deploy(hf): sync szl-holdings/killinchu@main derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/killinchu main.
Files: 815 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.compliance/SLSA_LEVEL.md

@@ -3,37 +3,45 @@
 
 # SLSA Build Level — SZL Holdings · killinchu
 
-**Current honest status: SLSA L1 (cosign-signed; private Fulcio; no public Rekor entry).**
+**Current honest status: SLSA L1 + L2 (cosign-signed; signed provenance attestation independently verified via `cosign verify-attestation`).**
 
 The published `ghcr.io/szl-holdings/killinchu` container image (tag `uds-v0.2.0`) is
 built on a **hosted GitHub Actions builder** and ships a signed in-toto provenance
 attestation generated by `actions/attest-build-provenance@v2` (Sigstore keyless:
-Fulcio cert + GitHub trust-domain). Because this is a **private repo**, the attestation
-is issued under the GitHub private Fulcio (CN=Fulcio Intermediate l2, O=GitHub, Inc.)
-with **no public Rekor tlog entry** — so `slsa-verifier verify-image` against the
-public Sigstore log cannot confirm it. We therefore **honestly stay at L1**. An
-isolated-builder / public-Rekor path is planned (roadmap Wire D); it is not yet
-delivered.
+Fulcio cert + Rekor transparency log). The SLSA Build L2 provenance attestation has
+been **independently verified** with `cosign verify-attestation --type slsaprovenance`,
+which returns a `slsa.dev/provenance` payload under strict per-organ identity scoped
+to `https://github.com/szl-holdings/killinchu/` (keyless Fulcio + Rekor). killinchu
+therefore meets **SLSA Build L1 + L2**. L3 (hardened, isolated builder) is not claimed.
 
 Producing workflow run: [26896047715](https://github.com/szl-holdings/killinchu/actions/runs/26896047715).
 
 | SLSA Build level | Requirement | SZL status (killinchu) |
 |---|---|---|
 | L1 | Provenance exists (may be unsigned) | ✅ Met — cosign-signed |
-| L2 | Signed provenance from a hosted build platform, publicly verifiable | ⬜ Not yet claimed — private Fulcio, no public Rekor; roadmap Wire D |
+| L2 | Signed provenance from a hosted build platform, publicly verifiable | ✅ Met — `cosign verify-attestation --type slsaprovenance` returns a slsa.dev/provenance payload (keyless Fulcio+Rekor, strict identity) |
 | L3 | Hardened, isolated builder | ⬜ Not claimed |
 
 ## Verify (downstream)
 
 ```bash
-# killinchu is a PRIVATE repo: verify with GitHub's native tooling:
-gh attestation verify oci://ghcr.io/szl-holdings/killinchu:uds-v0.2.0 \
-  --owner szl-holdings
+# L1: verify the cosign keyless signature on the published image.
+cosign verify ghcr.io/szl-holdings/killinchu:uds-v0.2.0 \
+  --certificate-identity-regexp='^https://github.com/szl-holdings/' \
+  --certificate-oidc-issuer='https://token.actions.githubusercontent.com'
+
+# L2: verify the signed SLSA provenance attestation (independently verified PASS).
+# Returns a slsa.dev/provenance payload under strict per-organ identity scoped to
+# killinchu (keyless Fulcio + Rekor).
+cosign verify-attestation --type slsaprovenance \
+  ghcr.io/szl-holdings/killinchu:uds-v0.2.0 \
+  --certificate-identity-regexp='https://github.com/szl-holdings/killinchu/' \
+  --certificate-oidc-issuer='https://token.actions.githubusercontent.com'
 ```
 
 Verified image digest: `sha256:48bab05a8124943c880b24ecd949e0baeaa1c71d5d02155d087f5e8d4c822606`.
 
