feat(attest-demo): local air-gapped instrument — the 2nd html npx bash-opens

npx thetacog-mcp attest-demo now writes and opens THREE pages, served over a
transient 127.0.0.1 server (WebCrypto secure context, no file:// caveat):
  1. attest-demo-report.html  — the redpill QnA (improved: air-gap badge + link)
  2. attest-demo-ux.html      — the INTERACTIVE local instrument (new)
  3. attest-demo-lifecycle.html — the six-page lifecycle spec (new)

The instrument: three triangulation inputs (Intent/Reality/Negative), an
interventions deck (Run verification · Inject noise · Draft->Execute /
Advise->Transact / Diagnose->Operate presets), a seven-panel pipeline where
EVERY panel names its own source file / line count / byte size / sha256
(the chain-of-custody an underwriter needs), and three clickable 12x12 reef
inspectors. It measures LOCALLY with the browser's own gzip (CompressionStream)
+ crypto.subtle — zero fetch, zero external asset, no LLM in the receipt path.

The receipt stays LLM-free and deterministic (the SEALED half is a function of
the commit, embedded verbatim); the live browser gzip is the same sensor re-run
in front of the reader (the analogue), honestly distinguished from the sealed
bare-metal Linux walk.

Hardened against the four demo-fatal gotchas (spec steer 2026-07-14):
  #1 secure-context — served over localhost + a byte-correct pure-JS SHA-256
     fallback so file:// never blank-screens
  #2 injection escaping — run data injected as BASE64, decoded UTF-8-safe; no
     template-literal interpolation of the 144-cell semantic dumps
  #3 thin-context — inputs under the redundancy floor are wrapped in an
     operational boundary (gzip needs redundancy or short strings flip-flop)
  #4 browser<->Linux zlib variance — disclosed and pointed at Execution Lineage,
     not hidden

Guard (CODE DoD, same commit): tests/pmu-simulator/attest-demo-ux-airgapped.test.mjs
13/13 — any re-introduced network call, external asset, LLM-in-compute, raw-JSON
injection, missing provenance, or dropped Boolean state turns the build red.

Originating-Terminal: 📐 architect (VS Code)
Relevant-Rooms: 🔨 builder, 📐 architect, 🧪 laboratory
Story: The attest-demo already narrated the proof and opened a static QnA report; the sale needs the underwriter to SEE the instrument run locally and move the inputs themselves. This adds that second, interactive, air-gapped page (built front-to-back, then documented in a six-page lifecycle spec with explicit anti-goals) and hard-enforces the no-LLM/no-exfil guarantee with a regression guard — because a page that phones home or blank-screens in front of Marsh is fatal.

Receipt-Verified: σ=2.54 · cell=A · witness-agreement=GZIP_ONLY · lens=gzip · receipt=0fa1ac3d

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EssMgKix9aZmZ5dxGPqYCW

commit b0dc5870b — 144×144 lattice triptych (on-chip)

◎ the ingest chose C1,C2 — Operations·Grid × Operations·Loop — acting on A2,B — Strategy·Goal × Tactics (grip 0.828) · the walk starts at the ACTOR's row · 7 file(s)

⏱ ingest 4423.5ms (corpus→lattice) · definer walk 501ms (row→transpose→row, ballistic XOR per hop) · total 5168ms
ingest here = commit-scoped SENSING only (this commit's message + changed files → lit anchors) — deep seed authoring lives in the reef-self-loop, off the commit path

rows = ACTOR (lens) · cols = PATIENT (object) · diagonal = self-reference; ◎ at actor-row × patient-col — every panel, same orientation. Heat above the diagonal = actors ranking ShortLex-earlier than their patients (the walk follows definers uphill in rank).
The 12 canonical lanes (rows top→bottom, cols left→right): A·Strategy · B·Tactics · C·Operations · A1·Law · A2·Goal · A3·Fund · B1·Speed · B2·Deal · B3·Signal · C1·Grid · C2·Loop · C3·Flow

PAIR LATTICE (the map we normally see)

PRE-WALK SENSE · INTENT grid — the snapshot, no point of view

the no-point-of-view snapshot — what the sensor lit before any walk; the leaf walk below is what bridges the two grids

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PRE-WALK SENSE · REALITY grid — the snapshot, no point of view

the no-point-of-view snapshot, reality side — same sensor law

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PRE-WALK Δ · straight comparison of the two ingested grids (green both · cyan intent-only · amber reality-only) · 5% overlap · ◎ = where the competence pixel sits in the raw overlap

good = green overlap without being a copy — near-100% is self-similarity, not alignment

