlib import Path
 from unittest.mock import patch
 
 from fastapi import FastAPI
@@ -90,6 +91,14 @@ class PublicContractTests(unittest.TestCase):
         build_variable = extension["build_metadata"]["source_git_revision_variable"]
         self.assertEqual(build_variable["value"], "source-build-sha")
         self.assertFalse(build_variable["is_huggingface_deployment_revision"])
+        overlay = extension["overlay"]
+        self.assertEqual(overlay["state"], "HF_ONLY_CORRECTIVE_OVERLAY")
+        self.assertEqual(overlay["base_revision"], killinchu_public_contracts.HF_OVERLAY_BASE_REVISION)
+        self.assertEqual(
+            [item["path"] for item in overlay["documented_paths"]],
+            ["Dockerfile", "serve.py", "killinchu_public_contracts.py", "tests/test_public_contracts.py", "README.md"],
+        )
+        self.assertIn("not a complete", overlay["scope_limit"])
 
         # Mirrors the identity checks in check_ecosystem_drift.compare.
         identity_errors = []
@@ -125,5 +134,15 @@ class PublicContractTests(unittest.TestCase):
                 self.assertEqual(response.json()["openapi"], "3.1.0")
 
 
+    def test_runtime_wires_contracts_before_entrypoint(self):
+        root = Path(__file__).resolve().parents[1]
+        serve = (root / "serve.py").read_text(encoding="utf-8")
+        dockerfile = (root / "Dockerfile").read_text(encoding="utf-8")
+        registration = serve.index("_kc_public_contracts.register(app, ns=\"killinchu\")")
+        entrypoint = serve.index('if __name__ == "__main__":')
+        self.assertLess(registration, entrypoint)
+        self.assertIn("COPY killinchu_public_contracts.py ./", dockerfile)
+
+
 if __name__ == "__main__":
     unittest.main()