deploy(hf): sync szl-holdings/killinchu@main derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/killinchu main.
Files: 886 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.well-known/szl-source.json

@@ -0,0 +1,61 @@
+{
+  "schema": "szl.deployment-source/v2",
+  "source": {
+    "repository": "szl-holdings/killinchu",
+    "commit": "9958c34a2066ba05e9679ce96ae4841fd67b1db6",
+    "path": "",
+    "relation": "current-github-main-reference",
+    "commit_state": "MEASURED_GITHUB_MAIN_REFERENCE_AT_AUDIT",
+    "sync_state": "PENDING_GITHUB_SYNC",
+    "build_source_state": "NOT_PROVEN"
+  },
+  "deployment": {
+    "hf_space": "SZLHOLDINGS/killinchu",
+    "audited_live_hf_revision": "bba71e38fc3955fb1809a76965911675a94041b2",
+    "audited_live_hf_revision_state": "MEASURED_LIVE_REFERENCE_AT_OBSERVATION",
+    "audited_live_stage": "RUNNING",
+    "audited_live_hardware": "cpu-basic",
+    "audited_live_last_modified": "2026-07-16T18:09:53.000Z",
+    "current_hf_revision": null,
+    "current_hf_revision_state": "NOT_CLAIMED",
+    "running_process_revision": "NOT_CLAIMED",
+    "deployed_equivalence_state": "NOT_CLAIMED"
+  },
+  "artifact_basis": {
+    "github_reference_commit": "9958c34a2066ba05e9679ce96ae4841fd67b1db6",
+    "hf_observed_revision": "bba71e38fc3955fb1809a76965911675a94041b2",
+    "semantics": "Two independently recorded references at audit time; their content parity and build relationship are not claimed."
+  },
+  "observed_at": "2026-07-16T18:09:53.000Z",
+  "transport_state": "REFERENCE_RECORDED",
+  "evidence_state": "SNAPSHOT",
+  "verification_state": "STRUCTURAL_ONLY",
+  "authority_state": "READ_ONLY",
+  "alignment_state": "PENDING_GITHUB_SYNC",
+  "attestation_state": "UNSIGNED_STRUCTURAL",
+  "claims": {
+    "github_parity": "NOT_CLAIMED",
+    "hugging_face_parity": "NOT_CLAIMED",
+    "deployed_equivalence": "NOT_CLAIMED",
+    "reproducible_build": "NOT_CLAIMED",
+    "build_provenance": "NOT_CLAIMED",
+    "current_hf_head": "NOT_CLAIMED"
+  },
+  "extensions": {
+    "schema": "szl.static-deployment-source-evidence/v1",
+    "overlay": {
+      "source_reference_commit": "9958c34a2066ba05e9679ce96ae4841fd67b1db6",
+      "artifact_path": ".well-known/szl-source.json",
+      "worktree_scope_state": "NOT_ATTESTED",
+      "sync_state": "PENDING_GITHUB_SYNC"
+    }
+  },
+  "limits": [
+    "This file is an unsigned structural snapshot and grants no mutation authority.",
+    "The GitHub commit is the current origin/main reference observed during this audit, not a commit containing this pending worktree overlay.",
+    "This snapshot does not prove that the pending overlay has been applied atop the referenced GitHub commit.",
+    "The Hugging Face revision is an observed live reference at 2026-07-16T18:09:53.000Z, not a claim about the current head.",
+    "No byte parity, build provenance, reproducible build, or deployed equivalence is claimed.",
+    "PENDING_GITHUB_SYNC must remain until an independently observable published commit contains this artifact."
+  ]
+}

README.md

@@ -62,7 +62,10 @@ ecosystem-stage: "operational"
 - Space URL: https://szlholdings-killinchu.hf.space
 - Health: `curl -s https://szlholdings-killinchu.hf.space/api/killinchu/v1/honest | jq .kernel_commit` → `"c7c0ba17"`
 - Source/deployment attestation: https://szlholdings-killinchu.hf.space/.well-known/szl-source.json
+  (unsigned structural snapshot; its `PENDING_GITHUB_SYNC` / `NOT_CLAIMED` fields are authoritative)
 - OpenAPI: https://szlholdings-killinchu.hf.space/openapi.json
+- Spaces registry: https://szlholdings-killinchu.hf.space/spaces
+  (apps open on canonical isolated HF origins; legacy `/spaces/<slug>` links are no-store 307 handoffs)
 - Docs: https://szl-holdings.github.io/docs-site/flagships/killinchu
 - Release: [v1.0.0](https://github.com/szl-holdings/killinchu/releases/tag/v1.0.0)
 

killinchu_elite_console.py

@@ -2435,8 +2435,8 @@ window.autoPill=function(gateId){ return '<span class="badge b-live" style="font
 
 /* ── Auto-crawl scheduler status (Task #742) — surfaces the live intel feed's
    self-refresh health from GET /api/killinchu/crawl/status. Honest by design:
-   a run that did not get fresh data (cached/degraded) is labelled DEGRADED, an
-   exception run ERROR, an overlap-guarded cycle SKIPPED — never shown healthy. ── */
+   a run that did not get fresh data is labelled DEGRADED; a disabled/not-wired
+   scheduler or an open storage circuit is STOPPED — never shown healthy. ── */
 function _csRel(iso, future){
   if(!iso) return '\u2014';
   try{
@@ -2457,35 +2457,34 @@ async function crawlStatusLoad(id){
     var enabled=(cfg.enabled!==false)&&wired;
     var health=String((j&&j.health)||(j&&j.status)||'unverified').toLowerCase();
     var halted=!!(j&&j.circuit_open)||health==='failed';
+    var stopped=halted||!enabled||health==='disabled';
     var last=String(sch.last_status||'').toLowerCase();
     var outcome, oc;
-    if(halted){ outcome='HALTED'; oc='#ff7b7b'; }
+    if(stopped){ outcome='STOPPED'; oc='#ff7b7b'; }
     else if(!sch.last_run_at){ outcome='NO RUN YET'; oc='#c9a05f'; }
     else if(last==='live'){ outcome='OK'; oc='#5fb3a3'; }
-    else if(last==='error'){ outcome='ERROR'; oc='#ff7b7b'; }
-    else if(last==='skipped'){ outcome='SKIPPED'; oc='#c9a05f'; }
-    else { outcome='DEGRADED'; oc='#f5b301'; }   // cached / degraded — not fresh data
-    var schTxt=halted?'CIRCUIT OPEN':(enabled?'ENABLED':(wired?'DISABLED':'NOT WIRED'));
-    var schC=(halted||!enabled)?'#ff7b7b':'#5fb3a3';
+    else { outcome='DEGRADED'; oc='#f5b301'; }   // cached / degraded / error / skipped — not fresh
+    var schTxt=halted?'CIRCUIT OPEN':(enabled?'ENABLED':'STOPPED');
+    var schC=stopped?'#ff7b7b':'#5fb3a3';
     var cf=sch.consecutive_failures||0;
-    var boTxt=halted?'fail-closed \u00b7 no retries':(cf>0?('backing off \u00b7 '+cf+' consecutive miss'+(cf===1?'':'es')):'nominal');
-    var boC=halted?'#ff7b7b':(cf>0?'#f5b301':'var(--dim)');
+    var boTxt=halted?'fail-closed \u00b7 no retries':(!enabled?'scheduler stopped':(cf>0?('backing off \u00b7 '+cf+' consecutive miss'+(cf===1?'':'es')):'nominal'));
+    var boC=stopped?'#ff7b7b':(cf>0?'#f5b301':'var(--dim)');
     var ivl=cfg.interval_seconds!=null?(cfg.interval_seconds+'s'):'\u2014';
     var freshness=String((j&&j.freshness)||'unverified').toUpperCase();
-    var title='Intel feed \u00b7 '+(halted?'HALTED':freshness);
+    var title='Intel feed \u00b7 '+(stopped?'STOPPED':freshness);
     var cell=function(label,val,color){ return '<div class="kpi" style="padding:.5rem .7rem"><div class="k">'+esc(label)+'</div><div class="v" style="font-size:1rem;color:'+(color||'var(--cream)')+'">'+val+'</div></div>'; };
     var remediation=halted&&j.operator_action
       ? '<div class="row mono" style="font-size:11px;color:#ff7b7b;margin-top:.5rem;word-break:break-word">operator action: '+esc(String(j.operator_action))+'</div>' : '';
-    var note=((outcome==='DEGRADED'||outcome==='ERROR'||outcome==='HALTED')&&sch.last_error)
+    var note=((outcome==='DEGRADED'||outcome==='STOPPED')&&sch.last_error)
       ? '<div class="row mono" style="font-size:11px;color:#f5b301;margin-top:.5rem;word-break:break-word">last issue: '+esc(String(sch.last_error))+'</div>'
-      : (outcome==='SKIPPED' ? '<div class="row mono dim" style="font-size:11px;margin-top:.5rem">a run was still in progress \u2014 this cycle was skipped to avoid pile-up</div>' : '');
+      : (last==='skipped' ? '<div class="row mono dim" style="font-size:11px;margin-top:.5rem">a run was still in progress \u2014 this cycle was skipped to avoid pile-up</div>' : '');
     box.innerHTML=
       '<div class="card-h"><span class="card-t">&#8635; '+esc(title)+'</span><span class="card-ep">GET /api/killinchu/crawl/status \u00b7 adsb.lol military ADS-B</span></div>'+
       '<div class="kpis" style="grid-template-columns:repeat(auto-fit,minmax(118px,1fr));gap:.5rem;margin:0">'+
         cell('Scheduler',schTxt,schC)+
         cell('Last run',_csRel(sch.last_run_at,false),'var(--cream)')+
         cell('Outcome',outcome,oc)+
-        cell('Next run',(enabled&&!halted)?_csRel(sch.next_run_at,true):'\u2014','var(--cream)')+
+        cell('Next run',(enabled&&!stopped)?_csRel(sch.next_run_at,true):'\u2014','var(--cream)')+
         cell('Backoff',boTxt,boC)+
         cell('Interval',ivl,'var(--dim)')+
       '</div>'+note+remediation;

killinchu_nav_wireup.py

@@ -24,8 +24,8 @@
 # markup; it removes nothing and never clobbers another lane's nav.
 #
 # DOCTRINE (v11): locked = 8 @ c7c0ba17; Λ = Conjecture 1 (NOT a theorem);
-# 0 visible codenames (label is the surface's own honest title); 0 CDN (the only
-# URL is the same-estate a11oy Restraint page, not a third-party CDN asset);
+# 0 visible codenames (labels are the surfaces' own honest titles); 0 CDN (the
+# absolute URLs are same-estate a11oy surfaces, not third-party CDN assets);
 # honest labels only; never weakens a gate; never commits a key; additive-only.
 #
 # Signed-off-by: Stephen P. Lutar Jr. <stephenlutar2@gmail.com>
@@ -72,6 +72,7 @@ _LEGACY_FOLD_REDIRECTS = {
 
 # The a11oy-hosted Restraint surfaces (same estate, NOT a third-party CDN).
 _A11OY_BASE = "https://szlholdings-a11oy.hf.space"
+_A11OY_PUBLIC_BASE = "https://a-11-oy.com"
 _RESTRAINT_URL = _A11OY_BASE + "/restraint"
 _RESTRAINT_BENCH_URL = _A11OY_BASE + "/restraint-bench"
 
@@ -105,12 +106,12 @@ _FLAGSHIP_PATHS = {"/ecosystem", "/estate-organism", "/counter-uas"}
 def _build_nav_item() -> bytes:
     """ONE Restraint nav-item, mirroring killinchu's own nav-item markup
     (class="nav-item" + <span class="ico"> + label). Navigates cross-app to the
-    a11oy Restraint surface via location.href. 0 CDN, 0 inline <style>, no codename."""
+    a11oy Restraint surface via a real anchor. 0 CDN, 0 inline <style>, no codename."""
     item = (
-        '<div class="nav-item" data-nav-restraint="r5" '
-        'onclick="location.href=\'%s\'" style="cursor:pointer" '
+        '<a class="nav-item" data-nav-restraint="r5" href="%s" '
+        'style="cursor:pointer;text-decoration:none" '
         'title="a11oy Restraint — governed code-minimization / dependency-frugality (aligns with, not certified)">'
-        '<span class="ico">\u27c2</span>Restraint (Governed Frugality)</div>'
+        '<span class="ico">\u27c2</span>Restraint (Governed Frugality)</a>'
     ) % _RESTRAINT_URL
     return item.encode("utf-8")
 
