SZL Holdings · Doctrine v11 · Λ = Conjecture 1 (advisory, never "green"/theorem) · canonical a-11-oy.com

IMMUNE — Verifiable AI You Can't Fake

Control before action. Evidence after.

Part of the szl-holdings estate · Product: a-11-oy.com · Proof: a11oy.net

Stage: REACHABLE · WRITE-READY · MEASURED software simulation. IMMUNE is the governed AI safety layer: every accepted agent action is sealed into an append-only SHA-256 hash-linked receipt chain. Status is CONNECTING, REACHABLE, or UNAVAILABLE — never a fabricated LIVE analog or PASS theorem. Λ = Conjecture 1 OPEN.

• Product tab: https://a-11-oy.com/immune
• Channel A kernel HUD: https://szlholdings-immune.hf.space (SZLHOLDINGS/immune)
• Channel B Python COP: https://szlholdings-immune-lattice.hf.space (SZLHOLDINGS/immune-lattice)
• NEXUS plane: https://szlholdings-immune.hf.space/nexus.html
• Org: https://github.com/szl-holdings · License: Apache-2.0

Lorenz OP (measured, sealed)

Default NEXUS showcase on both Spaces. Software simulation only.

POST /api/immune/nexus/run returns HTTP 201 with governed.pass=true when SENTRA admits the compact YAWAR payload (hashes, not floats).

Consolidation (do not delete either Space)

There are two Hugging Face Spaces. They are one product, two channels — not two immunes.

This Grok Build COP (src/lib/immune TypeScript ↔ python/immune Python) is the kernel both channels must follow. Lattice is not a second product.

Python kernel

python/
  immune/          canonical · sentra · huklla · persist · runtime · mesh · second_brain · frontier · organs · server
  tests/           unittest — boot WRITE-READY, cycle seal, DEADMAN, 575-handle brain, silhouette, MESH 3-of-4
  space/           HF hologram HUD

pip install -r python/requirements.txt
IMMUNE_DATA_DIR=./data/immune PYTHONPATH=python python3 -m immune.server
PYTHONPATH=python python3 -m unittest discover -s python/tests -v

---

What it demonstrates

IMMUNE sits between an AI agent's intent and its execution and proves, cryptographically, that the governance actually happened:

The receipt chain is the same principle public transparency logs use, applied to every AI-agent action.

Lattice COP (RANGE / GHOST / WRAITH / ECHO / MESH / GRAPH)

Additive command surface on the live Space. Palantir object model, Anduril effector tasking, CIA-style OSINT attribution — independently implemented under Doctrine v11.

Ops go through POST /api/immune/cycle (SENTRA → optional YAWAR receipt → HUKLLA). The public Hugging Face Space boots a labeled demo operator (IMMUNE_DEMO_OPERATOR=1 in the demo image): process-local Ed25519 signs genesis SET_MODE PASS and refreshes evidence so /readyz is write_ready: true. The demo keypair is persisted under IMMUNE_DATA_DIR/demo-operator.json so a process restart reuses the same trust root and receipt chain. That key is not an ATO. Production deployments omit the flag, require IMMUNE_ACTION_PUBLIC_KEY, and stay fail-closed READ_ONLY until a matching signed envelope is applied. Home remains the sole useGetImmuneState() authority query; ThreeScene and the controls scroll region are unchanged.

API

Signed advisory authority

Privileged advisory controls are disabled unless IMMUNE_ACTION_PUBLIC_KEY is canonical base64 for the trusted raw 32-byte Ed25519 public key. Clients submit a strict, short-lived immune.action.v1 envelope with a unique requestId; the signature covers the canonical envelope without its signature field.

Accepted actions and resulting state are committed together to data/immune/authority.sqlite in WAL/FULL mode. Receipts are append-only, request IDs remain single-use across restarts, and a missing trust root, read failure, stale receipt, or chain mismatch can never render green. The public UI holds no operator private key unless IMMUNE_DEMO_OPERATOR=1 or IMMUNE_ACTION_PRIVATE_KEY is set on the server. With those flags the process signs genesis SET_MODE PASS and auto-refreshes so evidence stays VERIFIED. The demo operator is labeled authority.demoOperator and is not a production ATO. Without them the UI accepts an already-signed envelope and is otherwise read-only. IMMUNE_EVIDENCE_MAX_AGE_MS may override the default 15-minute freshness window; stale state remains observable but cannot authorize a governed cycle.

/readyz remains explicit while that trust root is absent: verified immutable runtime bytes and a clean receipt ledger may be read_ready: true, but the contract stays status: READ_ONLY, ready: false, authority_ready: false, and write_ready: false with blocker ACTION_TRUST_ROOT_UNCONFIGURED. The public demo image sets IMMUNE_DEMO_OPERATOR=1 so the live Space is status: READY / write_ready: true after genesis.

The frontier evaluator consumes the shared @szl-holdings/contracts/decision-genome schema from Platform. It does not define a second contract, authorize an action, or claim measured detection performance. Missing or stale provenance, future-dated evidence, and insufficient calibration fail closed to review or withholding. The receipt-writing evaluator shares the agent abuse budget (three accepted requests per IP per minute and 300 accepted requests per UTC day) and returns HTTP 409 when the governed cycle does not seal the recommendation.

Repository layout

frontend/            React + Vite + Tailwind SPA ("cyber-HUD" UI, three.js + framer-motion)
  src/               App entry, Home page, panels (Controls, Audit, Intel, Pulse, Leaders), 3D scene
  deploy/            Dockerfile + build-standalone.sh + deploy README (assembles the HF Space image)
server/              Minimal standalone Express app for the demo
  immune-standalone.ts   Mounts ONLY /api/immune + serves the built SPA (no DB/auth/Bingle/Mulé)
  routes/immune/         canonical · sentra · huklla · ledger · state · intel · index
data/immune/         The REAL seeded receipt/evidence chain (ledger.jsonl, huklla_evidence.jsonl)
LEDGER_FIELD_KEYS.md Frozen ledger field-key decision (why `sentra` stays an internal hash-input key)

Build & deploy (the live Hugging Face Space)

After pnpm install --frozen-lockfile, run pnpm run build. The historical frontend/deploy/build-standalone.sh command delegates to the same cross-platform Node builder. It:

1. Builds the Vite frontend at site root (BASE_PATH=/).
2. Bundles server/immune-standalone.ts (all deps inlined) into a single dist/immune-server.js via esbuild.
3. Copies the built SPA to dist/public/ and seeds the real chain into dist/data/immune/.

frontend/deploy/Dockerfile (Node 24 Alpine, non-root UID 1000, port 7860) copies that dist/ and runs node immune-server.js. See frontend/deploy/README.md for the exact commands.

Provenance note. This repository is now independently installable, typecheckable, buildable, and smoke-testable. The deploy workflow always rebuilds from the exact merged GitHub revision, replaces the Space runtime whitelist, and verifies /.well-known/szl-source.json plus the live ledger before it reports success. Shared Decision Genome concepts retain their canonical Platform origin; the Apache-2.0 schema is mirrored locally so the runtime no longer depends on a private workspace link. /readyz binds the exact source and build revisions to the deployment-manifest digest, canonical artifact-set digest, server/UI artifact hashes, and current ledger audit.

---

SZL Holdings · Doctrine v11 · honest by design · Apache-2.0

---

Explore the SZL estate: a11oy console · LLM Router · Receipt format spec · Lean proofs · Docs · 🤗 SZLHOLDINGS