Add application file

README.md

@@ -1,15 +1,75 @@
 ---
-title: Verifier
-emoji: 🐢
-colorFrom: purple
-colorTo: red
+title: Provenance Verifier — Live Demo
+emoji: ✔
+colorFrom: gray
+colorTo: green
 sdk: gradio
-sdk_version: 6.26.0
-python_version: '3.12'
+sdk_version: 5.44.1
 app_file: app.py
 pinned: false
 license: apache-2.0
-short_description: Verification tool to chack the provenance of a model package
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# Provenance Verifier — live demo · FALCONS.AI Model Surgeon
+
+A public, no-account demo where anyone can watch a Model Surgeon package prove
+itself. Tap a sample, drop your own `.zip` onto the grid, or point it at a
+Hugging Face repo — the verdict comes straight from the unmodified, audited
+`verify_attestation.py` from
+[Falcons-ai/surgeon-verify](https://github.com/Falcons-ai/surgeon-verify)
+(Apache-2.0), invoked as a subprocess.
+
+Product: [surgeon.falcons.ai](https://surgeon.falcons.ai) ·
+[/verify](https://surgeon.falcons.ai/verify)
+
+> Signed creation is the product — universal verification is what makes it
+> worth anything. Free, no account, forever.
+
+## Transport: Gradio (refactored 2026-09-03 from the FastAPI/Docker Space)
+
+| file | role |
+| --- | --- |
+| `app.py` | the Gradio page and its three handlers (sample · upload · Hub repo), the cancel control, the five-deep verdict stack with receipts |
+| `engine_wrapper.py` | the verification wrapper — **every function byte-identical to the FastAPI original** (`_run_engine_sync`, `_parse_stdout`, `_normalize_container`, `_junk_entry`, `_zip_declared_size`, `_resolve_and_verify_repo_sync`, `_dsse_subject_names`, `_result`) |
+| `engine/verify_attestation.py` | the pinned engine, verbatim, unchanged |
+| `static/style.css` | the product stylesheet, unchanged; `static/gradio.css` holds the few overrides that hide Gradio's own wrappers |
+| `samples/` | SAMPLE_A (genuine) · SAMPLE_B (one byte flipped) |
+
+What changed for the reader: sample cards are tapped rather than dragged (Gradio has no cross-component drag; drop **of your own files** onto the grid still works); the keyid chip is plain selectable text (no copy button); "recomputing digests… / fetching from the Hub…" shows as Gradio's progress text; ✕ cancel aborts the in-flight event exactly as the old AbortController did.
+
+## Guarantees (BUILD SPEC section 1) — how each survives the transport
+
+- The **only** verification engine is the pinned, verbatim copy in `engine/verify_attestation.py`, invoked as a subprocess. No porting, no patching.
+- **No model-parsing code** anywhere in this Space.
+- **Nothing retained**: per-request temp dirs deleted in `finally`; Gradio's own upload copy is moved into that dir and deleted with it; `delete_cache=(60, 60)` sweeps anything Gradio holds; `analytics_enabled=False`; uvicorn runs with `access_log=False`; this code never logs user input.
+- A missing capability is never reported as tampering.
+- Weights are never re-served — the page has no file output component.
+
+## Configuration
+
+| env | default | meaning |
+| --- | --- | --- |
+| `MAX_UPLOAD_MB` | `1024` | per-file cap for uploads and repo files (also passed to Gradio as `max_file_size`) |
+| `MAX_REPO_MB` | `2048` | total cap for attested-repo subject downloads |
+| `HF_TOKEN` | unset | optional, for Hub rate headroom only |
+| `PORT` | `7860` | Spaces contract |
+
+## Local run
+
+```
+pip install -r requirements.txt
+python app.py            # http://localhost:7860
+```
+
+## Verified before delivery (sandbox, 2026-09-03)
+
+Handlers executed against the real engine and both samples through the Gradio
+functions (with the `gradio` import stubbed — the package is not installable in
+the build sandbox): SAMPLE_A → ✔ VERIFIED with keyid + receipt · SAMPLE_B →
+✘ TAMPERED with the ✖ line and signed/actual digests · a Windows-style
+backslash container → repaired, VERIFIED, note shown · a text file → NOT A
+SURGEON PACKAGE · over-cap → LIMIT / ERROR · bad repo id → LIMIT / ERROR · at
+capacity → the same "at capacity" verdict · stack capped at five · no temp
+dirs left behind, Gradio's cached upload deleted. **Not run here:** the Gradio
+UI itself (first render is on the Space); fonts still fall back to system
+monospace until `static/fonts/` is populated.

app.py

@@ -0,0 +1,394 @@
+"""
+FALCONS.AI "Verify Anything" — Hugging Face Space (Gradio transport)
+
+Refactor of the FastAPI Space to the `gradio` SDK. Look and behaviour are
+preserved: the product's dark theme tokens and stylesheet, the sample cards,
+the drop grid, the Hub-repo form, a cancel control, and the verdict stack
+(five newest, each with the engine's receipt). The verification logic is
+NOT here — it lives, byte-identical to the FastAPI original, in
+`engine_wrapper.py`, and still invokes the pinned, unmodified
+`engine/verify_attestation.py` as a subprocess.
+
+Standing rules (BUILD SPEC section 1), how each survives the transport:
+  1. Engine as subprocess only         -> engine_wrapper._run_engine_sync
+  2. No model-parsing code             -> none here; JSON metadata only
+  3. Nothing retained                  -> per-request temp dirs deleted in
+                                          `finally`; Gradio's own upload copy
+                                          is deleted in the same `finally`;
+                                          analytics off; uvicorn runs with
+                                          access_log=False; nothing logged.
+  4. Missing capability != tampering   -> engine_wrapper (unchanged)
+  5. Weights never re-served           -> the verdict stack shows text only;
+                                          no file output component exists.
