_{Part of the SZL Holdings governed estate — claims are designed to carry checkable receipts. Verification proves integrity & origin, never accuracy or performance.}

SZL Living Anatomy 🫀

Governed AI you can prove — as a living body. A 3D, navigable map of the governed organism: its organs, how a single decision flows through them, and where each proof and conjecture honestly sits.

The living substrate · 5 systems · Λ heart · DSSE Khipu receipt bus · honest by design

Shared, embeddable 3D scene — rendered inside the a11oy and killinchu consoles; a visualization component, not a separate governance console.

The governed-AI organ substrate shared by a11oy (governed-AI command body) and killinchu (maritime / drone C2 body): two bodies, one circulatory + nervous mesh, with the Λ heart at the center.

Live integrity kernel (szl-khipu)

This repository is the 3D atlas (SLSA L1 static viz). The fail-closed organ-integrity kernel that actually runs the five organs lives in szl-holdings/szl-khipu as evaluate_anatomy, and on the KHIPU Space Anatomy tab: SZLHOLDINGS/szl-khipu. The command body exposes the same fail-closed contract at GET/POST /api/a11oy/v1/organs/integrity and the Evidence Bay at szl-holdings/szl-organ-integrity.

HEART/YUYAY · YAWAR · YACHAY · OTel · Khipu skeleton. Any DOWN organ or a WILLAY veto blocks the body. Λ = Conjecture 1 OPEN. Energy UNAVAILABLE. Locked-proven stays 8. Not a Three.js rehost of this Space — the other way around: this Space is the map, szl-khipu is the kernel.

Evidence Bay — the proof boundary

The 3D organism now has a machine-readable evidence boundary without replacing its visual language. Open Evidence Bay from the atlas to inspect every major surface through the same five-part contract: Purpose · Try · Evidence · Limits · Reproduce.

• Transport, evidence, verification, and authority are separate dimensions. A RUNNING Space is not treated as proof of model quality, freshness, or safety.
• The deployed bundle emits a deterministic SHA-256 integrity receipt. Its local verifier recomputes every declared file and deliberately returns STRUCTURAL-ONLY because the public visualization has no signing key.
• Live A11OY, Killinchu, and receipt-verifier dependencies are probed separately and timestamped. Missing contracts stay MISSING or UNAVAILABLE; no green is synthesized from an unrelated endpoint.
• Formula claims link to their source files. This Space presents a declared snapshot—it does not run Lean—and Λ remains Conjecture 1.
• /.well-known/szl-source.json exposes the declared GitHub base, measured HF revision, artifact-set digest, and the remaining GitHub-sync state. Automated deployments add hf-deploy-manifest.json, binding the served runtime whitelist to the exact current protected-main commit rechecked immediately before publication; this is a source-bound deployment claim, not a whole-repository byte-parity claim.

v7 — YACHAY Neural Quant brain

The atlas now mounts a source-bound Neural Quant v7 instrument over the existing 3D organism. It observes the exact 575-chunk public Second Brain, the review-gated frontier candidate set, 30 attributed formula records, 21 executable formula kernels, nine quant domains, and bounded Ouroboros loop metadata.

The v7 interface is read-only and handles-only. It shows source revisions and SHA-256 receipts, never raw candidate content. The private graph is not loaded; training, promotion, execution, merge, and provider mutation remain NONE. Locked-proven remains exactly eight, the F-number mapping remains UNKNOWN_NOT_INFERRED, and Lambda remains Conjecture 1.

Open the floating Neural Quant v7 control or use /api/anatomy/v1/brain/neural-quant-v7. The desktop panel becomes a mobile bottom sheet with 44-pixel controls, safe-area support, reduced motion, high contrast, forced colors, keyboard focus trapping, and Escape close.

Public creator-profile Space: betterwithage/anatomy.

