docs(slsa): sync Space card with GitHub README (SLSA L1 honest; L2 roadmap, not yet claimed)

Automated README sync from szl-holdings/a11oy main via hf-sync.

Signed-off-by: Yachay <yachay@szlholdings.ai>
Co-Authored-By: Perplexity Computer Agent <agent@perplexity.ai>

README.md

@@ -7,33 +7,18 @@ sdk: docker
 app_port: 7860
 pinned: true
 license: apache-2.0
-short_description: "a11oy — signed-receipt substrate; receipts.in ≡ receipts.out"
+short_description: "a11oy — policy + receipt substrate"
 tags:
   - governance
   - agentic-ai
   - doctrine-v11
   - a11oy
-  - slsa-l2
+  - execution-fabric
   - apache-2.0
 ecosystem-stage: "operational"
 ---
-
-# a11oy 🔬
-
-> **The signed-receipt substrate. Every AI decision leaves a DSSE Khipu receipt. `receipts.in ≡ receipts.out`.**
-
-[![SLSA L1 + L2](https://img.shields.io/badge/SLSA-L1%20%2B%20L2%20attested-2C5F2D?style=flat-square)](.compliance/SLSA_LEVEL.md)
-[![cosign signed](https://img.shields.io/badge/cosign-keyless%20signed-blueviolet?style=flat-square)](https://search.sigstore.dev/?logIndex=1710578865)
-[![doctrine-v11](https://img.shields.io/badge/doctrine-v11%20LOCKED-0B1F3A?style=flat-square)](https://github.com/szl-holdings/.github/tree/main/doctrine)
-[![CI](https://github.com/szl-holdings/a11oy/actions/workflows/ci.yml/badge.svg)](https://github.com/szl-holdings/a11oy/actions)
-[![License](https://img.shields.io/badge/license-Apache--2.0-blue?style=flat-square)](LICENSE)
-
-**LOCKED kernel `c7c0ba17` · 749 declarations · 14 axioms · 163 sorries · Doctrine v11**
-**Proof posture (two-tier):** 5 locked-proven `{F1, F11, F12, F18, F19}` + **~36 experimental** theorems CI-green on main `@7885fd9` (Lean v4.18.0 · 1304 decls / 22 axioms — NOT in the locked count).
-
-[Live demo](#live) · [What it does](#what-it-does) · [Verify](#verify-it-yourself) · [Architecture](#architecture) · [Parity vs. leaders](#parity-vs-leaders) · [Honest status](#honest-status)
-
----
+<!-- HF Space front-matter is REQUIRED (sdk: docker). Injected by hf-sync
+     so the Space builds the Dockerfile. Do not remove. -->
 
 ## Live
 
@@ -89,22 +74,16 @@ Key capabilities:
 curl -s https://szlholdings-a11oy.hf.space/api/a11oy/v1/honest | jq .kernel_commit
 # => "c7c0ba17"
 
-# 2. Verify the cosign keyless signature on the published image (SLSA L1).
-#    GHCR verification shows a cosign-signed image (L1); the SLSA provenance
-#    attestation (L2) verifies via `cosign verify-attestation --type slsaprovenance`
-#    with strict identity. See .compliance/SLSA_LEVEL.md.
+# 2. Verify the cosign keyless signature on the published image (SLSA Build L1, honest).
+#    GHCR verification shows a cosign keyless-signed, Rekor-anchored image.
+#    SLSA L2 (verified build-provenance attestation under isolated builders) is on
+#    the roadmap — see .compliance/SLSA_LEVEL.md. We do NOT claim L2-verified today.
 cosign verify ghcr.io/szl-holdings/a11oy:uds-v0.2.0 \
   --certificate-identity-regexp="^https://github.com/szl-holdings/" \
   --certificate-oidc-issuer="https://token.actions.githubusercontent.com"
 # Public Rekor entry for the image signature: log index 1710578865
 
-# 3. Verify the SLSA L2 provenance attestation (strict identity)
-cosign verify-attestation --type slsaprovenance ghcr.io/szl-holdings/a11oy:uds-v0.2.0 \
-  --certificate-identity-regexp="https://github.com/szl-holdings/a11oy/" \
-  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"
-
-# 4. Deploy as part of the signed mesh bundle
-#    (service images are L2-attested; the bundle artifact itself is not yet attested)
+# 3. Deploy as part of the signed mesh bundle
 uds-cli bundle deploy oci://ghcr.io/szl-holdings/szl-uds-bundle:uds-v0.2.0 --confirm
 ```
 
@@ -119,7 +98,7 @@ graph TD
     A[Incoming action] --> PL[Policy layer\n/v1/policy/evaluate\ndeny-by-default]
     PL --> KD[Khipu DAG\nDSSE P-256 signed\nSHA-256 hash-linked]
     KD --> LDG[Ledger /v1/ledger\nreplayable, tamper-evident]
-    KD --> UDS[(GHCR\nSigned OCI\ncosign-signed · SLSA L2 attested)]
+    KD --> UDS[(GHCR\nSigned OCI\ncosign keyless-signed · SLSA L1 honest)]
     KD --> REKOR[(Rekor transparency log\nindex 1710578865)]
 ```
 