+"""
+
+import base64
+import html
+import json
+import os
+import shutil
+import tempfile
+import threading
+import zipfile
+from pathlib import Path
+
+import gradio as gr
+
+from engine_wrapper import (
+    BUILD_STAMP, LOCAL_CMD, MANIFEST, MAX_UPLOAD_BYTES, MAX_UPLOAD_MB,
+    MAX_REPO_MB, NORMALIZED_NOTE, NOT_A_PACKAGE_COPY, ROOT, SAMPLES_DIR,
+    _REPO_ID_RE, _normalize_container, _resolve_and_verify_repo_sync,
+    _result, _run_engine_sync, _zip_declared_size,
+)
+
+MAX_CONCURRENCY = 4
+STACK_MAX = 5
+
+print(f"falcons-verify build {BUILD_STAMP}")
+
+# ------------------------------------------------------------- concurrency
+# The FastAPI version counted in-flight requests under an asyncio lock and
+# answered 429 when full. Gradio runs handlers in worker threads, so the same
+# rule is a non-blocking semaphore: full -> the same "at capacity" verdict.
+
+_slots = threading.Semaphore(MAX_CONCURRENCY)
+
+
+def _busy_result():
+    return _result(
+        "error", None, "",
+        detail=("The demo is at capacity right now — give it a few seconds and "
+                "try again. " + LOCAL_CMD),
+    )
+
+
+# ---------------------------------------------------------------- verdicts
+# pushVerdict() from static/app.js, ported line for line. Same classes, same
+# headings, same rules (SCAN F3: a TAMPERED card shows the engine's ✖ line and
+# its signed/actual digest pair — never the reassuring signature line).
+
+COPY = {
+    "not_a_package": NOT_A_PACKAGE_COPY,
+    "repo_not_attested": (
+        "This repo doesn't carry a Surgeon attestation, so there's nothing to "
+        "verify against — that's a statement about provenance, not quality. "
+        "Repos published through Model Surgeon's attested push verify here."
+    ),
+}
+
+
+def _e(s):
+    return html.escape(str(s), quote=True)
+
+
+def _first_line_matching(text, needle_lower):
+    for ln in (text or "").split("\n"):
+        if needle_lower in ln.lower():
+            return ln.strip()
+    return None
+
+
+def _first_non_empty(text):
+    for ln in (text or "").split("\n"):
+        if ln.strip():
+            return ln.strip()
+    return None
+
+
+def render_card(res, source_label):
+    v = res.get("verdict")
+    if v == "verified":
+        cls, head = "v-verified", "✔ VERIFIED"
+    elif v == "tampered":
+        cls, head = "v-tampered", "✘ TAMPERED"
+    elif v == "not_a_package":
+        cls, head = "v-amber", "NOT A SURGEON PACKAGE"
+    elif v == "repo_not_attested":
+        cls, head = "v-amber", "REPO NOT ATTESTED"
+    else:
+        cls, head = "v-error", "LIMIT / ERROR"
+    parts = [f'<article class="verdict-card {cls}"><h3 class="vhead">{_e(head)}</h3>']
+    if source_label:
+        parts.append(f'<p class="vsub">{_e(source_label)}</p>')
+
+    stdout = res.get("stdout") or ""
+    if v == "verified":
+        if res.get("keyid"):
+            parts.append(
+                '<p class="vline"><span class="keyid"><span>'
+                + _e(res["keyid"])
+                + '</span></span><span class="kcaption">pin this to know who signed</span></p>'
+            )
+        fc = res.get("files_checked")
+        if fc is not None:
+            parts.append(f'<p class="vline">{_e(fc)} files checked</p>')
+        att = _first_line_matching(stdout, "attestation")
+        if att:
+            parts.append(f'<p class="vline">{_e(att)}</p>')
+
+    if v == "tampered":
+        fail = [ln.strip() for ln in stdout.split("\n")
+                if ln.lstrip().startswith(("✖", "signed ", "actual "))]
+        if not fail:
+            fail = [_first_non_empty(stdout)]
+        for ln in fail:
+            if ln:
+                parts.append(f'<p class="vline vfail">{_e(ln)}</p>')
+
+    detail = res.get("detail") or COPY.get(v, "")
+    if detail:
+        parts.append(f'<p class="vdetail">{_e(detail)}</p>')
+
+    if stdout.strip():
+        parts.append(
+            '<details class="receipt"><summary>show the receipt</summary><pre>'
+            + _e(stdout) + "</pre></details>"
+        )
+    parts.append("</article>")
+    return "".join(parts)
+
+
+def render_stack(stack):
+    if not stack:
+        return '<div id="verdictStack"></div>'
+    return '<div id="verdictStack">' + "".join(stack) + "</div>"
+
+
+def _push(stack, res, source_label):
+    stack = [render_card(res, source_label)] + list(stack or [])
+    return stack[:STACK_MAX]
+
+
+# ---------------------------------------------------------------- handlers
+# Each returns (new_stack_state, rendered_html). Every path releases its slot
+# and deletes its temp dir in `finally` (SPEC 1.3).
+
+def _samples():
+    return json.loads(MANIFEST.read_text()) if MANIFEST.exists() else []
+
+
+def verify_sample(sample_id, stack, progress=gr.Progress()):
+    if not _slots.acquire(blocking=False):
+        s = _push(stack, _busy_result(), sample_id)
+        return s, render_stack(s)
+    try:
+        progress(0, desc="recomputing digests…")
+        entry = next((e for e in _samples() if e.get("id") == sample_id), None)
+        if entry is None:
+            res = _result("error", None, "", detail="Unknown sample id.")