Holographic v7 companion instrument

Holographic v7 is a read-only, same-origin companion to Neural Quant v7. It serves the source-bound Second Brain through the frontier runtime without creating a second authority plane. The public snapshot remains 575 chunks with 30 attributed formulas, 21 executable formulas, and nine quant domains. Public identity stays HANDLES_ONLY; lambda remains Conjecture 1, and every frontier candidate remains review-gated rather than promoted by the visualization.

v6 — alive-proof layer (ratchet 2026-07-21)

The ⛬ alive-proof (v6) control closes the loop between the map and the running substrate. It fetches the latest anatomy alive-harness run from the restored public sink (SZLHOLDINGS/test-results), verifies the run's DSSE (PAE v1) ECDSA-P256 signature in the browser against the pinned, committed org key (hatun-mcp/PUBKEY_szlholdings-ec-p256.pem), and only then displays the run — verdict, live assertion counts, per-layer results, and the formula-gate pass rate, all derived from the signed evidence, never hand-typed. Runs are signed by the live Hatun MCP gateway (dsse_sign, keyid szlholdings-ec-p256) and published by a fail-closed publisher that verifies before and after upload. If the sink is unreachable or a signature fails, the panel says so — no fabricated green light. A signed GREEN run proves liveness, not doctrine upgrades: locked-proven stays exactly 8 and Λ remains Conjecture 1.

Machine-readable routes:

What's new in v5 — conscience, sovereign mesh, verifiable receipts (evolves v4)

v5 evolves v4 (it does not replace it): the entire v4 engine (data.js / app.js, dissection dock, live-body, yarqa CFD) is preserved. A single additive module (v5_organs.js, same vendored-free / 0-CDN / no-build posture) layers on six new, honestly-labeled capabilities — all read-only against the live a11oy origin:

• WILLAY — conscience / immune-gate organ (NEW). Five inspectable signed-refusal classifiers (cyber · bio dual-use · hidden-reasoning extraction · prompt-injection / governance bypass · self-harm), trust ceiling 0.97, read live from /api/a11oy/v1/willay/classifiers. Honest label: refusals are tamper-EVIDENT, not tamper-proof — auditable rules, the inverse of a removed/hidden classifier.
• Sovereign Mesh — circulatory upgrade. Per-node up/DOWN read live from /api/a11oy/v1/govern/health — a node that is offline reads DOWN, never a fabricated green light. F11 Ayni reciprocity per node; VRAM-fusion is ROADMAP (the mesh is a scheduler / router today).
• Buyer-verifiable receipt in-scene. A "Verify offline" action reuses Tier-1 WebCrypto ECDSA-P256-SHA256 over the DSSE PAE against /cosign.pub — verified entirely in your browser, no trust in us required. Plus a live receipt bloodstream counter reading the unified ledger (/api/lake/v1/health: total_receipts, sha3_256 chain head).
• 8 locked-proven → organ map. F1→BRAIN, F4+F11→HEART, F7+F22→CIRCULATORY, F12→NERVOUS, F18+F19→SKELETON — each showing the verbatim Lean statement + #print axioms, kernel-verified sorry-free @ c7c0ba17. Λ is the heart-gate: advisory, Conjecture 1, never a theorem. Khipu BFT = Conjecture 2.
• AI-Assurance (WDP / CDAO) overlay. Maps each organ to the assurance artifact it satisfies (model card · data card · SBOM/SLSA · SI-7 hash-chain · TEVV signed receipt · OTel-GenAI) with honest LIVE / PARTIAL / ROADMAP status chips; links the live /assurance surface.
• yarqa CFD + thermal-PINN physics layer. Composes the existing yarqa plug-flow compartmentalization with a thermal physics-informed-NN surrogate into one "physics-governed" layer, labeled MODELED (not measured), bounded error. Never a locked theorem; never folded into the locked-8.
• GPU-Sovereign Stack — SUBSTRATE (NEW). The vertical compute anatomy that complements the horizontal Sovereign Mesh: owned GPU fabric → runtime → mesh / router → open-weight model → native governance → buyer-verifiable receipts. Framed against how the leaders present sovereign compute (chip → cloud → model), made our own by promoting governance and verifiable receipts to first-class layers. Every layer carries an honest posture chip; live layers read /govern/health and degrade to DOWN, never a fabricated green light. Energy is SAMPLE until a real NVML meter; VRAM-fusion and on-metal TEE attestation are ROADMAP. Adds nothing to the locked-8.

Locked-proven stays exactly 8 {F1,F4,F7,F11,F12,F18,F19,F22} @ c7c0ba17; the doctrine footer is unchanged. Still sovereign: ONLY the vendored lib/three.min.js, zero runtime CDN.