@@ -120,6 +121,8 @@ def _build_related_strip(current_path: str) -> bytes:
     cluster from killinchu. Inline-styled (0 CDN). Honest labels."""
     rel = [
         ("/ecosystem", "Estate Hub"),
+        (_A11OY_PUBLIC_BASE + "/ecosystem", "a11oy Ecosystem"),
+        (_A11OY_PUBLIC_BASE + "/anatomy-v5", "Anatomy v5"),
         (_A11OY_BASE + "/nemo", "SZL-Nemo"),
         (_A11OY_BASE + "/autoreview", "Auto-Review"),
         (_A11OY_BASE + "/factory", "Factory"),
@@ -134,15 +137,17 @@ def _build_related_strip(current_path: str) -> bytes:
         if path == current_path:
             continue
         links.append(
-            '<a href="%s" style="color:#d4a444;text-decoration:none;'
-            'margin:0 .55em;white-space:nowrap">%s</a>' % (path, label)
+            '<a href="%s" style="color:#d4a444;text-decoration:none;display:inline-flex;'
+            'align-items:center;min-height:44px;padding:.35rem .2rem;white-space:nowrap">%s</a>'
+            % (path, label)
         )
     strip = (
         '<nav data-related-restraint="r5" aria-label="Related surfaces" '
-        'style="margin:1.25rem auto;max-width:1100px;padding:.6rem .9rem;'
+        'style="margin:1.25rem auto;max-width:1100px;padding:.6rem .9rem;display:flex;'
+        'flex-wrap:wrap;align-items:center;justify-content:center;gap:.15rem .35rem;'
         'border-top:1px solid #1d2632;font:13px/1.6 system-ui,sans-serif;'
         'color:#7c8794;text-align:center">'
-        '<span style="color:#7c8794;margin-right:.4em">Related surfaces:</span>'
+        '<span style="color:#7c8794;margin-right:.2em">Related surfaces:</span>'
         + "".join(links)
         + "</nav>"
     )
@@ -410,7 +415,7 @@ if __name__ == "__main__":
     assert "Operate</div>" in h1, "must NOT remove existing nav group"
     assert "footer</div>" in h1, "must NOT remove footer"
     # placed immediately before the footer
-    assert 'Restraint (Governed Frugality)</div><div class="side-foot">' in h1, "must place before footer"
+    assert 'Restraint (Governed Frugality)</a><div class="side-foot">' in h1, "must place before footer"
     assert h1 == h2, "second render must be byte-identical (idempotent)"
 
     e1 = c.get("/ecosystem").text
@@ -418,19 +423,22 @@ if __name__ == "__main__":
     assert e1.count('data-related-restraint="r5"') == 1, "cross-link strip must inject once"
     assert e2.count('data-related-restraint="r5"') == 1, "cross-link strip must be idempotent"
     assert _RESTRAINT_URL in e1 and "/autoreview" in e1, "strip must cross-link Restraint + flagships"
+    assert _A11OY_PUBLIC_BASE + "/ecosystem" in e1, "strip must link the public a11oy ecosystem"
+    assert _A11OY_PUBLIC_BASE + "/anatomy-v5" in e1, "strip must link public Anatomy v5"
     # /ecosystem is the current page -> omitted from its own strip
     inner = e1.split('data-related-restraint="r5"')[1].split("</nav>")[0]
-    assert "/ecosystem" not in inner, "strip must omit the current page (/ecosystem)"
+    assert 'href="/ecosystem"' not in inner, "strip must omit the current local page (/ecosystem)"
     assert e1 == e2, "second ecosystem render must be byte-identical"
 
     # Doctrine guard: 0 CDN (only the same-estate a11oy URL), 0 script, 0 codename.
     injected = (_build_nav_item().decode() + _build_related_strip("/ecosystem").decode())
     low = injected.lower()
     assert "<script" not in low, "nav markup must inject no script"
-    # the ONLY absolute URLs allowed are same-estate a11oy hf.space links
+    # the ONLY absolute URLs allowed are same-estate a11oy app/public-domain links
     import re
     urls = re.findall(r'https?://[^\'"\s]+', injected)
-    assert all(u.startswith(_A11OY_BASE) for u in urls), "only same-estate a11oy URLs allowed: %s" % urls
+    assert all(u.startswith((_A11OY_BASE, _A11OY_PUBLIC_BASE)) for u in urls), \
+        "only same-estate a11oy URLs allowed: %s" % urls
 
     print("killinchu_nav_wireup: ALL OK (Restraint nav item + cross-link strip; "
           "idempotent; additive; 0 codenames; 0 CDN; same-estate cross-link only)")

killinchu_public_route_repair.py

@@ -0,0 +1,177 @@
+"""Fail-closed public discovery routes for the Killinchu Space.
+
+The application has a large, additive router. Two public discovery contracts
+must win before its SPA catch-all:
+
+* ``/openapi.json`` delegates to the already-hardened namespaced generator.
+* ``/.well-known/szl-source.json`` serves the on-disk attestation artifact.
+
+This module deliberately does not manufacture either contract. If the real
+generator or artifact is unavailable, callers receive an explicit JSON 503
+instead of a misleading HTML shell or a synthetic success response.
+"""
+
+from __future__ import annotations
+
+import inspect
+import json
+import os
+from pathlib import Path
+from typing import Any
+
+
+_OPENAPI_ROUTE_NAME = "killinchu_p0_openapi_alias"
+_SOURCE_ROUTE_NAME = "killinchu_p0_source_artifact"
+_MAX_SOURCE_BYTES = 2 * 1024 * 1024
+_JSON_HEADERS = {
+    "Cache-Control": "no-store",
+    "X-Content-Type-Options": "nosniff",
+}
+
+
+def _head_from(response: Any, response_cls: Any) -> Any:
+    """Return a bodyless response while preserving GET status and headers."""
+
+    return response_cls(
+        content=b"",
+        status_code=response.status_code,
+        headers=dict(response.headers),
+    )
+
+
+def register(
+    app: Any,
+    *,
+    ns: str = "killinchu",
+    artifact_path: str | os.PathLike[str] | None = None,
+) -> dict[str, Any]:
+    """Register exact public routes ahead of defaults and the SPA catch-all."""
+
+    from starlette.responses import JSONResponse, Response
+    from starlette.routing import Route
+
+    organ_path = f"/api/{ns}/openapi.json"
+    organ_endpoint = next(
+        (
+            getattr(route, "endpoint", None)
+            for route in app.router.routes
+            if getattr(route, "path", None) == organ_path
+            and callable(getattr(route, "endpoint", None))
+        ),
+        None,
+    )
+
+    if artifact_path is None:
+        configured_path = os.environ.get("KILLINCHU_SOURCE_ATTESTATION_PATH", "").strip()
+        if configured_path:
+            source_path = Path(configured_path)
+        else:
+            app_root = Path(os.environ.get("KILLINCHU_ROOT", "/app"))
+            source_path = app_root / ".well-known" / "szl-source.json"
+    else:
+        source_path = Path(artifact_path)
+
+    def unavailable(schema: str, reason: str, method: str) -> Any:
+        response = JSONResponse(
+            {
+                "schema": schema,
+                "state": "UNAVAILABLE",
+                "reason": reason,
+            },
+            status_code=503,
+            headers=_JSON_HEADERS,
+        )
+        return _head_from(response, Response) if method == "HEAD" else response
+
+    async def public_openapi(request: Any) -> Any:
+        if organ_endpoint is None:
+            return unavailable(
+                "szl.openapi-unavailable/v1",
+                "generated OpenAPI contract is unavailable",
+                request.method,
+            )
+
+        try:
+            generated = organ_endpoint()
+            if inspect.isawaitable(generated):
+                generated = await generated
+
+            status_code = 200
+            if isinstance(generated, Response):
+                status_code = generated.status_code
+                raw_body = getattr(generated, "body", None)
+                if raw_body is None:
+                    raise ValueError("schema response is not materialized JSON")
+                payload = json.loads(bytes(raw_body).decode("utf-8"))
+            else:
+                payload = generated
+
+            if status_code >= 400 or not isinstance(payload, dict) or not payload.get("openapi"):
+                raise ValueError("schema response is not a valid OpenAPI document")
+        except Exception:
+            return unavailable(
+                "szl.openapi-unavailable/v1",
+                "generated OpenAPI contract is unavailable",
+                request.method,
+            )
+
+        response = JSONResponse(payload, headers=_JSON_HEADERS)
+        return _head_from(response, Response) if request.method == "HEAD" else response
+
+    async def source_attestation(request: Any) -> Any:
+        try:
+            raw = source_path.read_bytes()
+            if not raw or len(raw) > _MAX_SOURCE_BYTES:
+                raise ValueError("source attestation has an invalid size")
+            parsed = json.loads(raw.decode("utf-8"))
+            if not isinstance(parsed, dict):
+                raise ValueError("source attestation must be a JSON object")
+        except (OSError, UnicodeError, ValueError, json.JSONDecodeError):
+            return unavailable(
+                "szl.source-attestation-unavailable/v1",
+                "source attestation artifact is unavailable or invalid",
+                request.method,
+            )
+
+        response = Response(content=raw, media_type="application/json", headers=_JSON_HEADERS)
+        return _head_from(response, Response) if request.method == "HEAD" else response
+
+    existing_names = {getattr(route, "name", None) for route in app.router.routes}
+    routes: list[Any] = []
+    registered: list[str] = []
+
+    if _OPENAPI_ROUTE_NAME not in existing_names:
+        routes.append(
+            Route(
+                "/openapi.json",
+                endpoint=public_openapi,
+                methods=["GET", "HEAD"],
+                name=_OPENAPI_ROUTE_NAME,
+            )
+        )
+        registered.append("/openapi.json")
+
+    if _SOURCE_ROUTE_NAME not in existing_names:
+        routes.append(
+            Route(
+                "/.well-known/szl-source.json",
+                endpoint=source_attestation,
+                methods=["GET", "HEAD"],
+                name=_SOURCE_ROUTE_NAME,
+            )
+        )
+        registered.append("/.well-known/szl-source.json")
+
+    # Starlette resolves in declaration order. Front insertion ensures these
+    # exact contracts win over FastAPI's broken default and /{full_path:path}.
+    if routes:
+        app.router.routes[0:0] = routes
+
+    return {
+        "registered": registered,
+        "openapi_source": organ_path,
+        "source_artifact": str(source_path),
+    }
+
+
+__all__ = ["register"]

serve.py

@@ -5382,32 +5382,34 @@ except Exception as _sapa_e:  # pragma: no cover
 
 
 # ============================================================================
-# SPACES ON a-11-oy.com (Dev2+3) — surface all 11 live HF Spaces same-origin.
-# (1) szl_spaces_proxy: reverse-proxy each Space under /spaces/<name> (server-side
-#     fetch, honest 502 on flap, allowlist only, a11oy/killinchu skipped as self/own-
-#     host). (2) szl_spaces_surface: /api/<ns>/v1/spaces/health (REAL probe + HF-API
-#     stage), /spaces tiles page, + ONE idempotent "Spaces" nav item. Both SHARED &
-#     byte-identical in a11oy + killinchu. No new subdomains. 0 runtime CDN (server-
-#     side fetch — same justification as a11oy_hf_assets.py). Additive, idempotent,
-#     try/except-guarded; each register() front-inserts its routes so they beat the
-#     SPA + Node-proxy catch-alls. Doctrine v11: locked=8 @ c7c0ba17; Λ=Conjecture 1;
-#     Khipu=Conjecture 2; honest 502/unknown beats a fake 200; no codenames; no key.
+# HUGGING FACE SPACES REGISTRY (Dev2+3) — all 26 audited Spaces.
+# (1) szl_spaces_proxy: legacy /spaces/<name>/<path> links are no-store 307
+#     handoffs to canonical isolated HF app origins. It never proxies upstream bytes,
+#     JavaScript, cookies, or authentication into the Killinchu origin.
+# (2) szl_spaces_surface: /api/<ns>/v1/spaces/health (REAL probe + HF-API stage),
+#     /spaces canonical-origin tiles, + ONE idempotent nav item. Both front-insert
+#     exact routes before the SPA catch-all. Runtime health remains honestly measured;
+#     no missing probe becomes a fabricated green state.
 # Signed-off-by: Stephen Lutar <stephenlutar2@gmail.com>
 # Co-Authored-By: Perplexity Computer Agent <agent@perplexity.ai>
 # ============================================================================
 try:
     try:  # substrate-finish repoint: prefer shared pkg, fall back to vendored copy
         from szl_substrate import szl_spaces_proxy as _szl_spaces_proxy  # single source of truth
+        if getattr(_szl_spaces_proxy, "SPACE_HANDOFF_MODE", None) != "canonical-redirect-only/v1":
+            raise ImportError("shared Spaces module lacks redirect-only security contract")
     except Exception:
         import szl_spaces_proxy as _szl_spaces_proxy
     _szl_spaces_proxy_status = _szl_spaces_proxy.register(app, ns="killinchu")
-    print(f"[killinchu] Spaces reverse-proxy registered: {_szl_spaces_proxy_status}", file=__import__("sys").stderr)
+    print(f"[killinchu] Spaces canonical handoffs registered: {_szl_spaces_proxy_status}", file=__import__("sys").stderr)
 except Exception as _szl_sp_e:  # pragma: no cover
-    print(f"[killinchu] Spaces reverse-proxy NOT registered: {_szl_sp_e!r}; SPA + API unaffected", file=__import__("sys").stderr)
+    print(f"[killinchu] Spaces canonical handoffs NOT registered: {_szl_sp_e!r}; SPA + API unaffected", file=__import__("sys").stderr)
 
 try:
     try:  # substrate-finish repoint: prefer shared pkg, fall back to vendored copy
         from szl_substrate import szl_spaces_surface as _szl_spaces_surface  # single source of truth
+        if getattr(_szl_spaces_surface, "SPACE_TILE_ORIGIN_MODE", None) != "canonical-isolated-hf/v1":
+            raise ImportError("shared Spaces surface lacks canonical-origin contract")
     except Exception:
         import szl_spaces_surface as _szl_spaces_surface
     _szl_spaces_surface_status = _szl_spaces_surface.register(app, ns="killinchu")
@@ -5542,6 +5544,31 @@ except Exception as _kc_wave_e:  # pragma: no cover — never break SPA/other or
 # ============================================================================
 