+        else:
+            sample_path = SAMPLES_DIR / Path(entry["filename"]).name
+            if not sample_path.exists():
+                res = _result("error", None, "", detail=(
+                    "This sample package hasn't been installed on the Space yet. "
+                    + LOCAL_CMD))
+            else:
+                # Server-side copy only — the file never round-trips through
+                # the browser.
+                res = _run_engine_sync(sample_path)
+        s = _push(stack, res, entry["label"] if entry else sample_id)
+        return s, render_stack(s)
+    finally:
+        _slots.release()
+
+
+def verify_upload(file_path, stack, progress=gr.Progress()):
+    if not file_path:
+        return stack, render_stack(stack)
+    label = Path(file_path).name
+    if not _slots.acquire(blocking=False):
+        s = _push(stack, _busy_result(), label)
+        return s, render_stack(s)
+    tmp = tempfile.mkdtemp(prefix="verify-")
+    try:
+        progress(0, desc="recomputing digests…")
+        # Gradio has already streamed the upload to its cache (bounded by
+        # launch(max_file_size=…)); it is moved into our per-request dir so
+        # exactly one deletion covers everything.
+        target = Path(tmp) / "upload.bin"
+        shutil.move(file_path, target)
+        received = target.stat().st_size
+        if received > MAX_UPLOAD_BYTES:
+            res = _result("error", None, "", detail=(
+                "That file is over this demo's " + str(MAX_UPLOAD_MB)
+                + " MB upload cap. " + LOCAL_CMD))
+        elif received == 0:
+            res = _result("error", None, "", detail="No file was received. " + LOCAL_CMD)
+        else:
+            res = None
+            # Zip-bomb guard: declared uncompressed size, before any extraction.
+            if zipfile.is_zipfile(target):
+                try:
+                    if _zip_declared_size(target) > 2 * MAX_UPLOAD_BYTES:
+                        res = _result("error", None, "", detail=(
+                            "This archive declares an uncompressed size more than "
+                            "twice the " + str(MAX_UPLOAD_MB)
+                            + " MB cap, so the demo won't open it. " + LOCAL_CMD))
+                except zipfile.BadZipFile:
+                    pass  # let the engine speak for itself
+            if res is None:
+                # Any file type is accepted; the engine's own output routes
+                # non-zips and attestation-less zips to the polite
+                # not-a-package card. Windows/macOS-made zips get their
+                # container repaired first.
+                target, normalized = _normalize_container(target, tmp)
+                res = _run_engine_sync(target)
+                if normalized and isinstance(res, dict):
+                    res["detail"] = NORMALIZED_NOTE + (res.get("detail") or "")
+        s = _push(stack, res, label)
+        return s, render_stack(s)
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)          # SPEC 1.3 — nothing retained
+        try:
+            Path(file_path).unlink(missing_ok=True)      # Gradio's cached copy, if any remains
+        except Exception:
+            pass
+        _slots.release()
+
+
+def verify_repo(repo_id, stack, progress=gr.Progress()):
+    repo_id = (repo_id or "").strip()
+    if not repo_id:
+        return stack, render_stack(stack)
+    if not _slots.acquire(blocking=False):
+        s = _push(stack, _busy_result(), repo_id)
+        return s, render_stack(s)
+    tmp = tempfile.mkdtemp(prefix="verify-repo-")
+    try:
+        progress(0, desc="fetching from the Hub…")
+        if not _REPO_ID_RE.match(repo_id):
+            res = _result("error", None, "", detail=(
+                "That doesn't look like a Hugging Face repo id — the format is "
+                "owner/name. " + LOCAL_CMD))
+        else:
+            # Wall-clock: the download itself is bounded inside the resolver's
+            # hf_hub_download calls; the ✕ cancel button aborts the event.
+            res = _resolve_and_verify_repo_sync(repo_id, Path(tmp))
+        s = _push(stack, res, repo_id)
+        return s, render_stack(s)
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)          # SPEC 1.3 — nothing retained
+        _slots.release()
+
+
+# ---------------------------------------------------------------- the page
+
+def _data_uri(path, mime):
+    return f"data:{mime};base64," + base64.b64encode(Path(path).read_bytes()).decode()
+
+
+LOGO = _data_uri(ROOT / "static" / "logo.png", "image/png")
+CSS = (ROOT / "static" / "style.css").read_text(encoding="utf-8") + (ROOT / "static" / "gradio.css").read_text(encoding="utf-8")
+
+MASTHEAD = f"""
+<header class="masthead">
+  <a class="brandmark" href="https://surgeon.falcons.ai" target="_blank" rel="noopener" aria-label="FALCONS.AI">
+    <img src="{LOGO}" alt="FALCONS.AI falcon logo" width="72" height="72">
+  </a>
+  <div class="masthead-text">
+    <h1>PROVENANCE VERIFIER — LIVE DEMO</h1>
+    <p class="byline">by <span class="brand-name">FALCONS.AI</span></p>
+    <p class="sub">free for everyone · no account needed · <span class="brand">Model Surgeon</span></p>
+  </div>
+</header>"""
+
+FOOTER = """
+<footer class="footer">
+  <nav class="footlinks">
+    <a href="https://surgeon.falcons.ai/pricing">Pricing</a> ·
+    <a href="https://surgeon.falcons.ai/terms">Terms</a> ·
+    <a href="https://surgeon.falcons.ai/eu-ai-act">EU AI Act</a> ·
+    <a href="https://surgeon.falcons.ai/privacy">Privacy</a> ·
+    <a href="https://surgeon.falcons.ai">surgeon.falcons.ai</a> ·
+    <a href="https://github.com/Falcons-ai/surgeon-verify">GitHub: surgeon-verify</a>
+  </nav>
+  <p class="strapline">Signed creation is the product — universal verification is what makes it worth anything. Free, no account, forever.</p>
+</footer>"""
+
+# Force the dark theme regardless of the visitor's OS setting (the product is
+# dark only, SPEC 3) — Gradio otherwise follows prefers-color-scheme.