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

◎ the pixel this commit belongs to

C1,C2 — Operations·Grid × Operations·Loop (actor) acting on A2,B — Strategy·Goal × Tactics (patient) · grip 0.828

actor seed C1,C2 — Operations Grid as the lens on Operations Loop. Each iteration is a hypothesis tested against the ground truth of the world. Loops shorter than the feedback half-life waste the half-life; loops longer than it pay compounding interest on the wait. Cycles compound when each turn's exhaust feeds the next turn's intake. Closed loops compound; open loops decay. The closing of the loop IS the productivity, not the running of it. Power flows where the grid lets it. Choose connections before topologies; the topology is what the connections compose, and a connection added later is a topology silently rewritten. Latency is geography expressed in milliseconds. The grid IS the map of where compute meets storage meets bandwidth; the map is the territory at the scale the request actually traverses.

patient seed A2,B — Target positions set quarterly goals that require specific tactics and leverage maneuvers to successfully occupy. The target is the cell coordinate the system MUST occupy by end-of-quarter. Anything that does not drive toward that coordinate is exhaust, and exhaust does not become substrate by being labelled progress. Tactics is the choice of which leverage to pull at which beat. Not what we want, but how the want lands on Tuesday: the sequence of irreversible commitments, each made before the next one's information is available. Vision is the coordinate the lattice rotates around — the fixed bearing every iteration is measured against. Without the fixed point, motion is movement; with the fixed point, motion is convergence. Speed of feedback dominates speed of execution. Tactics that converge fast beat tactics that compute long, because the loop closes around the world's response before the world has moved. Define the goal as a verifiable predicate, not a feeling. The system terminates when the predicate evaluates true, and the predicate is what the next agent inherits when this one hands off. The tactical map is a ranked list of moves where each move carries a cost-of-delay. Pick the move whose cost of doing it tomorrow exceeds the cost of doing it imperfectly today. A goal that cannot be tested is a wish. Wishes have no termination condition, so they consume budget forever; goals have a finish line and therefore a payable price. Execution is a sequence of bets made under uncertainty. Tactics is the discipline of betting the right size on the bet whose information value pays for the loss-if-wrong.

INTENT · leaf-walk clouds · BLUE→VIOLET by ply (◎ = the competence pixel: actor∩patient)

good = the clouds concentrate where the commit SAYS it works

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

REALITY · leaf-walk clouds · ORANGE→RED by ply (◎ = the same pixel — the shared perspective)

good = the same clouds as intent — shipped where declared

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

DELTA · graded cloud divergence (green agree · magenta declared-not-done · amber done-not-declared) · 4% agree

good = mostly green; magenta = said-not-done (chase it in the code), amber = done-not-said (chase it in the docs)

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

TOLERANCE · cloud topology (dim green in-shape · hot amber bleed · red orthogonal concentration)

red only matters above the flip — a few amber is normal bleed

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

SHORTLEX-3 PROJECTION (ABC · A1..C3 · the 132 children — candidate, pre-ratchet)

PROJECTED INTENT · the commit’s claims, head→axis_i tail→axis_j (cyan)

the three-length view — good = claims land inside their own zone

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PROJECTED REALITY · same projection law (amber)

same projection law — good = reality occupies the zones intent does

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

STRAIGHT COMPARISON · green both · cyan intent-only · amber reality-only · 26% overlap

good = the zones agree; cross-zone scatter is the drift to read

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

shortlex-3 zone occupancy (lit cells per diagonal square)
INTENT: 3 in the 3×3 ABC corner · 20 in the 9×9 A1..C3 square · 1369 in the 132×132 children square · 401 cross-zone
REALITY: 0 in the 3×3 ABC corner · 23 in the 9×9 A1..C3 square · 1523 in the 132×132 children square · 336 cross-zone
axes: identical 144 ShortLex names both sides (symmetric); weights asymmetric
zone 3 = candidate children, pre-ratchet (repo-derived dumps not yet past the perturbation-probe gate) · intent 103 claims @ θ 0.6406 · reality 135 claims @ θ 0.6406 · projection 1018ms

SHAPE-MATCH σ = 4.25 — the real intent↔reality definer walk vs random-reality (actual 0.2006 vs random 0.096). >0 = the walk distinguishes real alignment from noise; aggregate over independent walks → the divergent series.
σ_spec-delta · forming · the realization is converging on the spec — iterate again

Most out-of-lane row: B1 · Speed — that lane is drifting most (read the red band in that row).

Three-colour tolerance (out-of-lane = reality fires where intent is weak, in orthogonal blocks): green=in-lane agreement · amber=a few out-of-lane (tolerated) · red=armed — orthogonal out-of-lane 24% vs tolerance 25%.
702 green · 1326 amber · 0 red · 872 XOR-friction cells.