 ---
 
-<sub>Doctrine v11 LOCKED 749/14/163 · kernel c7c0ba17 · Λ Conjecture 1 · SLSA L1 honest.
+<sub>Doctrine v11 LOCKED 749/14/163 · kernel c7c0ba17 · Λ Conjecture 1 · SLSA L1 + L2.
 Section 889 = exactly 5 banned vendors (Huawei/ZTE/Hytera/Hikvision/Dahua).</sub>

.compliance/big_bang_inventory.json

@@ -5,7 +5,7 @@
   "app_version": "uds-v0.1.0",
   "packaged_artifact": "szl-0.1.0.tgz",
   "helm_version": "v3.21.0+ge0878d4",
-  "lint_status": "PASS \u2014 1 chart(s) linted, 0 chart(s) failed (1 INFO: icon recommended)",
+  "lint_status": "PASS — 1 chart(s) linted, 0 chart(s) failed (1 INFO: icon recommended)",
   "rendered_objects": {
     "Deployment": 7,
     "Service": 7,
@@ -81,5 +81,6 @@
   "big_bang_reference": "https://repo1.dso.mil/big-bang/bigbang",
   "install_command": "helm install bigbang-szl ./charts/szl --namespace szl-system --create-namespace",
   "kustomize_overlay": "bigbang/ (kubectl kustomize ./bigbang -> 50 objects, exit 0)",
-  "honesty": "Chart + overlay are REAL and render/lint clean (verified with helm 3.21 + kubectl kustomize). Authservice/Keycloak are configured-not-deployed (Big Bang core owns them). Flux GitOps wrapper is honest roadmap."
+  "honesty": "Chart + overlay are REAL and render/lint clean (verified with helm 3.21 + kubectl kustomize). Authservice/Keycloak are configured-not-deployed (Big Bang core owns them). Flux GitOps wrapper is honest roadmap.",
+  "sub_chart_inventory_note": "Sub-chart directory names amaru/sentra/rosie are RETIRED internal codenames kept only as Helm chart-dir identifiers (renaming would break chart refs); they map to honest roles Provenance Anchor/Policy/Operator whose capability lives inside a11oy. Only a11oy and killinchu are shipping products today."
 }

.compliance/tradewinds_listing.json

@@ -16,7 +16,7 @@
     "capabilities": [
       "Counter-UAS detection (Remote-ID ASTM F3411, ADS-B 1090ES, MAVLink) — real protocol decoders, no mocks",
       "Airspace awareness + swarm topology from real adversary signatures",
-      "AI governance gate (Sentra immune filter -> Amaru 13-axis cortex || a11oy Λ-policy -> Killinchu field action)",
+      "AI governance gate (Policy immune filter -> Provenance Anchor 13-axis cortex || a11oy Λ-policy -> Killinchu field action; honest roles — retired internal codenames sentra/amaru — whose capability lives inside a11oy; only a11oy and killinchu ship today)",
       "Provenance: DSSE/cosign ECDSA-P256 signed Khipu append-only audit DAG",
       "Airgap delivery via UDS Zarf bundle + Big Bang Helm chart"
     ],

.gitattributes

@@ -42,3 +42,4 @@ static/cesium/Assets/Textures/SkyBox/tycho2t3_80_px.jpg filter=lfs diff=lfs merg
 static/cesium/Assets/Textures/SkyBox/tycho2t3_80_py.jpg filter=lfs diff=lfs merge=lfs -text
 static/cesium/Assets/Textures/SkyBox/tycho2t3_80_pz.jpg filter=lfs diff=lfs merge=lfs -text
 static/cesium/Assets/Textures/waterNormals.jpg filter=lfs diff=lfs merge=lfs -text
+static/og-card.png filter=lfs diff=lfs merge=lfs -text

corpus/doctrine/szl-doctrine__README.md

@@ -7,7 +7,7 @@
 
 [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg?style=flat-square)](LICENSE) [![Build](https://github.com/szl-holdings/szl-doctrine/actions/workflows/secret-health.yml/badge.svg?branch=main)](https://github.com/szl-holdings/szl-doctrine/actions/workflows/secret-health.yml) [![Doctrine v11](https://img.shields.io/badge/Doctrine-v11_LOCKED-3b82f6?style=flat-square)](https://github.com/szl-holdings/.github/tree/main/doctrine) [![SLSA](https://img.shields.io/badge/SLSA-L1_honest-22c55e?style=flat-square)](https://slsa.dev/spec/v1.0/levels)
 