+FORCE_DARK_JS = """
+() => {
+  const u = new URL(window.location);
+  if (u.searchParams.get('__theme') !== 'dark') {
+    u.searchParams.set('__theme', 'dark');
+    window.location.replace(u.toString());
+  }
+}
+"""
+
+
+def build():
+    samples = _samples()
+    with gr.Blocks(title="Provenance Verifier — live demo · FALCONS.AI Model Surgeon",
+                   css=CSS, js=FORCE_DARK_JS, analytics_enabled=False,
+                   theme=gr.themes.Base(font=gr.themes.GoogleFont("IBM Plex Mono"),
+                                        font_mono=gr.themes.GoogleFont("IBM Plex Mono"))) as demo:
+        stack = gr.State([])
+        gr.HTML(MASTHEAD)
+
+        with gr.Row(elem_classes="workbench"):
+            with gr.Column(scale=1, min_width=260, elem_classes="samples"):
+                gr.HTML('<h2 class="panel-label">SAMPLE PACKAGES</h2>')
+                sample_buttons = []
+                for entry in samples:
+                    b = gr.Button(f"▤  {entry['label']}", elem_classes="sample-card")
+                    gr.HTML(f'<p class="blurb">{_e(entry["blurb"])}</p>')
+                    sample_buttons.append((b, entry["id"]))
+                gr.HTML('<p class="hint">tap a sample to verify it</p>')
+
+            with gr.Column(scale=2, elem_classes="verify"):
+                gr.HTML('<h2 class="panel-label">THE GRID</h2>')
+                grid = gr.File(label="drop any .zip of your own here — or click to choose a file",
+                               file_count="single", type="filepath",
+                               elem_id="grid", elem_classes="grid")
+                with gr.Row(elem_classes="alt-inputs"):
+                    repo = gr.Textbox(show_label=False, placeholder="owner/name — e.g. an attested Surgeon push",
+                                      elem_classes="repoinput", scale=3, max_lines=1)
+                    repo_btn = gr.Button("VERIFY", elem_classes="repobtn", scale=1)
+                    cancel_btn = gr.Button("✕ cancel", elem_classes="cancel", scale=1)
+
+        verdicts = gr.HTML(render_stack([]), elem_classes="verdicts")
+        gr.HTML(FOOTER)
+        gr.HTML(f'<p class="buildtag">build {_e(BUILD_STAMP)} · upload cap {MAX_UPLOAD_MB} MB · repo cap {MAX_REPO_MB} MB</p>')
+
+        events = []
+        for b, sid in sample_buttons:
+            events.append(b.click(verify_sample, inputs=[gr.State(sid), stack], outputs=[stack, verdicts],
+                                  concurrency_limit=MAX_CONCURRENCY))
+        events.append(grid.upload(verify_upload, inputs=[grid, stack], outputs=[stack, verdicts],
+                                  concurrency_limit=MAX_CONCURRENCY))
+        events.append(repo.submit(verify_repo, inputs=[repo, stack], outputs=[stack, verdicts],
+                                  concurrency_limit=MAX_CONCURRENCY))
+        events.append(repo_btn.click(verify_repo, inputs=[repo, stack], outputs=[stack, verdicts],
+                                     concurrency_limit=MAX_CONCURRENCY))
+        # Same behaviour as the AbortController in the old front end: the
+        # in-flight verification is dropped; nothing is recorded for it.
+        cancel_btn.click(None, None, None, cancels=events)
+    return demo
+
+
+demo = build()
+
+if __name__ == "__main__":
+    # Mounted on a bare FastAPI shell so uvicorn can run with access_log=False
+    # (SPEC 1.3: no logging of filenames, repo ids, IPs, or verdicts). The
+    # `gradio` SDK on Spaces simply runs this file; port 7860 is its contract.
+    import uvicorn
+    from fastapi import FastAPI
+    from fastapi.responses import FileResponse
+
+    shell = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)
+
+    @shell.get("/favicon.ico")
+    async def favicon():
+        return FileResponse(ROOT / "static" / "favicon.png", media_type="image/png")
+
+    demo.queue(default_concurrency_limit=MAX_CONCURRENCY)
+    app = gr.mount_gradio_app(
+        shell, demo, path="/",
+        max_file_size=f"{MAX_UPLOAD_MB}mb",       # the streamed upload cap (SPEC 4.2)
+        show_api=False,
+        delete_cache=(60, 60),                     # Gradio's cache: sweep every minute, nothing older than a minute
+    )
+    uvicorn.run(app, host="0.0.0.0", port=int(os.environ.get("PORT", "7860")), access_log=False)

engine/UPSTREAM_NOTE.md

@@ -0,0 +1,19 @@
+# Suggested upstream change (NOT applied — shipped engine is verbatim)
+
+The attestation covers file digests, so verification should be OS-agnostic.
+Today `verify_attestation.py` exits 2 ("not a Surgeon package") on archives
+re-zipped by Windows Explorer / PowerShell Compress-Archive (backslash entry
+names) and by macOS Finder (`__MACOSX/` twins + `.DS_Store` break single-root
+detection). This Space repairs the container in its wrapper before invoking
+the engine, but local `python verify_attestation.py package.zip` still fails
+on such archives.
+
+Minimal engine-side fix (route through Michael):
+
+1. normalize names once:  `names = [n.replace("\\", "/") for n in z.namelist()]`
+   and read via a map from normalized -> original name;
+2. ignore archiver junk when detecting the wrapper root and when reading:
+   any path whose first segment is `__MACOSX`, or whose leaf is `.DS_Store`,
+   `Thumbs.db`, `desktop.ini`, or starts with `._`.