 
+# ============================================================================
+# BEGIN: P0 PUBLIC DISCOVERY ROUTE REPAIR (ADDITIVE)
+# Exact JSON contracts must resolve before FastAPI's default /openapi.json and
+# the SPA /{full_path:path} fallback. The helper delegates to the existing
+# hardened namespaced OpenAPI generator and serves the existing source artifact
+# from disk; missing evidence fails closed as JSON 503 (never synthetic HTML).
+# ============================================================================
+try:
+    import killinchu_public_route_repair as _kc_public_route_repair
+    _kc_public_route_status = _kc_public_route_repair.register(app, ns="killinchu")
+    print(
+        f"[killinchu] P0 public discovery routes registered: {_kc_public_route_status}",
+        file=sys.stderr,
+    )
+except Exception as _kc_public_route_e:  # pragma: no cover - preserve startup
+    print(
+        f"[killinchu] P0 public discovery routes NOT registered: {_kc_public_route_e!r}; "
+        "other organs unaffected",
+        file=sys.stderr,
+    )
+# ============================================================================
+# END: P0 PUBLIC DISCOVERY ROUTE REPAIR
+# ============================================================================
+
+
 if __name__ == "__main__":
     import uvicorn
     port = int(os.environ.get("PORT", "7860"))

szl_spaces_proxy.py

@@ -1,444 +1,323 @@
 #!/usr/bin/env python3
 # SPDX-License-Identifier: Apache-2.0
 # © 2026 Lutar, Stephen P. — SZL Holdings · ORCID 0009-0001-0110-4173
-"""szl_spaces_proxy.py — surface the live HF Spaces estate under a-11-oy.com/spaces/*.
+"""Canonical-origin handoffs for the audited Hugging Face Spaces estate.
 
-ADDITIVE, self-contained, SHARED (byte-identical in a11oy + killinchu). Founder rule:
-"all the huggingface on my a-11-oy.com" with NO new subdomains. This module reverse-
-proxies each live Hugging Face Space to a same-origin path:
+This shared module keeps the historical ``/spaces/<slug>`` links working without
+executing another Space inside the a11oy or Killinchu origin:
 
-    GET/HEAD /spaces                 -> index (delegates to szl_spaces_surface tiles if
-                                        present; else a minimal honest index of the 11)
-    GET/HEAD /spaces/{name}          -> reverse-proxy of https://szlholdings-{name}.hf.space/
-    GET/HEAD /spaces/{name}/{path}   -> reverse-proxy of that Space's sub-paths/assets
+* ``GET/HEAD /spaces`` renders a minimal fallback index when the richer tiles
+  surface is not registered.
+* ``GET/HEAD /spaces/{name}`` returns a no-store 307 to the audited Space's
+  canonical Hugging Face application origin.
+* ``GET/HEAD /spaces/{name}/{path}`` preserves the suffix and raw query string
+  in the same no-store 307 handoff.
 
-The proxy is a SERVER-SIDE fetch over the app's shared httpx.AsyncClient (resolved
-lazily from serve.py's module global, like szl_engine_status), NOT a browser CDN load —
-so it satisfies the 0-runtime-CDN doctrine for the same reason a11oy_hf_assets.py states
-(server-side fetch, not a browser CDN). HTML responses get a <base href="/spaces/{name}/">
-injected so the Space's root-relative assets resolve back through this proxy.
+There is no upstream fetch path in this module. It never copies upstream HTML,
+JavaScript, response bytes, authentication state, or ``Set-Cookie`` into the
+host application. Interactive apps, streaming, cookies, and authentication stay
+isolated on Hugging Face. Unknown identifiers fail closed with 404, so these
+routes cannot become an open redirect.
 
-HONEST DEGRADE: upstream timeout / connect error / unreachable -> a clean 502 page
-("Space <name> is starting / unreachable — open directly: <hf.space url>"). NEVER a fake
-200. Hop-by-hop headers are stripped. The proxy is an ALLOWLIST of the known Space names
-only (no open proxy); unknown names -> 404. a11oy is NOT self-proxied (would loop) and
-killinchu is served on its own host — both are listed as TILES (by szl_spaces_surface)
-linking to their canonical hosts, but are NOT in the reverse-proxy allowlist here.
-
-No auth token is forwarded to HF — these are PUBLIC Spaces.
-
-Routes are inserted at the FRONT of app.router.routes (app.router.routes[0:0] = new)
-so they win over the /api/<ns>/{path:path} Node proxy + the /{full_path:path} SPA
-catch-all (the same route-to-front idiom a11oy_hf_assets.py uses).
-
-Doctrine v11: locked-proven = EXACTLY 8 {F1,F4,F7,F11,F12,F18,F19,F22} @ c7c0ba17;
-Λ = Conjecture 1; Khipu = Conjecture 2; trust never 100%; 0 runtime CDN (server-side
-fetch); no user-visible codenames (Space names are their own honest titles); never
-commits a key; additive-only; never weakens a gate; honest 502 beats a fake 200.
+Routes are front-inserted so exact compatibility links beat the application's
+SPA catch-all. The audited 26-Space identity list is static; runtime reachability
+continues to be measured honestly by ``szl_spaces_surface``.
 
 Signed-off-by: Stephen Lutar <stephenlutar2@gmail.com>
-Co-Authored-By: Perplexity Computer Agent <agent@perplexity.ai>
 """
 from __future__ import annotations
 
+import html
 import sys
 from typing import Any
+from urllib.parse import quote
 
 _ORG_PREFIX = "szlholdings-"
-
-# The 11 live Spaces (all RUNNING). app URL pattern: https://szlholdings-<name>.hf.space
-# PROXY allowlist = the names we reverse-proxy under /spaces/<name>. We SKIP:
-#   - "a11oy"    : self-proxy would loop (a-11-oy.com IS the a11oy Space).
-#   - "killinchu": served on its own host; we link the tile to its host, never proxy it.
-# Both skipped names are still listed as TILES by szl_spaces_surface.
-ALL_SPACES = [
-    "immune", "sda", "anatomy", "cathedral", "energy", "yarqa",
-    "khipu-constellation", "llm-router-live", "hatun-mcp", "a11oy", "killinchu",
+_ORG = "SZLHOLDINGS"
+SPACE_HANDOFF_MODE = "canonical-redirect-only/v1"
+
+# Audited 26-Space public estate. Runtime state is deliberately absent here.
+# ``slug`` is the lowercase legacy route key; SDK selects the canonical app host.
+SPACE_INVENTORY: list[dict[str, str]] = [
+    {"name": "a11oy", "slug": "a11oy", "title": "a11oy — Command Center", "sdk": "docker"},
+    {"name": "anatomy", "slug": "anatomy", "title": "SZL Living Anatomy", "sdk": "docker"},
+    {"name": "cosmos", "slug": "cosmos", "title": "SZL Cosmos", "sdk": "docker"},
+    {"name": "david-leads", "slug": "david-leads", "title": "David Leads — Sovereign Insurance Intelligence", "sdk": "docker"},
+    {"name": "energy-attest-holo", "slug": "energy-attest-holo", "title": "Energy Attestation Holo", "sdk": "static"},
+    {"name": "energy-attested-runs", "slug": "energy-attested-runs", "title": "Energy-Attested Inference Runs", "sdk": "gradio"},
+    {"name": "governed-norm-holo", "slug": "governed-norm-holo", "title": "Governed Norms — WILLAY classifiers", "sdk": "static"},
+    {"name": "governed-receipt-verifier", "slug": "governed-receipt-verifier", "title": "Governed Receipt Verifier", "sdk": "static"},
+    {"name": "guardrail-receipt", "slug": "guardrail-receipt", "title": "Guardrail Decision-Receipt", "sdk": "gradio"},
+    {"name": "hatun-mcp", "slug": "hatun-mcp", "title": "hatun — MCP Server", "sdk": "docker"},
+    {"name": "holographic", "slug": "holographic", "title": "Holographic Estate", "sdk": "docker"},
+    {"name": "immune", "slug": "immune", "title": "IMMUNE — Verifiable AI Defense Matrix", "sdk": "docker"},
+    {"name": "killinchu", "slug": "killinchu", "title": "killinchu — Andean Drone Intelligence", "sdk": "docker"},
+    {"name": "lambda-gate-holo", "slug": "lambda-gate-holo", "title": "Λ Gate — Conjecture 1, never green", "sdk": "static"},
+    {"name": "llm-router-live", "slug": "llm-router-live", "title": "SZL LLM Router", "sdk": "docker"},
+    {"name": "README", "slug": "readme", "title": "SZL Holdings — Governed-AI Command Platform", "sdk": "static"},
+    {"name": "receipt-chain-live", "slug": "receipt-chain-live", "title": "Receipt Chain Live", "sdk": "static"},
+    {"name": "sda", "slug": "sda", "title": "SZL SDA", "sdk": "docker"},
+    {"name": "szl-blocked-live", "slug": "szl-blocked-live", "title": "szl-blocked-live", "sdk": "static"},
+    {"name": "szl-estate-live", "slug": "szl-estate-live", "title": "Khipu Loom — Governed AI Estate", "sdk": "static"},
+    {"name": "szl-forge-lab", "slug": "szl-forge-lab", "title": "SZL Forge Lab", "sdk": "gradio"},
+    {"name": "szl-govsign-live", "slug": "szl-govsign-live", "title": "szl-govsign-live", "sdk": "static"},
+    {"name": "szl-kernels-live", "slug": "szl-kernels-live", "title": "SZL Kernel Operations Hub", "sdk": "static"},
+    {"name": "szl-model-inference-lab", "slug": "szl-model-inference-lab", "title": "SZL Model Inference Lab", "sdk": "docker"},
+    {"name": "szl-provctl-live", "slug": "szl-provctl-live", "title": "szl-provctl-live", "sdk": "static"},
+    {"name": "yarqa", "slug": "yarqa", "title": "yarqa — Plug-Flow Compartments (live or sample, always honest)", "sdk": "docker"},
 ]
-# Names we DO reverse-proxy (allowlist). Order preserved for the fallback index.
-PROXY_SPACES = [n for n in ALL_SPACES if n not in ("a11oy", "killinchu")]
+_SPACE_BY_NAME = {sp["name"]: sp for sp in SPACE_INVENTORY}
+_SPACE_BY_SLUG = {sp["slug"]: sp for sp in SPACE_INVENTORY}
+
+ALL_SPACES = [sp["slug"] for sp in SPACE_INVENTORY]
+HANDOFF_SPACES = list(ALL_SPACES)
+# Backwards-compatible public name retained for downstream inventory checks.
+PROXY_SPACES = HANDOFF_SPACES
+
+_NO_STORE_HEADERS = {
+    "Cache-Control": "no-store",
+    "Referrer-Policy": "no-referrer",
+    "X-SZL-Space-Handoff": "canonical-origin",
+}
 
 
-def hf_url(name: str) -> str:
-    """Canonical HF app URL for a Space name (lowercase, org-prefixed)."""
-    return f"https://{_ORG_PREFIX}{name}.hf.space"
+def _space_record(identifier: str) -> dict[str, str]:
+    """Resolve only audited inventory identifiers; fail closed otherwise."""
 