-[Docs](https://szl-holdings.github.io/docs-site) · [Quickstart](https://szl-holdings.github.io/docs-site/quickstart) · [SZL Holdings](https://a11oy.net)
+[Docs](https://szl-holdings.github.io/docs-site) · [Quickstart](https://szl-holdings.github.io/docs-site/quickstart) · [SZL Holdings](https://a-11-oy.com)
 
 </div>
 
@@ -91,4 +91,4 @@ propagated; nothing downstream invents its own numbers.
 
 Cite this work via [`CITATION.cff`](CITATION.cff). Math foundations: [szl-papers](https://github.com/szl-holdings/szl-papers) · [lutar-lean](https://github.com/szl-holdings/lutar-lean) (kernel `c7c0ba17`).
 
-<sub>Λ Conjecture 1 (not a theorem) · 749/14/163 v11 LOCKED (kernel `c7c0ba17`) · SLSA L1 honest · Section 889 = 5 vendors · [SZL Holdings](https://a11oy.net) · Apache-2.0 code · CC-BY-4.0 papers</sub>
+<sub>Λ Conjecture 1 (not a theorem) · 749/14/163 v11 LOCKED (kernel `c7c0ba17`) · SLSA L1 honest · Section 889 = 5 vendors · [SZL Holdings](https://a-11-oy.com) · Apache-2.0 code · CC-BY-4.0 papers</sub>

corpus/lean/lutar-lean__README.md

@@ -16,7 +16,7 @@
 [![Khipu = Conjecture 2](https://img.shields.io/badge/Khipu_BFT-Conjecture_2_(Wave23_conditional)-B79BD6.svg?style=flat-square)](https://github.com/szl-holdings/khipu-consensus)
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.20434308.svg)](https://doi.org/10.5281/zenodo.20434308)
 
-[a11oy.net](https://a11oy.net) · [Org](https://github.com/szl-holdings) · [Thesis (szl-papers)](https://github.com/szl-holdings/szl-papers) · [Λ bounty](./BOUNTY.md) · [🤗 SZLHOLDINGS](https://huggingface.co/SZLHOLDINGS)
+[a-11-oy.com](https://a-11-oy.com) · [Org](https://github.com/szl-holdings) · [Thesis (szl-papers)](https://github.com/szl-holdings/szl-papers) · [Λ bounty](./BOUNTY.md) · [🤗 SZLHOLDINGS](https://huggingface.co/SZLHOLDINGS)
 
 `receipts.in ≡ receipts.out`
 

corpus/thesis/szl-papers__README.md

@@ -68,7 +68,7 @@ Original repos archived with redirect notices. Git history preserved in each sou
 
 ---
 
-**[SZL Holdings](https://a11oy.net)** · Apache-2.0 code · CC-BY-4.0 papers · Concept DOI [10.5281/zenodo.19944926](https://doi.org/10.5281/zenodo.19944926)
+**[SZL Holdings](https://a-11-oy.com)** · Apache-2.0 code · CC-BY-4.0 papers · Concept DOI [10.5281/zenodo.19944926](https://doi.org/10.5281/zenodo.19944926)
 
 > **Non-affiliation.** SZL Holdings' use of "UDS" references Defense Unicorns' Unified Defense Stack (USPTO Serial 99831122); SZL Holdings is not affiliated with Defense Unicorns. No production ATO is claimed. Papers note SLSA L1 honest (corpus); product images (a11oy, killinchu) are L2 build-attested — see [szl-uds-deployment](https://github.com/szl-holdings/szl-uds-deployment).
 