What's new in v4 — dissection tools

v4 evolves v3 (it does not replace it): the entire v3 engine, organs, formulas, YAWAR receipt bus, GPD lens, and text fallback are preserved. Layered on top are bench-grade dissection controls so the body is easier to dissect:

• Dissection layer stack — toggle + opacity-slide the conceptual layers (circulatory · nervous · organs · skeleton/Khipu · halos/glow); choices persist in localStorage.
• Clip-plane scalpel — a sliding X/Y/Z cross-section (renderer.localClippingEnabled) cuts the organism so you can see the interior, with a reset.
• Explode view — an eased 0→1 slider separates the organ groups radially for inspection.
• Search / jump — filter organs + formulas by name/id; selecting one flies the camera and opens its panel.
• Always-on visibility HUD — a compact overlay reading honest counts straight from data.js (D.KERNEL): locked-proven = 8, experimental tier, axioms 14, sorries 163, kernel c7c0ba17, Λ = Conjecture 1, Khipu BFT = Conjecture 2. Never hardcoded.
• Focus mode — fade the other organs when one is selected, to isolate it.
• yarqa flow compartments (CFD) — additive, off by default — an engineering-method layer in the dissection dock that runs a clean-room plug-flow compartmentalization (yarqa) over the existing circulatory / YAWAR flow sampled from data.js, draws the compartments as a toggleable read-only overlay, and emits a reproducible integrity receipt digest. It is labeled CFD, not a locked theorem, and is never counted among the locked 8 — data.js stays the single source of truth and the locked-proven count is unchanged at 8.
• Accessibility + mobile — every new control is keyboard-reachable and ARIA-labeled, laid out so it never overlaps the existing HUD/panel, and it respects prefers-reduced-motion.

Still sovereign: ONLY the vendored lib/three.min.js (THREE r160 global) — zero runtime CDN, no npm, no build step. The site stays a static, offline-capable bundle.

What you'll see

Walk the organism in 3D and watch a real decision propagate: a request enters, the YUYAY gate scores it on 13 conjunctive axes (deny-by-default), the verdict is sealed into a DSSE Khipu receipt on the YAWAR append-only bus, and the YACHAY read-only cortex supplies reasoning without ever holding write authority. Each organ is labeled with its honest proof state — proven, conditional, or open conjecture — so nothing is dressed up as more certain than it is.

Five systems: HEART · YUYAY (13-axis conjunctive critique gate, emits Λ-signed receipt) · CIRCULATORY/BLOOD · YAWAR (append-only SHA-256 receipt bus) · BRAIN · YACHAY (read-only reasoning cortex) · NERVOUS · OTel/VSP · SKELETON · 12 service repos.

Honest doctrine: locked-proven = 8 {F1, F4, F7, F11, F12, F18, F19, F22} @ kernel c7c0ba17 (the no-axiom theorem locked_count_eight; F4 Khipu DAG acyclicity, F7 Chaski FIFO ordering, F22 Khipu emit append-only monotonicity) · Λ unconditional uniqueness = Conjecture 1 (machine-checked FALSE); conditional Λ axiom-free PROVEN · Khipu BFT safety = Conjecture 2, with the Wave23 conditional agreement theorem (khipu_quorum_safety_conditional, n≥3f+1 + honest non-equivocation, axiom-clean) · ~185 experimental CI-green · trust never 100% · no AGI.

Supply-chain posture: this Space runs a hardened Python/FastAPI runtime that serves the sovereign static atlas and its read-only evidence, integrity, and v7 API routes inside the Docker image (sdk: docker). The atlas shell (index.html, app.js, data.js, and vendored lib/three.min.js) remains a zero-CDN, no-build, static and offline-capable bundle. The runtime image is presented as SLSA L1 honest; that posture does not prove runtime correctness, safety, or model quality. The product images it depicts (a11oy, killinchu) are SLSA L1 honest · L2 build-attested (container provenance via attest-build-provenance, Sigstore keyless, Rekor-anchored; L3 roadmap) — see the active canonical successors a11oy, killinchu, and szl-mesh.