+    record = _SPACE_BY_NAME.get(identifier) or _SPACE_BY_SLUG.get(identifier)
+    if record is None:
+        raise ValueError("unknown Space identifier: %s" % identifier)
+    return record
 
-# Hop-by-hop headers (RFC 7230 §6.1) — never forwarded across the proxy boundary.
-_HOP_BY_HOP = {
-    "connection", "keep-alive", "proxy-authenticate", "proxy-authorization",
-    "te", "trailers", "transfer-encoding", "upgrade",
-    # content-encoding/length are recomputed by our Response; strip to avoid mismatch.
-    "content-encoding", "content-length",
-}
 
-_PROXY_TIMEOUT = 20.0      # the box egress to *.hf.space flaps; give a full page GET room
-                           # to ride through a flap (the health HEAD probe needs less).
-_PROXY_RETRIES = 3         # retry a transient flap several times before honest-degrading.
-_MAX_BYTES = 25 * 1024 * 1024  # 25MB cap per proxied response (Spaces are light pages).
+def hf_url(name: str) -> str:
+    """Return the canonical isolated application origin for an audited Space."""
 
+    record = _space_record(name)
+    suffix = ".static.hf.space" if record["sdk"] == "static" else ".hf.space"
+    return f"https://{_ORG_PREFIX}{record['slug']}{suffix}"
 
-def _honest_502(name: str) -> bytes:
-    """Clean 502 page — NEVER a fake 200. Tells the user to open the Space directly."""
-    url = hf_url(name)
-    return (
-        "<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\">"
-        "<meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">"
-        "<title>Space %s — starting / unreachable</title></head>"
-        "<body style=\"margin:0;background:#0b0f14;color:#cdd6e0;"
-        "font:15px/1.6 system-ui,-apple-system,Segoe UI,Roboto,sans-serif;"
-        "display:flex;min-height:100vh;align-items:center;justify-content:center\">"
-        "<main style=\"max-width:560px;padding:2rem;text-align:center\">"
-        "<div style=\"font-size:2.2rem;margin-bottom:.4rem\">&#9889;</div>"
-        "<h1 style=\"font-size:1.25rem;margin:0 0 .6rem;color:#e7eef6\">"
-        "Space &ldquo;%s&rdquo; is starting or unreachable</h1>"
-        "<p style=\"color:#8a96a3;margin:0 0 1.2rem\">The upstream Hugging Face Space did "
-        "not respond in time. This is an honest 502 &mdash; not a faked page. "
-        "It usually means the Space is waking from sleep; try again shortly.</p>"
-        "<p><a href=\"%s\" style=\"color:#d4a444;text-decoration:none;font-weight:600\">"
-        "Open %s directly on Hugging Face &rarr;</a></p>"
-        "<p style=\"margin-top:1.4rem\"><a href=\"/spaces\" "
-        "style=\"color:#7c8794;text-decoration:none\">&larr; All Spaces</a></p>"
-        "</main></body></html>" % (name, name, url, name)
-    ).encode("utf-8")
+
+def hf_repo_url(name: str) -> str:
+    """Return the canonical Hugging Face repository page for an audited Space."""
+
+    record = _space_record(name)
+    return f"https://huggingface.co/spaces/{_ORG}/{record['name']}"
 
 
 def _fallback_index() -> bytes:
-    """Minimal honest /spaces index — used ONLY if szl_spaces_surface (the rich tiles
-    page) is not registered. Lists every Space name with both links. 0 CDN."""
+    """Render the dependency-free fallback registry with canonical links only."""
+
     rows = []
-    for name in ALL_SPACES:
-        if name in ("a11oy", "killinchu"):
-            local = hf_url(name)  # own canonical host (not self-proxied here)
-            local_label = "Open on HF"
-        else:
-            local = "/spaces/%s" % name
-            local_label = "Open in a-11-oy.com"
+    for record in SPACE_INVENTORY:
+        title = html.escape(record["title"])
+        name = html.escape(record["name"])
+        sdk = html.escape(record["sdk"])
+        canonical = html.escape(hf_url(record["slug"]), quote=True)
+        repository = html.escape(hf_repo_url(record["slug"]), quote=True)
         rows.append(
-            "<li style=\"margin:.4rem 0\"><strong style=\"color:#e7eef6\">%s</strong> "
-            "&middot; <a href=\"%s\" style=\"color:#d4a444;text-decoration:none\">%s</a> "
-            "&middot; <a href=\"%s\" style=\"color:#7c8794;text-decoration:none\">Open on HF</a>"
-            "</li>" % (name, local, local_label, hf_url(name))
+            '<li style="margin:.4rem 0"><strong style="color:#e7eef6">%s</strong> '
+            '<small style="color:#697787">%s &middot; %s</small> '
+            '&middot; <a href="%s" rel="noopener" target="_blank" '
+            'style="color:#d4a444;text-decoration:none">Open canonical app &#8599;</a> '
+            '&middot; <a href="%s" rel="noopener" target="_blank" '
+            'style="color:#7c8794;text-decoration:none">View repository &#8599;</a></li>'
+            % (title, name, sdk, canonical, repository)
         )
     return (
-        "<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\">"
-        "<meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">"
-        "<title>Spaces</title></head>"
-        "<body style=\"margin:0;background:#0b0f14;color:#cdd6e0;"
-        "font:15px/1.6 system-ui,-apple-system,Segoe UI,Roboto,sans-serif;padding:2rem\">"
-        "<main style=\"max-width:760px;margin:0 auto\">"
-        "<h1 style=\"color:#e7eef6\">Hugging Face Spaces</h1>"
-        "<p style=\"color:#8a96a3\">All live Spaces, surfaced under a-11-oy.com. "
-        "Server-side reverse proxy &mdash; 0 browser CDN.</p>"
-        "<ul style=\"list-style:none;padding:0\">" + "".join(rows) + "</ul>"
+        '<!doctype html><html lang="en"><head><meta charset="utf-8">'
+        '<meta name="viewport" content="width=device-width,initial-scale=1">'
+        '<title>Hugging Face Spaces</title>'
+        '<style>*{box-sizing:border-box}li{overflow-wrap:anywhere}'
+        'li a{display:inline-flex;align-items:center;min-height:44px;padding:.3rem .15rem}'
+        '@media(max-width:375px){body{padding:1rem!important}}</style></head>'
+        '<body style="margin:0;background:#0b0f14;color:#cdd6e0;'
+        'font:15px/1.6 system-ui,-apple-system,Segoe UI,Roboto,sans-serif;padding:2rem">'
+        '<main style="max-width:760px;margin:0 auto">'
+        '<h1 style="color:#e7eef6">Hugging Face Spaces</h1>'
+        '<p style="color:#8a96a3">All 26 audited Spaces open on their canonical isolated '
+        'Hugging Face origins. Legacy <code>/spaces/&lt;slug&gt;</code> links are no-store '
+        '307 handoffs; no upstream response bytes or cookies cross this application.</p>'
+        '<ul style="list-style:none;padding:0">' + "".join(rows) + "</ul>"
         "</main></body></html>"
     ).encode("utf-8")
 
 
-def _resolve_client() -> Any:
-    """Resolve the app's shared httpx.AsyncClient lazily from serve.py's module global
-    (same idiom as szl_engine_status) so registration order doesn't matter."""
+def _canonical_target(name: str, subpath: str = "", query: str = "") -> str:
+    """Build a fixed-origin redirect target without accepting an arbitrary host."""
+
+    record = _SPACE_BY_SLUG.get(name)
+    if record is None or name not in HANDOFF_SPACES:
+        raise ValueError("unknown Space identifier: %s" % name)
+    target = hf_url(name)
+    if subpath:
+        encoded_path = quote(subpath.lstrip("/"), safe="/:@!$&'()*+,;=-._~")
+        target += "/" + encoded_path
+    if query:
+        target += "?" + quote(query, safe="=&;%:+,/?@-._~")
+    return target
+
+
+def _raw_query(request: Any) -> str | None:
+    raw = request.scope.get("query_string", b"")
     try:
-        import serve as _serve  # type: ignore
-        return getattr(_serve, "_http_client", None)
-    except Exception:
+        query = bytes(raw).decode("ascii")
+    except (UnicodeDecodeError, TypeError, ValueError):
         return None
+    if "\r" in query or "\n" in query:
+        return None
+    return query
 