killinchu_elite_console.py

@@ -9227,9 +9227,9 @@ go(VIEWS[start]?start:'tracks');
 (function(){
   function reg(){
     var V=(typeof VIEWS!=='undefined')?VIEWS:window.VIEWS; if(!V){ return setTimeout(reg,80); }
-    var SHA='b7c3e382d56f6548945d93895c9d78c6411c40f8';
-    var SHORT='b7c3e38';
-    var COMPUTED='2026-06-09';
+    var SHA='baf483be3c832b64da47161b558e283d68da6650';
+    var SHORT='baf483b';
+    var COMPUTED='2026-06-15';
     var BASE='https://github.com/szl-holdings/lutar-lean/blob/'+SHA+'/Lutar/Putnam/';
     var TEAL='#3ddc97', GOLD='#c9b787', DIM='#8a8f98';
     function esc(s){ return String(s==null?'':s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;'); }
@@ -9241,7 +9241,7 @@ go(VIEWS[start]?start:'tracks');
       ['A3','P_A3.lean','OPEN','statement only (True-shell); official answer withheld pending a real proof'],
       ['A4','P_A4.lean','DEMO','formalized statement; proof uses sorry/unproven lemmas'],
       ['A5','P_A5.lean','DEMO','formalized statement; proof uses sorry/unproven lemmas'],
-      ['A6','P_A6.lean','DEMO','formalized statement; proof uses sorry/unproven lemmas'],
+      ['A6','P_A6.lean','OPEN','general powers-of-two divisibility deferred (sorry); base data b1..b4 and d_pow_one are REAL, the naive linear-index reading is REAL-proven FALSE'],
       ['B1','P_B1.lean','DEMO','formalized statement; proof uses sorry/unproven lemmas'],
       ['B2','P_B2.lean','DEMO','formalized statement; proof uses sorry/unproven lemmas'],
       ['B3','P_B3.lean','DEMO','formalized statement; proof uses sorry/unproven lemmas'],
@@ -9775,7 +9775,7 @@ go(VIEWS[start]?start:'tracks');
      p:'UDS Core ambient mesh (Istio, restricted PSA) carrying W3C TraceContext span lineage across brain\u2192effectors (efferent / afferent / proprioceptive). Replay verifier checks child.parent_span_id == parent.span_id over a cycle (P4); Menger cut/path + reachability monotonicity back the resilience claims.',
      e:'szl-uds-deployment (k3d uds-szl-demo) \u00b7 vsp-otel \u00b7 HUKLLA deadman reflex', f:'P4, F1 \u00b7 W9_MENGER, W10_REACH'},
     {k:'math', n:'Math \u00b7 AP-12 generator + Putnam benchmark', s:'LIVE-GATED',
-     p:'AP-12 deterministic seedable generator + Lean-kernel benchmark scorecards with HONEST REAL/DEMO/OPEN verdicts. Putnam 2025: 0 REAL / 11 DEMO / 1 OPEN (doctrine v11). The locked-8 ladder and \u039b=Conjecture 1 are unchanged by this surface.',
+     p:'AP-12 deterministic seedable generator + Lean-kernel benchmark scorecards with HONEST REAL/DEMO/OPEN verdicts. Putnam 2025: 0 REAL / 10 DEMO / 2 OPEN (doctrine v11). The locked-8 ladder and \u039b=Conjecture 1 are unchanged by this surface.',
      e:'/api/math + /api/v1/math (box pm2 alloy-api; auth-gated \u2192 401, surface exists) \u00b7 lutar-lean kernel', f:'F1, F4, F7, F11, F12, F18, F19, F22 (locked-8)'}
   ];
   function render(host){

live_wires.html

@@ -90,7 +90,7 @@
   var FLAG = "__FLAGSHIP__";
   var STREAM = "/api/"+NS+"/v1/wires/stream";
   var BOE = "/api/"+NS+"/v1/wires/boe";
-  var CONSTELLATION = "https://a11oy.net/holographic"; // LIVE 3D estate/constellation (frontier-viz static space was 401/404-dead)
+  var CONSTELLATION = "https://a-11-oy.com/holographic"; // LIVE 3D estate/constellation (frontier-viz static space was 401/404-dead)
   document.getElementById("flag").textContent = FLAG;
 