+
+Digest comparison logic unchanged; junk entries are never subjects.

engine/verify_attestation.py

@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+"""
+FALCONS.AI Model Surgeon — FREE attestation verifier.
+
+Anyone can verify a Surgeon package without a subscription:
+
+    python verify_attestation.py package.zip [--key HEXKEY-OR-STRING]
+
+Checks, in order:
+  1. the package carries a lineage.intoto.jsonl attestation;
+  2. every subject artifact's SHA-256 matches the signed digest;
+  3. the DSSE HMAC signature verifies under the given key
+     (--key or FALCONSAI_HMAC_KEY; defaults to the public demo key).
+
+Exit codes: 0 VERIFIED · 1 TAMPERED/INCOMPLETE · 2 not a Surgeon package.
+Verification is free by design: signed creation is the paid act, universal
+verification is what makes the signature worth anything.
+"""
+import argparse
+import base64
+import hashlib
+import hmac
+import json
+import os
+import sys
+import zipfile
+
+# SEC-7: this script used to default to a shipped secret — which meant the
+# signing key travelled inside every exported package. Anyone holding a
+# package could mint forgeries that verified. No default now: the verifier
+# requires the key out of band, exactly like any other shared secret.
+DEFAULT_KEY = None
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("package")
+    ap.add_argument("--key", default=os.environ.get("FALCONSAI_HMAC_KEY"))
+    a = ap.parse_args()
+    try:
+        z = zipfile.ZipFile(a.package)
+    except Exception as e:
+        print(f"✖ cannot open {a.package}: {e}")
+        sys.exit(2)
+    names = z.namelist()
+    prefix = ""
+    roots = {n.split("/", 1)[0] for n in names if n.strip("/")}
+    if len(roots) == 1 and all("/" in n for n in names if n.strip("/")):
+        prefix = next(iter(roots)) + "/"   # Explorer-style re-zip: descend
+
+    def _zread(nm):
+        return z.read(prefix + nm)
+    try:
+        att = json.loads(_zread("lineage.intoto.jsonl"))
+    except KeyError:
+        print("✖ no lineage.intoto.jsonl — not a Surgeon package "
+              "(or the attestation was stripped).")
+        sys.exit(2)
+    payload = base64.b64decode(att.get("payload", ""))
+    want = (att.get("signatures") or [{}])[0].get("sig", "")
+    # SEC-1: asymmetric first — the package carries the publisher's PUBLIC
+    # key, so verification needs no secret and forgery needs the private
+    # key. Free verification, restored properly.
+    env_missing = False
+    sig_entry = (att.get("signatures") or [{}])[0] or {}
+    scheme = sig_entry.get("scheme") or "hmac"
+    if scheme == "ed25519" and sig_entry.get("publicKey"):
+        try:
+            from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+                Ed25519PublicKey)
+            Ed25519PublicKey.from_public_bytes(
+                bytes.fromhex(sig_entry["publicKey"])).verify(
+                    bytes.fromhex(want), payload)
+            have = want
+            print(f"signature   : ed25519 OK · publisher {sig_entry.get('keyid')}")
+            print("              (pin this fingerprint to establish WHO "
+                  "signed it)")
+        except ImportError:
+            # A missing library is an ENVIRONMENT problem, not evidence of
+            # tampering — say so, keep checking digests, verdict INCOMPLETE.
+            have = None
+            env_missing = True
+            print("signature   : cannot check — install the 'cryptography' "
+                  "package (pip install cryptography) to verify ed25519")
+        except Exception as e:
+            have = None
+            print(f"signature   : ed25519 INVALID ({e})")
+    elif a.key:
+        have = hmac.new(a.key.encode(), payload, hashlib.sha256).hexdigest()
+        print("signature   : legacy shared-key (hmac) — anyone with the "
+              "key could have produced this package")
+    else:
+        have = None
+        print("signature   : legacy shared-key package; supply --key or "
+              "FALCONSAI_HMAC_KEY to check it (digests still verified)")
+    sig_ok = hmac.compare_digest(want, have)
+    stmt = json.loads(payload)
+    print(f"attestation : {stmt.get('predicateType')}")
+    print(f"tool        : {(stmt.get('predicate') or {}).get('tool')}")
+    all_ok = True
+    for sub in stmt.get("subject", []):
+        nm, digest = sub["name"], sub["digest"]["sha256"]
+        try:
+            actual = hashlib.sha256(_zread(nm)).hexdigest()
+            ok = actual == digest
+        except KeyError:
+            actual, ok = "<missing from zip>", False
+        except Exception:
+            # e.g. the archive's own CRC rejects the entry — the byte-flip
+            # case. Corruption is tampering evidence, not a crash.
+            actual, ok = "<unreadable — fails the archive's own checksum>", False
+        all_ok &= ok
+        print(f"  {'✔' if ok else '✖'} {nm}")
+        if not ok:
+            print(f"      signed  {digest}\n      actual  {actual}")
+    print(f"signature   : {'✔ valid under this key' if sig_ok else '✖ does NOT verify under this key'}")
+    merges = (stmt.get("predicate") or {}).get("merges") or []
+    if merges:
+        print(f"merges      : {len(merges)} recorded "
+              f"({', '.join(sorted({m.get('method','lerp') for m in merges}))})")
+    verdict = "VERIFIED" if sig_ok and all_ok and stmt.get("subject") \
+        else "INCOMPLETE" if (env_missing and all_ok) \
+        else "TAMPERED" if stmt.get("subject") else "INCOMPLETE"
+    print(f"\nVERDICT: {verdict}")
+    sys.exit(0 if verdict == "VERIFIED" else 1)
+
+
+if __name__ == "__main__":
+    main()

engine_wrapper.py

@@ -0,0 +1,496 @@
+"""
+FALCONS.AI "Verify Anything" — engine wrapper (transport-independent).