 
-def _urllib_fetch(method: str, url: str, headers: dict, timeout: float):
-    """Blocking stdlib fetch — the PROVEN-working outbound path on the live box
-    (a11oy_hf_assets.py reaches HF via urllib server-side). Used as a fallback when the
-    shared httpx.AsyncClient is None or fails. Returns (status, body_bytes, headers_dict).
-    Raises on failure (caller degrades to an honest 502). 0 browser CDN; no auth token."""
-    import http.client
-    import urllib.error
-    import urllib.request
-    req = urllib.request.Request(url, method=method.upper(), headers=headers)
-    try:
-        with urllib.request.urlopen(req, timeout=timeout) as r:
-            status = getattr(r, "status", None) or r.getcode()
-            hdrs = {k: v for k, v in r.headers.items()}
-            # Read the body TOLERANTLY: a flapping upstream often drops the connection
-            # mid-stream (http.client.IncompleteRead). The status line + headers already
-            # arrived fine, so return whatever body bytes we got rather than 502-ing a
-            # response that was really a 200. This is honest: status reflects the REAL
-            # upstream status; we just don't discard a near-complete page over a late EOF.
-            try:
-                body = r.read(_MAX_BYTES)
-            except http.client.IncompleteRead as ire:
-                body = ire.partial or b""
-            except Exception:
-                body = b""
-            return status, body, hdrs
-    except urllib.error.HTTPError as he:  # a real upstream non-2xx is NOT a flap
-        body = b""
-        try:
-            body = he.read(_MAX_BYTES)
-        except Exception:
-            pass
-        return he.code, body, {k: v for k, v in (he.headers or {}).items()}
-
-
-async def _to_thread(fn, *a, **kw):
-    import asyncio as _asyncio
-    return await _asyncio.get_event_loop().run_in_executor(None, lambda: fn(*a, **kw))
-
-
-def _rewrite_html(body: bytes, name: str) -> bytes:
-    """Inject <base href="/spaces/<name>/"> so the Space's root-relative asset URLs
-    (e.g. /assets/app.js, href="/"...) resolve back through this proxy. Idempotent:
-    if a base href for this proxy is already present, leave the body untouched."""
-    base_tag = ('<base href="/spaces/%s/">' % name).encode("utf-8")
-    if base_tag in body:
-        return body
-    low = body.lower()
-    # Prefer to place the <base> right after <head ...> so it applies to all assets.
-    h = low.find(b"<head")
-    if h != -1:
-        gt = body.find(b">", h)
-        if gt != -1:
-            return body[: gt + 1] + base_tag + body[gt + 1:]
-    # No <head> — try right after <html ...>.
-    h = low.find(b"<html")
-    if h != -1:
-        gt = body.find(b">", h)
-        if gt != -1:
-            return body[: gt + 1] + base_tag + body[gt + 1:]
-    # No usable anchor — prepend (still better than broken relative assets).
-    return base_tag + body
-
-
-async def _proxy(name: str, subpath: str, request) -> Any:
-    """Reverse-proxy one request to the named Space. Honest 502 on any upstream flap."""
-    from starlette.responses import Response
-
-    if name not in PROXY_SPACES:
-        # Not in the allowlist — either unknown, or a deliberately-skipped self/own-host
-        # Space. 404 (no open proxy). The skipped ones are reachable as tiles only.
-        return Response(content=b"Unknown or non-proxied Space.\n",
-                        status_code=404, media_type="text/plain")
-
-    # Resolve the shared async httpx client if it's wired. On the LIVE box serve.py runs
-    # as __main__ (Dockerfile CMD ["python","serve.py"]), so `import serve` inside
-    # _resolve_client() binds a SECOND module object whose startup() never fired and whose
-    # _http_client is therefore None — even though the real __main__ app has a live client.
-    # We must NOT 502 on a None client: the stdlib urllib path below is the PROVEN outbound
-    # path on this box (it is exactly what szl_spaces_surface's health probe uses to report
-    # app_reachable=true). So client==None simply means "skip httpx, use urllib" — never an
-    # automatic honest-502. An honest 502 is reserved for a GENUINE upstream flap (both the
-    # httpx attempt AND the urllib fallback exhausted their retries).
-    client = _resolve_client()
-
-    target = hf_url(name) + "/" + subpath
-    # Send a CLEAN, minimal header set rather than forwarding the raw browser headers.
-    # Forwarding the incoming Host (a-11-oy.com) makes HF route to the wrong vhost -> 404,
-    # and forwarding the full browser header set (incl. Accept-Encoding: br, X-Forwarded-*)
-    # was tripping the upstream fetch on the live box. We mirror the proven-working probe:
-    # identity encoding, a simple UA, and only the few request headers that are safe to
-    # pass through. No Host, no cookies, no auth token (public Spaces).
-    _SAFE_PASS = {"accept", "accept-language", "range", "content-type"}
-    fwd_headers = {
-        "User-Agent": "szl-spaces-proxy/1.0",
-        "Accept-Encoding": "identity",
-    }
-    for k, v in request.headers.items():
-        if k.lower() in _SAFE_PASS:
-            fwd_headers[k] = v
-    fwd_headers.setdefault("Accept", "*/*")
-    method = request.method.upper()
-
-    status = None
-    body = b""
-    up_headers: dict = {}
-    last_exc = None
-
-    # Try the shared async httpx client first (streaming-capable, preferred).
-    if client is not None:
-        for _attempt in range(_PROXY_RETRIES + 1):
-            try:
-                upstream = await client.request(
-                    method, target, headers=fwd_headers,
-                    timeout=_PROXY_TIMEOUT, follow_redirects=True,
-                )
-                status = upstream.status_code
-                body = upstream.content or b""
-                up_headers = {k: v for k, v in upstream.headers.items()}
-                break
-            except Exception as e:  # connect/timeout/read error -> try fallback below
-                last_exc = e
-                status = None
-                import asyncio as _a
-                await _a.sleep(0.4 * (_attempt + 1))  # brief backoff across a flap
-
-    # Fallback to the PROVEN stdlib urllib path if httpx was None or failed.
-    if status is None:
-        import asyncio as _a
-        for _attempt in range(_PROXY_RETRIES + 1):
-            try:
-                status, body, up_headers = await _to_thread(
-                    _urllib_fetch, method, target, fwd_headers, _PROXY_TIMEOUT)
-                break
-            except Exception as e:  # genuine upstream flap -> honest 502
-                last_exc = e
-                status = None
-                await _a.sleep(0.5 * (_attempt + 1))  # brief backoff across a flap
-
-    if status is None:
-        print("[spaces-proxy] upstream flap for %s: %r" % (name, last_exc),
-              file=sys.stderr)
-        # Surface the real upstream error class in an honest diagnostic header (the body
-        # stays the clean honest-502 page). Never fabricates a 200.
-        return Response(content=_honest_502(name), status_code=502,
-                        media_type="text/html",
-                        headers={"x-szl-proxy-error": type(last_exc).__name__ if last_exc else "none",
-                                 "x-szl-proxy-target": target})
-
-    if len(body) > _MAX_BYTES:
-        body = body[:_MAX_BYTES]
-    ct = (up_headers.get("content-type") or up_headers.get("Content-Type") or "").lower()
-
-    # HTML: inject <base href> so assets resolve under /spaces/<name>/.
-    if "text/html" in ct:
-        body = _rewrite_html(body, name)
-
-    out_headers = {
-        k: v for k, v in up_headers.items()
-        if k.lower() not in _HOP_BY_HOP
-    }
-    # HEAD must carry no body.
-    if method == "HEAD":
-        body = b""
-
-    return Response(content=body, status_code=status,
-                    headers=out_headers,
-                    media_type=ct or None)
-
-
-def register(app, ns: str = "a11oy") -> str:
-    """ADDITIVE: mount the /spaces reverse-proxy routes at the FRONT of the router so
-    they beat the SPA + Node-proxy catch-alls. try/except-guarded by the caller."""
+async def _proxy(name: str, subpath: str, request: Any) -> Any:
+    """Legacy function name; perform a redirect-only canonical-origin handoff."""
+
+    from starlette.responses import RedirectResponse, Response
+
+    if name not in HANDOFF_SPACES:
+        return Response(
+            content=b"Unknown or non-handoff Space.\n",
+            status_code=404,
+            media_type="text/plain",
+            headers={"Cache-Control": "no-store"},
+        )
+
+    query = _raw_query(request)
+    if query is None:
+        return Response(
+            content=b"Invalid query string.\n",
+            status_code=400,
+            media_type="text/plain",
+            headers={"Cache-Control": "no-store"},
+        )
+
+    target = _canonical_target(name, subpath, query)
+
+    return RedirectResponse(target, status_code=307, headers=_NO_STORE_HEADERS)
+
+
+def register(app: Any, ns: str = "a11oy") -> str:
+    """Front-insert the fallback index and redirect-only compatibility routes."""
+
     try:
         from starlette.responses import Response
-    except Exception as e:  # pragma: no cover
-        return "unavailable: %r" % (e,)
+        from starlette.routing import Route
+    except Exception as exc:  # pragma: no cover
+        return "unavailable: %r" % (exc,)
 
     n_before = len(app.router.routes)
 
-    async def _spaces_index(request):
-        # Delegate the rich tiles page to szl_spaces_surface if it owns /spaces; this
-        # fallback index only renders if that module isn't present. Idempotent: this
-        # route is inserted only once per register() and register() is guarded upstream.
+    async def _spaces_index(request: Any) -> Any:
+        headers = {"Cache-Control": "no-store"}
         if request.method.upper() == "HEAD":
-            return Response(content=b"", status_code=200, media_type="text/html")
-        return Response(content=_fallback_index(), status_code=200,
-                        media_type="text/html")
+            return Response(content=b"", status_code=200, media_type="text/html", headers=headers)
+        return Response(
+            content=_fallback_index(),
+            status_code=200,
+            media_type="text/html",
+            headers=headers,
+        )
 
-    async def _spaces_name(request):
-        name = request.path_params.get("name", "")
-        return await _proxy(name, "", request)
+    async def _spaces_name(request: Any) -> Any:
+        return await _proxy(request.path_params.get("name", ""), "", request)
 
-    async def _spaces_path(request):
-        name = request.path_params.get("name", "")
-        subpath = request.path_params.get("path", "")
-        return await _proxy(name, subpath, request)
+    async def _spaces_path(request: Any) -> Any:
+        return await _proxy(
+            request.path_params.get("name", ""),
+            request.path_params.get("path", ""),
+            request,
+        )
 
-    from starlette.routing import Route
-    # NOTE: szl_spaces_surface registers its OWN richer /spaces tiles page and inserts
-    # it at the front AFTER this module (it's registered second in serve.py), so the
-    # tiles page wins over this fallback index — by design. Both are idempotent.
     routes = [
-        Route("/spaces", _spaces_index, methods=["GET", "HEAD"]),
-        Route("/spaces/{name}", _spaces_name, methods=["GET", "HEAD"]),
-        Route("/spaces/{name}/{path:path}", _spaces_path, methods=["GET", "HEAD"]),
+        Route("/spaces", _spaces_index, methods=["GET", "HEAD"], name="spaces-fallback-index"),
+        Route("/spaces/{name}", _spaces_name, methods=["GET", "HEAD"], name="spaces-handoff-root"),
+        Route(
+            "/spaces/{name}/{path:path}",
+            _spaces_path,
+            methods=["GET", "HEAD"],
+            name="spaces-handoff-path",
+        ),
     ]
-    for r in routes:
-        app.router.routes.append(r)
-
+    app.router.routes.extend(routes)
     new = app.router.routes[n_before:]
     del app.router.routes[n_before:]
     app.router.routes[0:0] = new
-    print("[%s] Spaces reverse-proxy registered: /spaces + /spaces/{name} + "
-          "/spaces/{name}/{path} (%d proxied: %s) [moved %d routes to front]"
-          % (ns, len(PROXY_SPACES), ",".join(PROXY_SPACES), len(new)), file=sys.stderr)
-    return "ok: %d proxied spaces, %d routes" % (len(PROXY_SPACES), len(new))
-
-
-# ---------------------------------------------------------------------------
-# Self-test — pure stdlib + starlette TestClient; no real network. Stubs the shared
-# client to assert: allowlist enforced (unknown -> 404), honest 502 on a dead client,
-# <base href> injection, HEAD carries no body, and the fallback index lists all 11.
-# ---------------------------------------------------------------------------
-if __name__ == "__main__":
-    import ast as _ast
-    # parse-self guard
-    with open(__file__, "r", encoding="utf-8") as _fh:
-        _ast.parse(_fh.read())
-
-    # base-href injection
-    out = _rewrite_html(b"<html><head><title>x</title></head><body>hi</body></html>", "immune")
-    assert b'<base href="/spaces/immune/">' in out, "must inject base href"
-    assert _rewrite_html(out, "immune") == out, "base href injection must be idempotent"
 
-    # honest 502 content
-    p = _honest_502("sda")
-    assert b"honest 502" in p and b"szlholdings-sda.hf.space" in p, "502 must be honest + direct link"
+    print(
+        "[%s] Spaces canonical-origin handoffs registered: /spaces + "
+        "/spaces/{name} + /spaces/{name}/{path} (%d audited handoffs; %d routes)"
+        % (ns, len(HANDOFF_SPACES), len(new)),
+        file=sys.stderr,
+    )
+    return "ok: %d canonical handoff spaces, %d routes" % (len(HANDOFF_SPACES), len(new))
 
-    # allowlist
-    assert "a11oy" not in PROXY_SPACES and "killinchu" not in PROXY_SPACES, "self/own-host skipped"
-    assert len(ALL_SPACES) == 11 and len(PROXY_SPACES) == 9, (len(ALL_SPACES), len(PROXY_SPACES))
 
-    # fallback index lists all 11 names
-    idx = _fallback_index()
-    for nm in ALL_SPACES:
-        assert nm.encode() in idx, "index missing %s" % nm
+if __name__ == "__main__":
+    import ast
+    from pathlib import Path
+
+    source = Path(__file__).read_text(encoding="utf-8")
+    ast.parse(source)
+    assert "urllib" + ".request" not in source
+    assert "client." + "request(" not in source
+    assert "upstream." + "content" not in source
+
+    assert len(ALL_SPACES) == len(HANDOFF_SPACES) == 26
+    assert hf_url("README") == "https://szlholdings-readme.static.hf.space"
+    assert hf_url("immune") == "https://szlholdings-immune.hf.space"
+    try:
+        hf_url("notreal")
+        raise AssertionError("unknown Space identifier must fail closed")
+    except ValueError:
+        pass
+
+    fallback = _fallback_index()
+    for space in SPACE_INVENTORY:
+        assert space["name"].encode() in fallback
+        assert space["title"].encode() in fallback
+        assert hf_url(space["slug"]).encode() in fallback
+        assert hf_repo_url(space["slug"]).encode() in fallback
+    assert b'href="/spaces/' not in fallback
+    assert b"reverse proxy" not in fallback.lower()
 
     from starlette.applications import Starlette
     from starlette.responses import PlainTextResponse
-    from starlette.routing import Route as _R
+    from starlette.routing import Route
     from starlette.testclient import TestClient
 