Non-affiliation. SZL Holdings' use of "UDS" references Defense Unicorns' Unified Defense Stack (USPTO Serial 99831122); SZL Holdings is not affiliated with Defense Unicorns. No production ATO is claimed.

Live body view — live-body.html

A new, additive page (live-body.html + live-body.js, linked from the title bar of the 3D atlas) turns the anatomy into the LIVE BODY VIEW of the agentic GPU mind. It is a standalone static page — same vendored-free, no-build, no-CDN posture as index.html — reachable directly at …static.hf.space/live-body.html. It does not modify the 3D engine (app.js, data.js), so there are no breaking changes.

Each of the six organs reads its real endpoint and lights up with its honest live status; press Run proactive cycle to watch the GPU mind act (IMMUNE → BRAIN → run → HEART/BLOOD → NERVOUS), pulsing each organ in turn:

The GPU-mind posture card reads a11oy /api/a11oy/code/healthz (sovereign / backend / mode); the honesty strip reads the doctrine lock live from a11oy /api/a11oy/v1/honest.

Honest by design (doctrine v11/v12):

• sovereign:true is shown only when /code/healthz reports the literal true — never synthesized from a truthy value. If the mind is unreachable the card shows sovereign: false. The half-state (banner sovereign while a router serves) is the one outcome the view will never render.
• Energy / joules are labeled SAMPLE until a real meter is wired.
• Λ is shown as Conjecture 1 (the skeleton's killer formula is intentionally a conjecture), pulled live, never hardcoded as proven.
• An unreachable endpoint degrades to an honest unreachable — … · honest empty-state; no green light is ever fabricated for an organ that did not answer. (Today amaru/sentra spaces may be unrouted → those organs honestly read unreachable; a11oy + the mind posture read live.)
• Read-only, sends no key, open-weight only.

See SCREENSHOT_NOTES.md for the body layout and what a reviewer should see in a deploy preview.

Run, test, rollback (operability)

This Space is a hardened Python/FastAPI runtime in a Docker Space (sdk: docker). It serves the sovereign static atlas plus the read-only /api/anatomy/v1/*, /version, /evidence, and /.well-known/szl-source.json contracts. The atlas shell itself remains static and offline-capable; the API service is required for runtime evidence and the v7 instruments. To run and test locally:

# run: launch the same application runtime used by the Docker image
python3 -m pip install -r requirements.txt
python3 living_runtime.py            # then open http://localhost:7860/

# atlas-shell-only mode (API/evidence routes are intentionally unavailable)
python3 -m http.server 8000          # then open http://localhost:8000/index.html

# test: the headless QA harness (Playwright/Chromium) renders all three
# viewports, asserts 0 console errors, exercises the v4 dissection dock + the
# v6 yarqa CFD layer, and confirms yarqa is NEVER counted in the locked-8.
npm i -D playwright && npx playwright install chromium
node qa_yarqa.js

Health: the page is "healthy" when index.html renders the 3D atlas with zero console errors at all three viewports (the QA assertion). The live-lens panels poll a11oy read-only and degrade to a labeled offline · static snapshot when an endpoint is unreachable — an offline endpoint is an expected state, not an outage.

Rollback (one step): every deploy is a git commit; to revert the live Space to a known-good state, redeploy the previous tag/commit — git revert <bad-sha> (or reset the HF Space mirror to the prior commit). Because the atlas shell is self-contained (vendored lib/three.min.js, no runtime CDN) and the application service is read-only and stateless, rollback means redeploying the older source-bound image; there is no data migration to unwind.

Service ownership: see .github/CODEOWNERS.

Security headers (SAFE-NOW hardening, R2)

This Space serves the atlas and read-only API contracts through the repository's Python/FastAPI runtime (sdk: docker; living_runtime.py on port 7860). Under sdk: docker Hugging Face does not apply a README custom_headers block (that lever is static-SDK only), so the cross-origin headers are emitted by the application server. Hardening is split across the two levers that actually take effect, and nothing is set that the browser would silently ignore (doctrine v11: never fabricate):