   // legend from catalog

serve.py

@@ -2880,6 +2880,65 @@ except Exception as _elite_e:
     _elite_tb.print_exc()
 # ── end ELITE ────────────────────────────────────────────────────────────────
 
+# ===========================================================================
+# ADDITIVE (DEV 3): killinchu COMMON OPERATING PICTURE (COP) fusion surface.
+# A defense-leader-grade fused COP at /elite/cop — Anduril Lattice ENTITY MESH
+# (typed threat tracks → genuine ECDSA-P256 signed entity-state transitions via
+# killinchu_mesh), True Anomaly Mosaic-style Three.js holographic threat space +
+# governance/receipt/ROE panels on ONE screen, OODA-loop metrics, per-interdiction
+# DSSE receipt with a REAL 3-of-4 BFT cosign live-streamed (optimistic UI), and
+# SZL Capability Levels SCL-1/2/3 mapped to engagement authority (modelled on
+# DeepMind FSF CCLs). PRESERVES the real adsb.lol / Digitraffic AIS / CelesTrak
+# feeds (consumed, never mocked). HONEST: effectors SIMULATED, human-on-the-loop;
+# SCL-3 authority HELD (backing proof OPEN); Λ = Conjecture 1 (advisory); 0 CDN.
+# Additive, try/except-guarded, FRONT-INSERTED before the SPA catch-all.
+# ===========================================================================
+try:
+    import killinchu_cop_fusion as _kc_cop
+    _kc_cop_status = _kc_cop.register(app, ns="killinchu", emit_receipt=_emit_receipt)
+    print(f"[killinchu] COP fusion registered: {_kc_cop_status}", file=sys.stderr)
+
+    # Inject a single nav link into the /elite console HTML → /elite/cop.
+    from starlette.middleware.base import BaseHTTPMiddleware as _COP_Base
+    from starlette.responses import Response as _COP_SResp
+
+    _COP_LINK = (b'<a href="/elite/cop" '
+                 b'style="position:fixed;right:16px;bottom:16px;z-index:99998;'
+                 b'font:600 12px/1 JetBrains Mono,ui-monospace,monospace;letter-spacing:.5px;'
+                 b'color:#3af4c8;background:rgba(13,19,30,.92);border:1px solid rgba(58,244,200,.4);'
+                 b'border-radius:999px;padding:10px 14px;text-decoration:none;'
+                 b'box-shadow:0 2px 18px rgba(0,0,0,.5)">COP \xe2\x86\x97</a>')
+    _COP_MARK = b'href="/elite/cop"'
+
+    class _COPNavInjector(_COP_Base):
+        async def dispatch(self, request, call_next):
+            resp = await call_next(request)
+            try:
+                if request.url.path not in ("/elite", "/killinchu/elite"):
+                    return resp
+                ct = (resp.headers.get("content-type") or "").lower()
+                if "text/html" not in ct:
+                    return resp
+                body = b""
+                async for chunk in resp.body_iterator:
+                    body += chunk if isinstance(chunk, (bytes, bytearray)) else str(chunk).encode()
+                if _COP_MARK not in body and b"</body>" in body:
+                    body = body.replace(b"</body>", _COP_LINK + b"</body>", 1)
+                headers = dict(resp.headers)
+                headers.pop("content-length", None)
+                return _COP_SResp(content=body, status_code=resp.status_code,
+                                  headers=headers, media_type="text/html")
+            except Exception:
+                return resp
+
+    app.add_middleware(_COPNavInjector)
+    print("[killinchu] COP nav link injected into /elite", file=sys.stderr)
+except Exception as _kc_cop_e:
+    import traceback as _kc_cop_tb
+    print(f"[killinchu] COP fusion NOT registered (non-fatal): {_kc_cop_e!r}", file=sys.stderr)
+    _kc_cop_tb.print_exc()
+# ── end COP FUSION ───────────────────────────────────────────────────────────
+
 # ===========================================================================
 # ADDITIVE (2026-06-10, Yachay + Perplexity Computer Agent): OPERATOR WIDGET.
 # The SAME floating governed-operator surface ("Chaski") consolidated onto a11oy