-    a = Starlette(routes=[_R("/{full_path:path}", lambda req: PlainTextResponse("SPA"))])
-    st = register(a, ns="a11oy")
-    assert st.startswith("ok:"), st
-    c = TestClient(a)
-    # /spaces fallback index resolves before the SPA catch-all and lists all names
-    r = c.get("/spaces")
-    assert r.status_code == 200 and "immune" in r.text and "killinchu" in r.text, r.status_code
-    # unknown / non-proxied name -> 404 (no open proxy); a11oy is deliberately skipped
-    assert c.get("/spaces/a11oy").status_code == 404, "a11oy must not be self-proxied"
-    assert c.get("/spaces/notreal").status_code == 404, "unknown -> 404"
-    # known name, no shared client wired AND the (urllib) upstream fetch fails -> honest 502
-    # (never a fake 200). We stub _urllib_fetch so the test is hermetic (no real network):
-    # client==None must NOT short-circuit to 502 by itself; it must fall through to urllib,
-    # and only a GENUINE fetch failure degrades honestly. This is the regression guard for
-    # the live __main__/import-serve dual-module bug (client==None on the box) that was
-    # making EVERY proxied Space 502 even though the urllib probe reached the upstream fine.
-    # NB: stub the global in THIS running module (serve runs us as __main__, and _proxy
-    # resolves _urllib_fetch via the module global at call time), so monkeypatch globals().
-    _self_mod = sys.modules[__name__]
-    _orig_fetch = _self_mod._urllib_fetch
-    def _boom(*_a, **_k):
-        raise OSError("simulated upstream flap")
-    _self_mod._urllib_fetch = _boom
-    try:
-        r502 = c.get("/spaces/immune")
-        assert r502.status_code == 502 and "honest 502" in r502.text, (r502.status_code, r502.text[:80])
-        assert r502.headers.get("x-szl-proxy-error") == "OSError", r502.headers.get("x-szl-proxy-error")
-        rh = c.head("/spaces/immune")
-        assert rh.status_code == 502, rh.status_code
-    finally:
-        _self_mod._urllib_fetch = _orig_fetch
-    # client==None + urllib SUCCESS -> 200 proxied (proves None no longer auto-502s).
-    def _ok(method, url, headers, timeout):
-        return 200, b"<html><head></head><body>live immune</body></html>", {"content-type": "text/html"}
-    _self_mod._urllib_fetch = _ok
-    try:
-        r200 = c.get("/spaces/immune")
-        assert r200.status_code == 200, r200.status_code
-        assert b'<base href="/spaces/immune/">' in r200.content, "must inject base href on proxied HTML"
-    finally:
-        _self_mod._urllib_fetch = _orig_fetch
-
-    print("szl_spaces_proxy: ALL OK (allowlist; honest 502 on genuine flap; client==None "
-          "falls through to urllib not auto-502; base-href idempotent; "
-          "%d proxied of %d; 0 CDN server-side fetch)" % (len(PROXY_SPACES), len(ALL_SPACES)))
+    app = Starlette(routes=[Route("/{full_path:path}", lambda req: PlainTextResponse("SPA"))])
+    status = register(app, ns="killinchu")
+    assert status.startswith("ok:")
+    client = TestClient(app)
+
+    root = client.get(
+        "/spaces/immune",
+        headers={"Cookie": "private=session", "Authorization": "Bearer private"},
+        follow_redirects=False,
+    )
+    assert root.status_code == 307
+    assert root.headers["location"] == "https://szlholdings-immune.hf.space"
+    assert root.headers["cache-control"] == "no-store"
+    assert root.headers["x-szl-space-handoff"] == "canonical-origin"
+    assert "set-cookie" not in root.headers and root.content == b""
+
+    nested = client.get(
+        "/spaces/immune/api/events?cursor=a%2Fb&cursor=two+words",
+        follow_redirects=False,
+    )
+    assert nested.status_code == 307
+    assert nested.headers["location"] == (
+        "https://szlholdings-immune.hf.space/api/events?cursor=a%2Fb&cursor=two+words"
+    )
+    head = client.head("/spaces/immune/assets/app.js?build=7", follow_redirects=False)
+    assert head.status_code == 307 and head.content == b""
+    assert head.headers["location"].endswith("/assets/app.js?build=7")
+    assert client.get("/spaces/notreal", follow_redirects=False).status_code == 404
+    own = client.get("/spaces/a11oy", follow_redirects=False)
+    assert own.status_code == 307
+    assert own.headers["location"] == "https://szlholdings-a11oy.hf.space"
+
+    print(
+        "szl_spaces_proxy: ALL OK (26 audited redirect-only handoffs; "
+        "path/query preserved; no-store; no upstream bytes/Set-Cookie)"
+    )

szl_spaces_surface.py

@@ -3,8 +3,8 @@
 # © 2026 Lutar, Stephen P. — SZL Holdings · ORCID 0009-0001-0110-4173
 """szl_spaces_surface.py — console "Spaces" surface (health API + tiles + nav).
 
-ADDITIVE, self-contained, SHARED (byte-identical in a11oy + killinchu). The console
-companion to szl_spaces_proxy: a LIVE health view of the whole HF Spaces estate plus a
+ADDITIVE, self-contained, SHARED across a11oy + killinchu. The console companion to
+the canonical handoff module: a LIVE health view of the whole HF Spaces estate plus a
 clean tiles page and ONE idempotent nav item, following the additive-injector pattern
 (a11oy_nav_wireup.py / killinchu_nav_wireup.py).
 
@@ -12,20 +12,21 @@ ROUTES (additive, inserted at the FRONT of the router so they beat the SPA + Nod
 catch-alls — same route-to-front idiom as a11oy_hf_assets.py):
 
   GET  /api/<ns>/v1/spaces/health  -> for each Space, an HONEST status:
-        {name, title, stage, app_reachable, url, proxy_url}
+        {name, slug, title, sdk, stage, app_reachable, url, canonical_url, proxy_url}
         - stage          : runtime.stage from the HF API
                            (https://huggingface.co/api/spaces/SZLHOLDINGS/<name>),
                            or "unknown" if that API call degrades. LABELLED as HF-API.
-        - app_reachable  : a REAL same-origin server-side probe of
+        - app_reachable  : a REAL server-side probe of
                            https://szlholdings-<name>.hf.space/ (HEAD, short timeout).
                            true ONLY when the probe really succeeded. Never fabricated.
         Degrade -> stage:"unknown", app_reachable:false. NEVER a faked stage/200.
 
   GET/HEAD /spaces                 -> a clean tiles page (one card per Space: honest
-        title, live status dot fed by /health, "Open in a-11-oy.com" -> /spaces/<name>,
-        "Open on HF" -> hf.space url). Pure inline markup, 0 browser CDN. The status
-        dots are filled by a tiny inline fetch of the SAME-ORIGIN /health JSON (not a
-        CDN; the data is our own server-side-probed endpoint).
+        title, live status dot fed by /health, canonical isolated hf.space app link,
+        and a separate huggingface.co repository link).
+        No upstream app executes inside the a11oy or Killinchu origin. Pure inline
+        markup, 0 browser CDN. Status dots are filled by a tiny inline fetch of the
+        SAME-ORIGIN /health JSON (our own server-side-probed endpoint).
 
 NAV: a BaseHTTPMiddleware injector adds ONE nav item "Spaces" -> /spaces into the
 console left-nav (before <div class="side-foot">, with nav-group / nav-item fallbacks).
@@ -54,25 +55,46 @@ from typing import Any
 
 _ORG = "SZLHOLDINGS"
 _ORG_PREFIX = "szlholdings-"
-
-# The 11 live Spaces + their honest, public titles (NOT codenames — each Space's own
-# name). a11oy + killinchu are listed as tiles linking to their own canonical hosts;
-# they are NOT reverse-proxied by szl_spaces_proxy (self / own-host).
+SPACE_TILE_ORIGIN_MODE = "canonical-isolated-hf/v1"
+
+# Audited 26-Space public estate. Names are exact Hub repository names and titles are
+# the current public card titles observed during the 2026-07-16 alignment audit. Runtime
+# state is deliberately NOT frozen here: /health measures it on every cache refresh and
+# degrades to unknown/false when evidence is unavailable. ``slug`` is the lowercase,
+# same-origin route key; it differs from ``name`` only for the Hub repository ``README``.
+# a11oy + killinchu retain the historical own-host classification in the health payload,
+# but every tile now opens its canonical isolated Hugging Face application origin.
 SPACES: list[dict[str, str]] = [
-    {"name": "immune",              "title": "Immune — Verifiable Screening"},
-    {"name": "sda",                 "title": "SDA — Space Domain Awareness"},
-    {"name": "anatomy",             "title": "Anatomy — Canonical Formula Registry"},
-    {"name": "cathedral",           "title": "Cathedral — Estate Cathedral"},
-    {"name": "energy",              "title": "Energy — Sovereign Compute"},
-    {"name": "yarqa",               "title": "Yarqa — Data Channel"},
-    {"name": "khipu-constellation", "title": "Khipu Constellation — Receipt Mesh"},
-    {"name": "llm-router-live",     "title": "LLM Router (Live)"},
-    {"name": "hatun-mcp",           "title": "Hatun — MCP Server"},
-    {"name": "a11oy",               "title": "a11oy — Brand Orchestration Layer"},
-    {"name": "killinchu",           "title": "Killinchu — Edge Console"},
+    {"name": "a11oy", "slug": "a11oy", "title": "a11oy — Command Center", "sdk": "docker"},
+    {"name": "anatomy", "slug": "anatomy", "title": "SZL Living Anatomy", "sdk": "docker"},
+    {"name": "cosmos", "slug": "cosmos", "title": "SZL Cosmos", "sdk": "docker"},
+    {"name": "david-leads", "slug": "david-leads", "title": "David Leads — Sovereign Insurance Intelligence", "sdk": "docker"},
+    {"name": "energy-attest-holo", "slug": "energy-attest-holo", "title": "Energy Attestation Holo", "sdk": "static"},
+    {"name": "energy-attested-runs", "slug": "energy-attested-runs", "title": "Energy-Attested Inference Runs", "sdk": "gradio"},
+    {"name": "governed-norm-holo", "slug": "governed-norm-holo", "title": "Governed Norms — WILLAY classifiers", "sdk": "static"},
+    {"name": "governed-receipt-verifier", "slug": "governed-receipt-verifier", "title": "Governed Receipt Verifier", "sdk": "static"},
+    {"name": "guardrail-receipt", "slug": "guardrail-receipt", "title": "Guardrail Decision-Receipt", "sdk": "gradio"},
+    {"name": "hatun-mcp", "slug": "hatun-mcp", "title": "hatun — MCP Server", "sdk": "docker"},
+    {"name": "holographic", "slug": "holographic", "title": "Holographic Estate", "sdk": "docker"},
+    {"name": "immune", "slug": "immune", "title": "IMMUNE — Verifiable AI Defense Matrix", "sdk": "docker"},
+    {"name": "killinchu", "slug": "killinchu", "title": "killinchu — Andean Drone Intelligence", "sdk": "docker"},
+    {"name": "lambda-gate-holo", "slug": "lambda-gate-holo", "title": "Λ Gate — Conjecture 1, never green", "sdk": "static"},
+    {"name": "llm-router-live", "slug": "llm-router-live", "title": "SZL LLM Router", "sdk": "docker"},
+    {"name": "README", "slug": "readme", "title": "SZL Holdings — Governed-AI Command Platform", "sdk": "static"},
+    {"name": "receipt-chain-live", "slug": "receipt-chain-live", "title": "Receipt Chain Live", "sdk": "static"},
+    {"name": "sda", "slug": "sda", "title": "SZL SDA", "sdk": "docker"},
+    {"name": "szl-blocked-live", "slug": "szl-blocked-live", "title": "szl-blocked-live", "sdk": "static"},
+    {"name": "szl-estate-live", "slug": "szl-estate-live", "title": "Khipu Loom — Governed AI Estate", "sdk": "static"},
+    {"name": "szl-forge-lab", "slug": "szl-forge-lab", "title": "SZL Forge Lab", "sdk": "gradio"},
+    {"name": "szl-govsign-live", "slug": "szl-govsign-live", "title": "szl-govsign-live", "sdk": "static"},
+    {"name": "szl-kernels-live", "slug": "szl-kernels-live", "title": "SZL Kernel Operations Hub", "sdk": "static"},
+    {"name": "szl-model-inference-lab", "slug": "szl-model-inference-lab", "title": "SZL Model Inference Lab", "sdk": "docker"},
+    {"name": "szl-provctl-live", "slug": "szl-provctl-live", "title": "szl-provctl-live", "sdk": "static"},
+    {"name": "yarqa", "slug": "yarqa", "title": "yarqa — Plug-Flow Compartments (live or sample, always honest)", "sdk": "docker"},
 ]
-# Spaces served on their OWN canonical host (not reverse-proxied here): the tile's
-# primary "open" link points at HF rather than /spaces/<name>.
+_SPACE_BY_NAME = {sp["name"]: sp for sp in SPACES}
+_SPACE_BY_SLUG = {sp["slug"]: sp for sp in SPACES}
+# Product Spaces retained as metadata for consumers that distinguish flagship hosts.
 _OWN_HOST = {"a11oy", "killinchu"}
 