• Response headers emitted by the Space's static server (set on every response):
  • cross-origin-opener-policy: same-origin-allow-popups
  • cross-origin-resource-policy: cross-origin (keeps the page loadable inside the legitimate huggingface.co / *.hf.space embed iframe).
  • COEP require-corp is intentionally not set — it would block the page's read-only cross-origin fetches to a11oy/amaru/sentra and buys nothing here (no SharedArrayBuffer/wasm).
• <meta http-equiv> in index.html + live-body.html (what the browser honors from markup):
  • Content-Security-Policy (enforced, non-breaking): default-src 'self'; object-src 'none'; base-uri 'self'; an explicit connect-src allow-list (self + the four SZL *.hf.space origins it reads); img-src 'self' data: blob:. script-src/style-src keep 'unsafe-inline' on purpose — the 3D atlas ships heavy inline JS, inline styles, and a WebGL canvas, so a strict nonce/hash CSP would white-screen it. The win is origin-locking: no rogue external script, CDN, or pixel can load.
  • X-Content-Type-Options: nosniff and Referrer-Policy: strict-origin-when-cross-origin.

Why no HSTS / frame-ancestors / Report-Only here: browsers ignore HSTS, CSP frame-ancestors, and Content-Security-Policy-Report-Only when delivered via <meta>, and the static server does not emit them as real headers — so setting them in-repo would be security theater. HF already terminates TLS and redirects to HTTPS at the edge. Embedding is deliberately left enabled (no X-Frame-Options: DENY, no disable_embedding) so the Space keeps working inside the huggingface.co / *.hf.space iframe.

CORS: the evidence endpoints are public, read-only inspection contracts and return Access-Control-Allow-Origin: * so A11OY and the wider estate can ingest them. The only POST is a pure receipt recomputation; it cannot sign, store, fetch user-controlled URLs, or mutate state. Outbound dependency probes use a fixed allowlist in server.py; no key, cookie, or credential is sent.

Verify it yourself

The organism is a map, not the source of truth — every claim it draws is checkable against the live products it depicts:

# Confirm the live doctrine posture the heart reports
curl -s https://szlholdings-a11oy.hf.space/api/a11oy/v1/honest | jq .kernel_commit   # => "c7c0ba17"
# Inspect and replay the Anatomy bundle receipt (result is STRUCTURAL-ONLY, not signed)
curl -s https://szlholdings-anatomy.hf.space/api/anatomy/v1/receipt -o anatomy-receipt.json
curl -s -X POST -H "Content-Type: application/json" --data-binary @anatomy-receipt.json \
  https://szlholdings-anatomy.hf.space/api/anatomy/v1/verify/receipt | jq .verdict
# Open the independent browser verifier for signed governed receipts
open https://huggingface.co/spaces/SZLHOLDINGS/governed-receipt-verifier

Read the thesis → szl-papers · run the kernel → lutar-lean.

---

Declared source base: szl-holdings/anatomy (GitHub) → betterwithage/anatomy (creator-profile HF Space). The live source attestation reports the exact deployment revision and whether the HF overlay still needs GitHub synchronization. · a-11-oy.com

_{v5 (evolves v4) — WILLAY conscience · sovereign mesh · buyer-verifiable receipts · 8-proof→organ map · AI-assurance · yarqa+PINN (MODELED) · GPU-sovereign stack (SUBSTRATE) · Doctrine v11 LOCKED · 749/14/163 · kernel c7c0ba17 · 8 locked-proven + experimental CI-green tier · Λ = Conjecture 1 · Khipu Conjecture 2 open · SLSA L1 honest (static viz) · Apache-2.0}

---

◇ Part of the SZL Holdings estate — governed AI you can prove

One sovereign substrate, many organs — every decision carries a signed, checkable receipt.

◇ Holographic Estate — the showcase · 🛡️ a11oy · 🧬 IMMUNE · 🦅 killinchu · 🫀 anatomy · 🌌 cosmos · 🛰️ SDA · 🌊 yarqa · 🤗 all Spaces

Governed-receipt cluster — the open receipt format, an offline verifier, and a conformance bench (the DSSE Khipu receipts this organism depicts conform to this spec): 📐 governed-receipt-spec · ✅ receipt verifier · 📦 receipts bench

_{Doctrine v11 · Λ = Conjecture 1 (advisory — never "green"/theorem; open) · honest by design · public data only.}