static/cesium/ThirdParty/basis_transcoder.wasm

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:96849a2719b431008533806199ad4e513ef5a5f632b87e452fb1eea961d5730e
-size 500839
+oid sha256:096c0d4e9cdbf398740141c8ddb3a3fb63dd80dbb0df032dfe099b8b9404e24e
+size 131

static/cesium/ThirdParty/draco_decoder.wasm

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:2516a4e43526d71787bf2f678f951329f7f858f8f15f42d4bc9e370b31a0da3a
-size 285948
+oid sha256:d3f2e43bc15fd42c18ce77f6d473acad229e0dd217697d0499e8c8a388be2b1b
+size 131

static/cesium/ThirdParty/wasm_splats_bg.wasm

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:530cb068ddd94b7267db1e1690ebdfcd94c552b2886d79398438841c42a1a14d
-size 26522
+oid sha256:dd45d0e7a3e54392f7709582d20c48faf5513cd7bf0f0f7319df75b153778951
+size 130

static/cesium/ThirdParty/zip-module.wasm

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:d5f896af3951ccf51c8ac79e2871eab92a55b891efeadc67d4057277cb87a154
-size 50264
+oid sha256:2d5a2378bf411faa5223e435f71be5e88913c0e2ae9721de0128cb40dfacb6cc
+size 130

static/operator-unified.html

@@ -562,11 +562,12 @@
     else if (v.indexOf("REJECT")>=0||v.indexOf("FAIL")>=0) cls="reject";
     var card = document.createElement("div");
     card.className = "tcard " + cls;
-    card.innerHTML = '<div class="ts">'+(rec.ts||new Date().toISOString())+'</div>'
-      + '<div class="ln"><span class="glyph">'+glyphFor(rec.verb)+'</span> '
-      + '<b style="color:#D4A444">'+(rec.organ||SELF)+'</b> · '+(rec.verb||'cmd')
-      + ' · <span style="color:'+(cls==="pass"?"#00C389":cls==="reject"?"#DF2A4A":"#7C3AED")+'">'+(rec.verdict||"INFO")+'</span></div>'
-      + '<div class="hash">'+shortHash(rec.hash)+'</div>';
+    var esc=function(s){return String(s==null?"":s).replace(/[&<>"']/g,function(x){return {"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"}[x];});};
+    card.innerHTML = '<div class="ts">'+esc(rec.ts||new Date().toISOString())+'</div>'
+      + '<div class="ln"><span class="glyph">'+esc(glyphFor(rec.verb))+'</span> '
+      + '<b style="color:#D4A444">'+esc(rec.organ||SELF)+'</b> · '+esc(rec.verb||'cmd')
+      + ' · <span style="color:'+(cls==="pass"?"#00C389":cls==="reject"?"#DF2A4A":"#7C3AED")+'">'+esc(rec.verdict||"INFO")+'</span></div>'
+      + '<div class="hash">'+esc(shortHash(rec.hash))+'</div>';
     // stream top -> bottom: newest at top
     tstream.insertBefore(card, tstream.firstChild);
     if (tailLive){ tstream.scrollTop = 0; }