+
+Every function below is the FastAPI-era code, moved VERBATIM out of app.py so
+the Gradio app and any future transport call exactly the same logic. The
+standing rules (BUILD SPEC section 1) live here:
+  1. The engine is invoked ONLY as a subprocess. Never ported/patched/inlined.
+  2. No model-parsing code of any kind in this Space.
+  3. Nothing retained: callers use per-request temp dirs, deleted in `finally`.
+  4. A missing capability is never reported as tampering.
+  5. Weights are never re-served.
+"""
+
+import base64
+import fnmatch
+import json
+import os
+import re
+import subprocess
+import sys
+import zipfile
+from pathlib import Path
+
+# ---------------------------------------------------------------- constants
+
+ROOT = Path(__file__).resolve().parent
+ENGINE = ROOT / "engine" / "verify_attestation.py"
+SAMPLES_DIR = ROOT / "samples"
+MANIFEST = SAMPLES_DIR / "manifest.json"
+
+MAX_UPLOAD_MB = int(os.environ.get("MAX_UPLOAD_MB", "1024"))
+MAX_REPO_MB = int(os.environ.get("MAX_REPO_MB", "2048"))
+MAX_UPLOAD_BYTES = MAX_UPLOAD_MB * 1024 * 1024
+MAX_REPO_BYTES = MAX_REPO_MB * 1024 * 1024
+
+ENGINE_TIMEOUT_S = 120
+DOWNLOAD_TIMEOUT_S = 300
+MAX_CONCURRENCY = 4
+
+# SPEC 5 — appended verbatim to every error state.
+LOCAL_CMD = (
+    "You can always verify locally: python verify_attestation.py package.zip "
+    "— github.com/Falcons-ai/surgeon-verify"
+)
+
+NOT_A_PACKAGE_COPY = (
+    "This doesn't look like a Surgeon package — no signed attestation inside. "
+    "Not an error, just not something this tool can vouch for. Export any "
+    "model from Model Surgeon and drop it here, or try the two samples."
+)
+
+# SPEC 4.3.c — attestation filename patterns at repo root.
+# TODO(SPEC 6.2): confirm the exact filename against the product fixture repo
+# before enabling this path in production; patterns below follow the spec.
+# Pinned per the shipped engine: it looks for exactly this name (SPEC 6.2).
+ATTESTATION_PATTERNS = ("lineage.intoto.jsonl",)
+
+# Bumped on every delivered build so a running instance is identifiable.
+BUILD_STAMP = "2026-09-03.1-gradio"
+
+# ---------------------------------------------------------------- helpers
+
+
+def _result(verdict, exit_code, stdout, keyid=None, files_checked=None, detail=""):
+    """Common response shape (SPEC 4). Never invent fields the engine
+    didn't print."""
+    return {
+        "verdict": verdict,
+        "exit_code": exit_code,
+        "stdout": stdout,
+        "keyid": keyid,
+        "files_checked": files_checked,
+        "detail": detail,
+    }
+
+
+# Defensive stdout parsing. If these miss, fields stay null and the raw
+# stdout still shows — the engine's own words are always the receipt.
+_KEYID_RE = re.compile(
+    r"publisher\s+(\S+)"
+)
+# fallback for older engine builds that print "keyid: ..."
+_KEYID_FALLBACK_RE = re.compile(
+    r"key\s*[- ]?id\s*[:=]?\s*([0-9a-zA-Z:._-]{8,})"
+)
+_FILES_RE = re.compile(
+    r"(\d+)\s+files?\s+(?:checked|verified|ok|passed)", re.I
+)
+_SUBJECT_LINE_RE = re.compile(r"^\s*[\u2714\u2716]\s+\S", re.M)
+
+
+def _parse_stdout(stdout):
+    """Best-effort keyid / files_checked from engine stdout (SPEC 4.5).
+    Null when absent — never invented."""
+    keyid = None
+    m = _KEYID_RE.search(stdout)
+    if not m:
+        m = _KEYID_FALLBACK_RE.search(stdout)
+    if m:
+        keyid = m.group(1)
+    files_checked = None
+    m = _FILES_RE.search(stdout)
+    if m:
+        files_checked = int(m.group(1))
+    else:
+        n = len(_SUBJECT_LINE_RE.findall(stdout))
+        if n:
+            files_checked = n
+    return keyid, files_checked
+
+
+def _run_engine_sync(target):
+    """Invoke the pinned engine as a subprocess (SPEC 4, all paths)."""
+    try:
+        proc = subprocess.run(
+            [sys.executable, str(ENGINE), str(target)],
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            timeout=ENGINE_TIMEOUT_S,
+        )
+    except subprocess.TimeoutExpired:
+        return _result(
+            "error",
+            None,
+            "",
+            detail=(
+                "Verification timed out after "
+                + str(ENGINE_TIMEOUT_S)
+                + " s. "
+                + LOCAL_CMD
+            ),
+        )
+
+    stdout = (proc.stdout or "") + (("\n" + proc.stderr) if proc.stderr else "")
+    keyid, files_checked = _parse_stdout(proc.stdout or "")
+
+    if proc.returncode == 0:
+        return _result("verified", 0, stdout, keyid, files_checked)
+    if proc.returncode == 1:
+        if "VERDICT:" not in (proc.stdout or ""):
+            # SCAN F2: the engine crashed before reaching a verdict (e.g. the
+            # legacy-no-key path raises TypeError at the signature compare).
+            # A crash is OUR bug — never evidence about the user's package,
+            # and never rendered as TAMPERED (SPEC 1.4).