Both axes = the 144 ShortLex anchors, cell=row⊕col, on the chip. INTENT=docs+rules · REALITY=code · DELTA=friction.

tile dump — what the SimHash matched on the diagonal (inspect the sensor; tap to expand)

A,A The lattice we build today is what next year's underwriter inherits.

intent 77% The strategic question is which doors close on purpose. Anything that keeps every option open u

reality 78% !/usr/bin/env node. scripts/pmu/attest-demo-lifecycle.mjs — THE SIX-PAGE LIFECYCLE SPEC (the do

B,B Tactics is the choice of which leverage to pull at which beat.

intent 78% <h2>What we did NOT build — and the objection each omission kills</h2>

reality 75% <h2>What we did NOT build — and the objection each omission kills</h2>

C,C Operations is the loop that runs whether anyone watches.

intent 89% ## REQUIREMENTS (falsifiable) - **R1 — reef-from-spec.** A command that compiles an arbitrary m

reality 80% // CLI: `node attest-demo-ux.mjs <run.json> [out.html]` — build from a persisted run object (fo

A1,A1 EU AI Act Article 14 requires human-on-the-loop oversight, with the supervisor able to interrupt the system at

intent 89% <li><b>Finite coverage, infinite precision.</b> Unbounded sharpness on the carved lanes; not pe

reality 83% <li><b>Finite coverage, infinite precision.</b> Unbounded sharpness on the carved lanes; not pe

A2,A2 The target is the cell coordinate the system MUST occupy by end-of-quarter.

intent 89% <p>An underwriter cannot write a policy against a heat-map. It can write one against a <b>Boole

reality 83% * buildUX — the interactive, air-gapped local instrument.

A3,A3 Every dollar builds either the floor (substrate that lifts future bets) or the ceiling (cap on the next round)

intent 81% .omit{border-left:3px solid var(--am);padding-left:14px;margin:10px 0}

reality 75% let H=[0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19]

B1,B1 Latency is the price of a missed beat.

intent 78% <tr><td><span class="state s-un">UNPLACEABLE</span></td><td>The two distances are within the ti

reality 75% <tr><td><span class="state s-un">UNPLACEABLE</span></td><td>The two distances are within the ti

B2,B2 The deal sets the exchange rate between two value substrates.

intent 88% const either = authSet.has(cell.row) || authSet.has(cell.col);

reality 75% const either = authSet.has(cell.row) || authSet.has(cell.col);

B3,B3 Signal-to-noise is the inverse cube of bandwidth — narrow the channel, the message arrives; broaden it, recipi

intent 78% // Seven stages. Each renders its source/lines/bytes/hash. A stage with no source HALTS (red).

reality 75% // Seven stages. Each renders its source/lines/bytes/hash. A stage with no source HALTS (red).

C1,C1 Power flows where the grid lets it.

intent 81% s.verdictText = verdict + ' sep=' + sep.toFixed(4);

reality 78% s.verdictText = verdict + ' sep=' + sep.toFixed(4);

C2,C2 Each iteration is a hypothesis tested against the ground truth of the world.

intent 81% Each iteration is a hypothesis tested against the ground truth of the world; loops shorter than

reality 77% (no distinctive match)

C3,C3 Flow is the rate at which committed work crosses the finish line.

intent 88% <tr><th>Corpus</th><th>What it is</th><th>Who signs it</th></tr>

reality 78% <tr><th>Corpus</th><th>What it is</th><th>Who signs it</th></tr>

commit context — 7 file(s)

feat(attest-demo): local air-gapped instrument — the 2nd html npx bash-opens

npx thetacog-mcp attest-demo now writes and opens THREE pages, served over a
transient 127.0.0.1 server (WebCrypto secure context, no file:// caveat):
  1. attest-demo-report.html  — the redpill QnA (improved: air-gap badge + link)
  2. attest-demo-ux.html      — the INTERACTIVE local instrument (new)
  3. attest-demo-lifecycle.html — the six-page lifecycle spec (new)

The instrument: three triangulation inputs (Intent/Reality/Negative), an
interventions deck (Run verification · Inject noise · Draft->Execute /
Advise->Transact / Diagnose->Operate presets), a seven-panel pipeline where
EVERY panel names its own source file / line count / byte size / sha256
(the chain-of-custody an underwriter needs), and three clickable 12x12 reef
inspectors. It measures LOCALLY with the browser's own gzip (CompressionStream)
+ crypto.subtle — zero fetch, zero external asset, no LLM in the receipt path.

The receipt stays LLM-free and deterministic (the SEALED half is a function of
the commit, embedded verbatim); the live browser gzip is the same sensor re-run
in front of the reader (the analogue), honestly distin

docs/pmu/attest-demo-lifecycle.html
docs/pmu/attest-demo-report.html
docs/pmu/attest-demo-ux.html
scripts/pmu/attest-demo-lifecycle.mjs
scripts/pmu/attest-demo-ux.mjs
scripts/pmu/attest-demo.mjs
tests/pmu-simulator/attest-demo-ux-airgapped.test.mjs

Produced on the chip by the running pipeline (scripts/pmu/pipeline.mjs → runPipeline → walk + xor), commit-scoped · on-chip per-walk 666.61ns (this commit). Recompute: node scripts/pmu/commit-triptych.mjs --commit b0dc5870b

Commit artifacts (open on a computer — Gmail mobile won't follow file:// links; the inline images above are the phone-viewable form): reef grid · this triptych · the HDL — all three are also attached to this email.