 _DOCTRINE = {
@@ -85,22 +107,47 @@ _DOCTRINE = {
 
 _PROBE_TIMEOUT = 6.0
 _HF_API_TIMEOUT = 6.0
-_HEALTH_CACHE_TTL = 20.0  # seconds — keep the tiles page snappy without re-probing 11x.
+_HEALTH_CACHE_TTL = 20.0  # seconds — keep the tiles page snappy without re-probing 26x.
 _HEALTH_CACHE: dict[str, Any] = {"ts": 0.0, "payload": None}
+_RUNNING_STAGES = {"RUNNING"}
+
+
+def _space_record(identifier: str) -> dict[str, str]:
+    """Resolve only audited inventory identifiers; fail closed for unknown names."""
+    record = _SPACE_BY_NAME.get(identifier) or _SPACE_BY_SLUG.get(identifier)
+    if record is None:
+        raise ValueError("unknown Space identifier: %s" % identifier)
+    return record
 
 
 def hf_url(name: str) -> str:
-    return f"https://{_ORG_PREFIX}{name}.hf.space"
+    record = _space_record(name)
+    host_suffix = ".static.hf.space" if record["sdk"] == "static" else ".hf.space"
+    return f"https://{_ORG_PREFIX}{record['slug']}{host_suffix}"
 
 
 def hf_api_url(name: str) -> str:
-    return f"https://huggingface.co/api/spaces/{_ORG}/{name}"
+    record = _space_record(name)
+    return f"https://huggingface.co/api/spaces/{_ORG}/{record['name']}"
+
+
+def hf_repo_url(name: str) -> str:
+    record = _space_record(name)
+    return f"https://huggingface.co/spaces/{_ORG}/{record['name']}"
+
+
+def canonical_url(name: str) -> str:
+    """Canonical isolated application origin for an audited Space."""
+    return hf_url(name)
 
 
 def proxy_url(name: str) -> str:
-    """Where the tile's primary "open" link points. Own-host Spaces -> their HF host;
-    everyone else -> the same-origin reverse proxy at /spaces/<name>."""
-    return hf_url(name) if name in _OWN_HOST else f"/spaces/{name}"
+    """Deprecated compatibility alias for ``canonical_url``.
+
+    No upstream Space executes under the host application's origin; interactive
+    apps, streaming, cookies, and authentication stay isolated on Hugging Face.
+    """
+    return canonical_url(name)
 
 
 def _resolve_client() -> Any:
@@ -143,17 +190,21 @@ async def _probe_one(client: Any, sp: dict[str, str]) -> dict[str, Any]:
     """HONEST per-Space status. app_reachable is a REAL HEAD probe; stage is from the
     HF API. Any failure degrades to honest false/'unknown' — never fabricated."""
     name = sp["name"]
+    slug = sp["slug"]
     result: dict[str, Any] = {
         "name": name,
+        "slug": slug,
         "title": sp["title"],
+        "sdk": sp["sdk"],
         "url": hf_url(name),
+        "canonical_url": canonical_url(name),
         "proxy_url": proxy_url(name),
-        "own_host": name in _OWN_HOST,
+        "own_host": slug in _OWN_HOST,
         "stage": "unknown",         # from HF API; HF-API-labelled below
         "stage_source": "hf-api",
         "app_reachable": False,     # REAL probe; only true when the probe truly succeeds
     }
-    # (1) REAL same-origin liveness probe of the Space app. Try the shared async httpx
+    # (1) REAL liveness probe of the canonical Space app. Try the shared async httpx
     #     client first; on None/failure fall back to the PROVEN stdlib urllib path.
     probed = False
     if client is not None:
@@ -214,14 +265,45 @@ async def _probe_one(client: Any, sp: dict[str, str]) -> dict[str, Any]:
         except Exception as e:
             result["stage_error"] = type(e).__name__
 
+    result["state"] = _space_health_state(result)
     return result
 
 
+def _space_health_state(space: dict[str, Any]) -> str:
+    """Derive one conservative, user-facing state from observed row evidence."""
+    reachable = bool(space.get("app_reachable"))
+    stage = str(space.get("stage") or "unknown").upper()
+    if reachable and stage in _RUNNING_STAGES:
+        return "LIVE"
+    if not reachable and stage == "UNKNOWN":
+        return "UNAVAILABLE"
+    return "DEGRADED"
+
+
+def _aggregate_health_state(spaces: list[dict[str, Any]]) -> str:
+    """Derive a conservative top-level state from the observed Space rows."""
+    if not spaces:
+        return "UNAVAILABLE"
+    states = [_space_health_state(row) for row in spaces]
+    if all(state == "LIVE" for state in states):
+        return "LIVE"
+    if all(state == "UNAVAILABLE" for state in states):
+        return "UNAVAILABLE"
+    return "DEGRADED"
+
+
 async def spaces_health() -> dict[str, Any]:
-    """Aggregate honest health for all 11 Spaces (short TTL cache)."""
+    """Aggregate honest health for the audited 26-Space estate (short TTL cache)."""
     now = time.monotonic()
     if _HEALTH_CACHE["payload"] is not None and (now - _HEALTH_CACHE["ts"]) < _HEALTH_CACHE_TTL:
-        return _HEALTH_CACHE["payload"]
+        cached = _HEALTH_CACHE["payload"]
+        # Return a new top-level mapping: label the transport as CACHED while
+        # preserving the original aggregate verdict for auditability.
+        return {
+            **cached,
+            "state": "CACHED",
+            "cached_state": cached.get("state", "UNAVAILABLE"),
+        }
 
     client = _resolve_client()
     # Probe every Space concurrently. _probe_one handles client=None internally by
@@ -231,14 +313,17 @@ async def spaces_health() -> dict[str, Any]:
     spaces = list(await _asyncio.gather(*[_probe_one(client, sp) for sp in SPACES]))
 
     payload = {
+        "state": _aggregate_health_state(spaces),
         "count": len(spaces),
         "spaces": spaces,
         "labels": {
+            "state": "Fresh: LIVE only when every app is reachable and HF reports RUNNING; otherwise DEGRADED or UNAVAILABLE. TTL reuse is CACHED with cached_state.",
+            "space_state": "LIVE requires app_reachable:true plus HF stage RUNNING; partial evidence is DEGRADED",
             "stage": "HF API runtime.stage (https://huggingface.co/api/spaces/SZLHOLDINGS/<name>)",
-            "app_reachable": "REAL same-origin server-side HEAD/GET probe of the Space app",
+            "app_reachable": "REAL server-side HEAD/GET probe of the canonical Space app",
             "degrade": "stage:'unknown' + app_reachable:false; never fabricated",
         },
-        "note": "Server-side probed; 0 browser CDN. Honest live/unknown only.",
+        "note": "Server-side probed; 0 browser CDN. Honest LIVE/DEGRADED/UNAVAILABLE; cache reuse is explicitly CACHED.",
         "doctrine": _DOCTRINE,
         "fetchedAt": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
     }
@@ -256,52 +341,71 @@ def _tiles_page(ns: str) -> bytes:
     cards = []
     for sp in SPACES:
         name = sp["name"]
+        slug = sp["slug"]
         title = sp["title"]
-        primary = proxy_url(name)
-        primary_label = "Open on HF" if name in _OWN_HOST else "Open in a-11-oy.com"
+        primary = canonical_url(name)
+        primary_label = "Open isolated app"
         cards.append(
             '<article class="sp-card" data-space="%s">'
             '<header class="sp-head">'
             '<span class="sp-dot" data-dot="%s" title="status">&#9679;</span>'
             '<h2 class="sp-title">%s</h2></header>'
+            '<div class="sp-kind">%s &middot; %s</div>'
             '<div class="sp-stage" data-stage="%s">stage: <span>checking&hellip;</span></div>'
             '<div class="sp-links">'
-            '<a class="sp-open" href="%s">%s</a>'
-            '<a class="sp-hf" href="%s" rel="noopener" target="_blank">Open on HF &#8599;</a>'
+            '<a class="sp-open" href="%s" rel="noopener" target="_blank">%s &#8599;</a>'
+            '<a class="sp-hf" href="%s" rel="noopener" target="_blank">View repository &#8599;</a>'
             '</div></article>'
-            % (name, name, title, name, primary, primary_label, hf_url(name))
+            % (slug, slug, title, name, sp["sdk"], slug,
+               primary, primary_label, hf_repo_url(name))
         )
     html = (
         '<!doctype html><html lang="en"><head><meta charset="utf-8">'
         '<meta name="viewport" content="width=device-width,initial-scale=1">'
-        '<title>Spaces &middot; a11oy</title>'
+        '<title>Spaces &middot; ' + ns + '</title>'
         '<style>'
         ':root{color-scheme:dark}'
         '*{box-sizing:border-box}'
         'body{margin:0;background:#0b0f14;color:#cdd6e0;'
         'font:15px/1.6 system-ui,-apple-system,Segoe UI,Roboto,sans-serif}'
-        '.sp-wrap{max-width:1100px;margin:0 auto;padding:2rem 1.25rem}'
+        '.sp-wrap{max-width:1100px;margin:0 auto;padding:2rem 1.25rem;min-width:0}'
         '.sp-h1{color:#e7eef6;font-size:1.6rem;margin:0 0 .25rem}'
-        '.sp-sub{color:#8a96a3;margin:0 0 1.6rem}'
-        '.sp-grid{display:grid;gap:1rem;'
+        '.sp-sub{color:#8a96a3;margin:0 0 .75rem;overflow-wrap:anywhere}'
+        '.sp-health{display:flex;align-items:center;gap:.45rem;min-height:44px;'
+        'color:#8a96a3;margin:0 0 1rem}'
+        '.sp-health strong{border:1px solid #3b4654;border-radius:999px;padding:.22rem .55rem;'
+        'color:#9fb0c0;font-size:.76rem;letter-spacing:.04em}'
+        '.sp-health strong.live{border-color:#3ad07a;color:#3ad07a}'
+        '.sp-health strong.degraded{border-color:#c9a23a;color:#c9a23a}'
+        '.sp-health strong.unavailable{border-color:#e0593a;color:#e0593a}'
+        '.sp-health strong.cached,.sp-health strong.checking{border-color:#697787;color:#9fb0c0}'
+        '.sp-grid{display:grid;gap:1rem;min-width:0;'
         'grid-template-columns:repeat(auto-fill,minmax(260px,1fr))}'
         '.sp-card{background:#121821;border:1px solid #1d2632;border-radius:12px;'
-        'padding:1rem 1.1rem;display:flex;flex-direction:column;gap:.5rem}'
-        '.sp-head{display:flex;align-items:center;gap:.55rem}'
+        'padding:1rem 1.1rem;display:flex;flex-direction:column;gap:.5rem;min-width:0}'
+        '.sp-head{display:flex;align-items:center;gap:.55rem;min-width:0}'
         '.sp-dot{color:#5b6675;font-size:.7rem;line-height:1}'
         '.sp-dot.up{color:#3ad07a}.sp-dot.down{color:#e0593a}.sp-dot.unknown{color:#c9a23a}'
-        '.sp-title{font-size:1rem;margin:0;color:#e7eef6;font-weight:600}'
-        '.sp-stage{color:#7c8794;font-size:.82rem}'
+        '.sp-title{font-size:1rem;margin:0;color:#e7eef6;font-weight:600;min-width:0;overflow-wrap:anywhere}'
+        '.sp-kind{color:#697787;font-size:.76rem;overflow-wrap:anywhere}'
+        '.sp-stage{color:#7c8794;font-size:.82rem;overflow-wrap:anywhere}'
         '.sp-stage span{color:#9fb0c0}'
         '.sp-links{margin-top:auto;display:flex;gap:.9rem;flex-wrap:wrap;padding-top:.4rem}'
+        '.sp-links a{display:inline-flex;align-items:center;min-height:44px;padding:.4rem .15rem}'
         '.sp-open{color:#d4a444;text-decoration:none;font-weight:600}'
         '.sp-hf{color:#7c8794;text-decoration:none}'
-        '.sp-foot{color:#5b6675;font-size:.8rem;margin-top:1.6rem}'
+        '.sp-foot{color:#5b6675;font-size:.8rem;margin-top:1.6rem;overflow-wrap:anywhere}'
+        '@media(max-width:375px){'
+        '.sp-wrap{padding:1.25rem .75rem}.sp-grid{grid-template-columns:minmax(0,1fr)}'
+        '.sp-links{gap:.15rem}.sp-links a{flex:1 1 100%}}'
         '</style></head>'
         '<body><main class="sp-wrap">'
         '<h1 class="sp-h1">Hugging Face Spaces</h1>'
-        '<p class="sp-sub">All live Spaces, surfaced on a-11-oy.com &mdash; server-side '
-        'reverse proxy + honest live health. 0 browser CDN.</p>'
+        '<p class="sp-sub">All 26 audited Spaces in one evidence-labelled registry. '
+        'Apps open on their canonical isolated Hugging Face origin; health is probed '
+        'server-side. Legacy <code>/spaces/&lt;slug&gt;</code> links are no-store 307 handoffs.</p>'
+        '<p class="sp-health">Estate health: '
+        '<strong id="sp-estate-health" class="checking" aria-live="polite">CHECKING</strong></p>'
         '<div class="sp-grid">' + "".join(cards) + '</div>'
         '<p class="sp-foot">Status dot &amp; stage are filled from the same-origin '
         '<code>/api/' + ns + '/v1/spaces/health</code> endpoint (real server-side probe '
@@ -309,16 +413,33 @@ def _tiles_page(ns: str) -> bytes:
         '</main>'
         '<script>'
         '(function(){'
-        'fetch("/api/' + ns + '/v1/spaces/health").then(function(r){return r.json();})'
-        '.then(function(d){(d.spaces||[]).forEach(function(s){'
-        'var card=document.querySelector(\'[data-space="\'+s.name+\'"]\');if(!card)return;'
+        'var estate=document.getElementById("sp-estate-health");'
+        'function estateState(raw,cached){'
+        'var allowed={LIVE:1,DEGRADED:1,UNAVAILABLE:1,CACHED:1};'
+        'raw=String(raw||"UNAVAILABLE").toUpperCase();if(!allowed[raw])raw="UNAVAILABLE";'
+        'var label=raw;if(raw==="CACHED")label="CACHED \\u00b7 "+String(cached||"UNAVAILABLE").toUpperCase()+" snapshot";'
+        'if(estate){estate.className=raw.toLowerCase();estate.textContent=label;}}'
+        'function healthUnavailable(){estateState("UNAVAILABLE");'
+        'var cards=document.querySelectorAll(".sp-card");for(var i=0;i<cards.length;i++){'
+        'var dot=cards[i].querySelector(".sp-dot");if(dot){dot.classList.remove("up","unknown");'
+        'dot.classList.add("down");dot.title="UNAVAILABLE / health fetch failed";}'
+        'var st=cards[i].querySelector(".sp-stage span");if(st)st.textContent="UNAVAILABLE \\u00b7 health fetch failed";}}'
+        'fetch("/api/' + ns + '/v1/spaces/health").then(function(r){'
+        'if(!r.ok)throw new Error("health "+r.status);return r.json();})'
+        '.then(function(d){estateState(d.state,d.cached_state);(d.spaces||[]).forEach(function(s){'
+        'var card=document.querySelector(\'[data-space="\'+(s.slug||s.name)+\'"]\');if(!card)return;'
         'var dot=card.querySelector(".sp-dot");'
+        'var stage=String(s.stage||"unknown").toUpperCase();'
+        'var state=String(s.state||((s.app_reachable&&stage==="RUNNING")?"LIVE":'
+        '((s.app_reachable||stage!=="UNKNOWN")?"DEGRADED":"UNAVAILABLE"))).toUpperCase();'
+        'if(state!=="LIVE"&&state!=="DEGRADED"&&state!=="UNAVAILABLE")state="UNAVAILABLE";'
         'if(dot){dot.classList.remove("up","down","unknown");'
-        'dot.classList.add(s.app_reachable?"up":(s.stage&&s.stage!=="unknown"?"unknown":"down"));'
-        'dot.title=(s.app_reachable?"reachable":"unreachable")+" / stage:"+(s.stage||"unknown");}'
+        'dot.classList.add(state==="LIVE"?"up":(state==="DEGRADED"?"unknown":"down"));'
+        'dot.title=state+" / "+(s.app_reachable?"reachable":"unreachable")+" / stage:"+(s.stage||"unknown");}'
         'var st=card.querySelector(".sp-stage span");'
-        'if(st){st.textContent=(s.stage||"unknown")+(s.app_reachable?" \\u00b7 reachable":" \\u00b7 unreachable");}'
-        '});}).catch(function(){});'
+        'if(st){st.textContent=state+" \\u00b7 "+(s.stage||"unknown")+'
+        '(s.app_reachable?" \\u00b7 reachable":" \\u00b7 unreachable");}'
+        '});}).catch(healthUnavailable);'
         '})();'
         '</script>'
         '</body></html>'
@@ -340,9 +461,9 @@ def _nav_item() -> bytes:
     """ONE 'Spaces' nav item, mirroring the console's own nav-item markup so it inherits
     the console styling (0 CDN, 0 codename). Globe glyph; honest label."""
     return (
-        '<div class="nav-item" data-nav-spaces="hf1" data-wireup-path="/spaces" '
-        'onclick="location.href=\'/spaces\'" style="cursor:pointer">'
-        '<span class="ico">\U0001F310</span>Spaces</div>'
+        '<a class="nav-item" data-nav-spaces="hf1" data-wireup-path="/spaces" '
+        'href="/spaces" style="cursor:pointer;text-decoration:none">'
+        '<span class="ico">\U0001F310</span>Spaces</a>'
     ).encode("utf-8")
 