+            if "legacy shared-key" in (proc.stdout or ""):
+                _d = ("This is an older shared-key Surgeon package — the demo "
+                      "can't check its signature without the key. Not evidence "
+                      "of tampering. " + LOCAL_CMD +
+                      " (add --key or FALCONSAI_HMAC_KEY)")
+            else:
+                _d = ("The verifier itself hit a bug on this input — that's "
+                      "on our side, not evidence about your package. "
+                      + LOCAL_CMD)
+            return _result("error", 1, stdout, keyid, files_checked, _d)
+        if "VERDICT: INCOMPLETE" in (proc.stdout or ""):
+            return _result(
+                "error", 1, stdout, keyid, files_checked,
+                detail=(
+                    "The engine could not fully establish the signature in "
+                    "this environment (verdict INCOMPLETE). That is a missing "
+                    "capability, not evidence of tampering. " + LOCAL_CMD
+                ),
+            )
+        return _result("tampered", 1, stdout, keyid, files_checked)
+
+    # Any other exit: classify by the engine's own words (SPEC 4). A missing
+    # capability is never reported as tampering (SPEC 1.4).
+    lower = (proc.stdout or "").lower() + (proc.stderr or "").lower()
+    package_signals = (
+        "no signed attestation",
+        "no attestation",
+        "attestation missing",
+        "missing attestation",
+        "not a zip",
+        "bad zip",
+        "not a valid",
+        "not a package",
+        "not a surgeon package",
+        "no lineage.intoto.jsonl",
+        "cannot open",
+    )
+    if any(sig in lower for sig in package_signals):
+        return _result(
+            "not_a_package", proc.returncode, stdout, keyid, files_checked,
+            NOT_A_PACKAGE_COPY,
+        )
+    return _result(
+        "error", proc.returncode, stdout, keyid, files_checked,
+        "The verifier couldn't process this input. " + LOCAL_CMD,
+    )
+
+
+def _junk_entry(name):
+    """Archiver metadata that no OS's archive tool should make load-bearing:
+    macOS Finder resource forks and .DS_Store, Windows Thumbs.db /
+    desktop.ini. Matched per path segment, case-insensitively."""
+    parts = [seg.lower() for seg in name.replace("\\", "/").split("/") if seg]
+    if not parts:
+        return True
+    if parts[0] == "__macosx":
+        return True
+    leaf = parts[-1]
+    return leaf in (".ds_store", "thumbs.db", "desktop.ini") or leaf.startswith("._")
+
+
+def _normalize_container(path, workdir):
+    r"""Canonicalize a zip CONTAINER before handing it to the engine, so the
+    verdict is OS-agnostic (SPEC intent: the signature covers file digests,
+    not the archiver's packaging quirks).
+
+    Repairs exactly two classes of archiver quirk:
+      * Windows (Explorer / Compress-Archive): backslash entry names,
+        which the ZIP APPNOTE forbids;
+      * macOS (Finder "Compress"): __MACOSX/ resource-fork twins and
+        .DS_Store entries, which break single-root detection.
+
+    Entry NAMES are rewritten (\ -> /) and junk entries dropped; every
+    remaining content byte is copied exactly as stored, CRC checks bypassed
+    so corrupted (tampered) bytes still reach the engine's own digest
+    comparison. On any doubt (name collision, unreadable container) the
+    original file is returned untouched and the engine speaks for itself.
+    Never touches package content (SPEC 1.1 / 1.2).
+    """
+    try:
+        if not zipfile.is_zipfile(path):
+            return path, False
+        src = zipfile.ZipFile(path)
+        names = src.namelist()
+        needs = any("\\" in n for n in names) or any(_junk_entry(n) for n in names)
+        if not needs:
+            return path, False
+        mapped = {}
+        for info in src.infolist():
+            new = info.filename.replace("\\", "/")
+            if new.endswith("/") or _junk_entry(new):
+                continue
+            if new in mapped:
+                return path, False  # collision -- refuse to guess
+            mapped[new] = info
+        if not mapped:
+            return path, False
+        fixed = Path(workdir) / "normalized.zip"
+        with zipfile.ZipFile(fixed, "w", zipfile.ZIP_DEFLATED) as out:
+            for new, info in mapped.items():
+                f = src.open(info)
+                f._expected_crc = None  # deliver bytes even if the CRC is broken
+                out.writestr(new, f.read())
+        return fixed, True
+    except Exception:
+        return path, False
+
+
+NORMALIZED_NOTE = (
+    "Note: the demo repaired this archive's container before verification "
+    "(archiver quirks such as Windows path separators or macOS metadata "
+    "entries) -- package contents untouched. "
+)
+
+
+def _zip_declared_size(path):
+    """Sum of declared uncompressed sizes (zip-bomb guard, SPEC 4.2).
+    Reads only the central directory — no member is extracted here."""
+    with zipfile.ZipFile(path) as zf:
+        return sum(i.file_size for i in zf.infolist())
+
+
+_REPO_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._\-]*/[A-Za-z0-9._\-]+$")
+
+
+def _resolve_and_verify_repo_sync(repo_id, workdir):
+    """SPEC 4.3 resolver. Runs in a worker thread; wall-clock capped by
+    the caller."""
+    from huggingface_hub import HfApi, hf_hub_download
+    from huggingface_hub.errors import GatedRepoError, RepositoryNotFoundError
+
+    token = os.environ.get("HF_TOKEN") or None
+    api = HfApi(token=token)
+
+    tree = None
+    repo_type = None
+    last_err = None
+    for rt in ("model", "dataset"):
+        try:
+            tree = list(
+                api.list_repo_tree(repo_id, repo_type=rt, recursive=True)
+            )
+            repo_type = rt
+            break
+        except GatedRepoError:
+            return _result(
+                "error",
+                None,
+                "",
+                detail=(
+                    "this demo verifies public repos — run the verifier "
+                    "locally on files you have access to. " + LOCAL_CMD
+                ),
+            )
+        except RepositoryNotFoundError as e:
+            last_err = e
+            continue
+        except Exception as e:  # network etc.