@@ -131,7 +110,7 @@ graph TD
 |---|---|---|---|
 | Policy enforcement | ✅ | ✅ `/v1/policy/evaluate` | — |
 | Audit trail | ✅ logs | ✅ **signed receipts** | Palantir logs are not individually verifiable cryptographic artifacts |
-| Supply-chain provenance | — | ✅ **cosign-signed + SLSA L2 attested** | `cosign verify` + `cosign verify-attestation --type slsaprovenance` on every image — they don't offer this. |
+| Supply-chain provenance | — | ✅ **cosign keyless-signed, Rekor-anchored (SLSA Build L1, honest)** | `cosign verify` on every image; verifiable transparency-log entry. SLSA L2 verified-provenance is on the roadmap. |
 | Formal math substrate | — | ✅ Lean 4 / 749 decl | Open, machine-checkable |
 | Air-gap deployment | ✅ (proprietary) | ✅ **one UDS command** | Open-source, reproducible |
 | Receipt multi-party witness | — | ✅ BFT quorum-capable | — |
@@ -151,9 +130,10 @@ docker run --rm -p 7860:7860 ghcr.io/szl-holdings/a11oy:uds-v0.2.0
 | Claim | Status |
 |---|---|
 | Live HF Space (HTTP 200) | ✅ |
-| SLSA Build L1 + L2 | ✅ — cosign-signed image (L1), verifiable via `cosign verify`; Rekor [1710578865](https://search.sigstore.dev/?logIndex=1710578865). L2 SLSA provenance attestation verifies via `cosign verify-attestation --type slsaprovenance` (strict identity, keyless Fulcio+Rekor). See [.compliance/SLSA_LEVEL.md](.compliance/SLSA_LEVEL.md). |
+| SLSA Build **L1 (honest)** | ✅ — cosign keyless-signed image, verifiable via `cosign verify`; Rekor [1710578865](https://search.sigstore.dev/?logIndex=1710578865). See [.compliance/SLSA_LEVEL.md](.compliance/SLSA_LEVEL.md). |
+| SLSA Build **L2** | 🛣️ **Roadmap** — verified build-provenance attestation under isolated builders. **Not claimed as achieved today.** |
 | cosign keyless signed | ✅ |
-| UDS bundle (`szl-uds-bundle:uds-v0.2.0`) | ✅ Real, deployable mesh bundle. **Note:** the bundle artifact itself is **not yet SLSA-attested** (owner-only GHCR package-write grant pending). The L2 build-provenance attestation that verifies is on the **service images**, not the bundle. |
+| UDS bundle (`szl-uds-bundle:uds-v0.2.0`) | ✅ Real, deployable mesh bundle (cosign-signed, Rekor-anchored). |
 | DSSE Khipu receipts | ✅ — ECDSA P-256-SHA256 |
 | Lean 749/14/163 @ `c7c0ba17` | ✅ |
 | Locked-proven PURIQ formulas | ✅ Exactly **5** — F1, F11, F12, F18, F19 (Lean 4, depend on **no** axioms; machine-enforced `locked_count_five`). |
@@ -164,7 +144,7 @@ docker run --rm -p 7860:7860 ghcr.io/szl-holdings/a11oy:uds-v0.2.0
 
 ---
 
-<sub>Doctrine v11 LOCKED · 749/14/163 · kernel `c7c0ba17` · SLSA L1 + L2 (provenance attestation verified; L3 not claimed) · Λ = Conjecture 1 · Apache-2.0 · DOI [10.5281/zenodo.20434276](https://doi.org/10.5281/zenodo.20434276)</sub>
+<sub>Doctrine v11 LOCKED · 749/14/163 · kernel `c7c0ba17` · SLSA Build L1 honest (L2 roadmap; L3 / FedRAMP / Iron Bank / CMMC not claimed) · 5 locked-proven + experimental CI-green tier · Λ = Conjecture 1 · Apache-2.0 · DOI [10.5281/zenodo.20434276](https://doi.org/10.5281/zenodo.20434276)</sub>
 
 Signed-off-by: Stephen P. Lutar Jr. <stephenlutar2@gmail.com>