 
@@ -404,7 +525,6 @@ def register(app, ns: str = "a11oy") -> str:
     at the FRONT of the router (beat the SPA + Node-proxy catch-alls), and attach the
     idempotent 'Spaces' nav injector. try/except-guarded by the caller."""
     try:
-        from fastapi.responses import JSONResponse  # noqa: F401
         from starlette.responses import Response, JSONResponse as _JSON
     except Exception as e:  # pragma: no cover
         return "unavailable: %r" % (e,)
@@ -414,12 +534,13 @@ def register(app, ns: str = "a11oy") -> str:
 
     async def _health(request):
         payload = await spaces_health()
-        return _JSON(payload)
+        return _JSON(payload, headers={"Cache-Control": "no-store"})
 
     async def _tiles(request):
+        headers = {"Cache-Control": "no-store"}
         if request.method.upper() == "HEAD":
-            return Response(content=b"", status_code=200, media_type="text/html")
-        return Response(content=tiles, status_code=200, media_type="text/html")
+            return Response(content=b"", status_code=200, media_type="text/html", headers=headers)
+        return Response(content=tiles, status_code=200, media_type="text/html", headers=headers)
 
     from starlette.routing import Route
     routes = [
@@ -446,7 +567,7 @@ def register(app, ns: str = "a11oy") -> str:
 # ---------------------------------------------------------------------------
 # Self-test — pure stdlib + starlette TestClient; no real network. Stubs the shared
 # client to assert: health degrades honestly (no client -> stage unknown + reachable
-# false), tiles page lists ALL 11 names + has the health-fetch JS, nav injects exactly
+# false), tiles page lists ALL 26 names + has the health-fetch JS, nav injects exactly
 # once + is idempotent + removes nothing, /spaces is NOT nav-injected.
 # ---------------------------------------------------------------------------
 if __name__ == "__main__":
@@ -454,15 +575,33 @@ if __name__ == "__main__":
     with open(__file__, "r", encoding="utf-8") as _fh:
         _ast.parse(_fh.read())
 
-    assert len(SPACES) == 11, len(SPACES)
+    assert len(SPACES) == 26, len(SPACES)
     tp = _tiles_page("a11oy")
     for sp in SPACES:
         assert sp["name"].encode() in tp, "tiles missing %s" % sp["name"]
         assert sp["title"].encode() in tp, "tiles missing title %s" % sp["title"]
+        assert canonical_url(sp["name"]).encode() in tp, "tiles missing canonical app origin"
+        assert hf_repo_url(sp["name"]).encode() in tp, "tiles missing repository link"
+        assert proxy_url(sp["name"]) == canonical_url(sp["name"]), "primary link must stay isolated"
     assert b"/api/a11oy/v1/spaces/health" in tp, "tiles must fetch the health endpoint"
     assert b"http://" not in tp, "tiles must be 0 CDN (no http://)"
-    # the only https in the page should be the hf.space open links (server-named, fine)
-    assert tp.count(b"https://huggingface.co") == 0, "tiles must not pull from HF CDN"
+    assert b'href="/spaces/' not in tp, "tiles must not execute an app under this origin"
+    assert b"canonical isolated Hugging Face origin" in tp
+    # Repository anchors are navigation only; no browser asset is loaded from HF.
+    assert tp.count(b"https://huggingface.co/spaces/") == len(SPACES)
+    assert b'<script src="https://' not in tp and b'<link href="https://' not in tp
+
+    running = {"app_reachable": True, "app_status": 200, "stage": "RUNNING"}
+    unknown = {"app_reachable": False, "stage": "unknown"}
+    http_200_unknown = {"app_reachable": True, "app_status": 200, "stage": "unknown"}
+    assert _aggregate_health_state([running, dict(running)]) == "LIVE"
+    assert _aggregate_health_state([unknown, dict(unknown)]) == "UNAVAILABLE"
+    assert _aggregate_health_state([running, unknown]) == "DEGRADED"
+    assert _aggregate_health_state([http_200_unknown]) == "DEGRADED", \
+        "HTTP 200 alone must never upgrade aggregate state to LIVE"
+    assert _space_health_state(running) == "LIVE"
+    assert _space_health_state(unknown) == "UNAVAILABLE"
+    assert _space_health_state(http_200_unknown) == "DEGRADED"
 
     from starlette.applications import Starlette
     from starlette.responses import HTMLResponse, PlainTextResponse
@@ -489,23 +628,36 @@ if __name__ == "__main__":
     assert st.startswith("ok:"), st
     c = TestClient(app)
 
-    # health: no httpx client wired -> falls back to the stdlib urllib probe (the proven
-    # outbound path on the box). Assert SHAPE + honesty: every space has a boolean
-    # app_reachable and a string stage; values are REAL (network) or honest unknown/false
-    # (no network) -- never fabricated. We do NOT require network in CI: both outcomes ok.
-    h = c.get("/api/a11oy/v1/spaces/health").json()
-    assert h["count"] == 11, h["count"]
+    # health: no httpx client wired -> falls back to the stdlib urllib probe. Stub that
+    # final outbound path so this self-test is hermetic and verifies the exact honest
+    # degrade contract for every audited Space (no network, no fabricated green state).
+    _self_mod = sys.modules[__name__]
+    _orig_probe = _self_mod._urllib_probe
+    def _offline(*_a, **_k):
+        raise OSError("simulated offline audit")
+    _self_mod._urllib_probe = _offline
+    _HEALTH_CACHE["ts"] = 0.0
+    _HEALTH_CACHE["payload"] = None
+    try:
+        health_response = c.get("/api/a11oy/v1/spaces/health")
+        h = health_response.json()
+    finally:
+        _self_mod._urllib_probe = _orig_probe
+        _HEALTH_CACHE["ts"] = 0.0
+        _HEALTH_CACHE["payload"] = None
+    assert h["count"] == 26, h["count"]
+    assert h["state"] == "UNAVAILABLE", h["state"]
+    assert health_response.headers["cache-control"] == "no-store"
     for s in h["spaces"]:
-        assert isinstance(s["app_reachable"], bool), "app_reachable must be a real bool"
-        assert isinstance(s["stage"], str), "stage must be a string (HF-API or 'unknown')"
-        # honest contract: if not reachable AND no stage, it must be the honest unknown/false
-        if not s["app_reachable"] and s["stage"] == "unknown":
-            pass  # honest degrade -- allowed
+        assert s["app_reachable"] is False, "offline probe must honestly degrade false"
+        assert s["stage"] == "unknown", "offline HF API must honestly degrade unknown"
+        assert s["state"] == "UNAVAILABLE", "offline row must fail closed"
     assert h["doctrine"]["locked_proven"] == ["F1", "F4", "F7", "F11", "F12", "F18", "F19", "F22"]
 
     # tiles page resolves + lists all names
     t = c.get("/spaces")
     assert t.status_code == 200 and "text/html" in t.headers["content-type"], t.status_code
+    assert t.headers["cache-control"] == "no-store"
     for sp in SPACES:
         assert sp["name"] in t.text, "tiles page missing %s" % sp["name"]
 
@@ -514,12 +666,12 @@ if __name__ == "__main__":
     p2 = c.get("/console").text
     assert p1.count('data-nav-spaces="hf1"') == 1, "nav must inject exactly once"
     assert p2.count('data-nav-spaces="hf1"') == 1, "nav must be idempotent"
-    assert "location.href='/spaces'" in p1, "nav must link /spaces"
+    assert 'href="/spaces"' in p1, "nav must link /spaces with a real anchor"
     assert "Operate</div>" in p1 and "Existing</div>" in p1 and "footer</div>" in p1, \
         "must remove nothing from the SPA source"
     assert p1 == p2, "second console render must be byte-identical (idempotent)"
     # the tiles page itself must NOT be nav-injected (it has no console sidebar)
     assert 'data-nav-spaces="hf1"' not in c.get("/spaces").text, "/spaces must not be nav-injected"
 
-    print("szl_spaces_surface: ALL OK (11 spaces; honest degrade; tiles 0-CDN; nav "
-          "idempotent + additive; /spaces not self-injected)")
+    print("szl_spaces_surface: ALL OK (26 canonical isolated links; honest degrade; "
+          "tiles 0-CDN + no-store; nav idempotent + additive; /spaces not self-injected)")