+            last_err = e
+            tree = None
+            break
+
+    if tree is None:
+        if isinstance(last_err, RepositoryNotFoundError):
+            # Private repos also surface as not-found when anonymous.
+            return _result(
+                "error",
+                None,
+                "",
+                detail=(
+                    "Couldn't find that repo on the Hub. If it's private or "
+                    "gated: this demo verifies public repos — run the "
+                    "verifier locally on files you have access to. "
+                    + LOCAL_CMD
+                ),
+            )
+        return _result(
+            "error",
+            None,
+            "",
+            detail=(
+                "Couldn't reach the Hugging Face Hub for this repo. "
+                + LOCAL_CMD
+            ),
+        )
+
+    files = [t for t in tree if getattr(t, "size", None) is not None]
+    names = [t.path for t in files]
+    sizes = {t.path: t.size for t in files}
+
+    def _download(fname):
+        p = hf_hub_download(
+            repo_id=repo_id,
+            filename=fname,
+            repo_type=repo_type,
+            local_dir=workdir,
+            token=token,
+        )
+        return Path(p)
+
+    # ---- SPEC 4.3.b — exactly one *.zip in the repo → verify as a package
+    zips = [n for n in names if n.lower().endswith(".zip")]
+    if len(zips) == 1:
+        zname = zips[0]
+        if sizes.get(zname, 0) > MAX_UPLOAD_BYTES:
+            return _result(
+                "error",
+                None,
+                "",
+                detail=(
+                    "The package in this repo is over the "
+                    + str(MAX_UPLOAD_MB)
+                    + " MB demo cap. "
+                    + LOCAL_CMD
+                ),
+            )
+        try:
+            zpath = _download(zname)
+        except Exception:
+            return _result(
+                "error",
+                None,
+                "",
+                detail=(
+                    "Downloading the package from the Hub failed. "
+                    + LOCAL_CMD
+                ),
+            )
+        zpath, normalized = _normalize_container(zpath, workdir)
+        result = _run_engine_sync(zpath)
+        if normalized and isinstance(result, dict):
+            result["detail"] = NORMALIZED_NOTE + (result.get("detail") or "")
+        return result
+
+    # ---- SPEC 4.3.c — DSSE attestation at repo root → subjects-only verify
+    root_files = [n for n in names if "/" not in n]
+    att_name = None
+    for n in root_files:
+        if any(fnmatch.fnmatch(n, pat) for pat in ATTESTATION_PATTERNS):
+            att_name = n
+            break
+    if att_name:
+        try:
+            att_path = _download(att_name)
+            subjects = _dsse_subject_names(att_path)
+        except Exception:
+            return _result(
+                "error",
+                None,
+                "",
+                detail=(
+                    "Found an attestation file in this repo but couldn't "
+                    "fetch or read it. " + LOCAL_CMD
+                ),
+            )
+
+        # Download only the files the attestation names as subjects
+        # (SPEC 4.3.c).
+        total = 0
+        for s in subjects:
+            if s not in sizes:
+                # Missing subject: nothing to download — the engine will
+                # flag it, and a missing subject IS tampered (SPEC 4.3.c).
+                continue
+            if sizes[s] > MAX_UPLOAD_BYTES:
+                return _result(
+                    "error",
+                    None,
+                    "",
+                    detail=(
+                        "A file named by the attestation is over the "
+                        + str(MAX_UPLOAD_MB)
+                        + " MB per-file demo cap. "
+                        + LOCAL_CMD
+                    ),
+                )
+            total += sizes[s]
+            if total > MAX_REPO_BYTES:
+                return _result(
+                    "error",
+                    None,
+                    "",
+                    detail=(
+                        "The attested files in this repo total more than "
+                        "the "
+                        + str(MAX_REPO_MB)
+                        + " MB demo cap. "
+                        + LOCAL_CMD
+                    ),
+                )
+            try:
+                _download(s)
+            except Exception:
+                # Leave it absent; the engine decides what that means.
+                pass
+
+        # Hub-added files not named by the attestation: informational only,
+        # never TAMPERED (SPEC 4.3.c).
+        uncovered = [n for n in names if n not in subjects and n != att_name]
+
+        # SCAN F1: the engine verifies ZIP packages only (a directory input
+        # exits 2 "cannot open"). Package the attestation + downloaded
+        # subjects into a canonical zip; a subject missing from the repo is
+        # simply absent, and the engine's own "<missing from zip>" makes
+        # that TAMPERED — exactly SPEC 4.3.c.
+        pkg = Path(workdir) / "__attested_package.zip"
+        with zipfile.ZipFile(pkg, "w", zipfile.ZIP_DEFLATED) as zf:
+            zf.write(att_path, att_name)
+            for s in subjects:
+                sp = Path(workdir) / s
+                if sp.is_file():
+                    zf.write(sp, s)
+        res = _run_engine_sync(pkg)
+        if uncovered:
+            note = (
+                "present but not covered by the attestation: "
+                + ", ".join(sorted(uncovered))
+            )
+            res["detail"] = (
+                (res["detail"] + " · ") if res["detail"] else ""
+            ) + note
+        return res
+
+    # ---- SPEC 4.3.d — nothing to verify against
+    return _result(
+        "repo_not_attested",
+        None,
+        "",
+        detail=(
+            "This repo doesn't carry a Surgeon attestation, so there's "
+            "nothing to verify against — that's a statement about "
+            "provenance, not quality. Repos published through Model "
+            "Surgeon's attested push verify here."
+        ),
+    )
+
+
+def _dsse_subject_names(att_path):
+    """Read subject filenames out of a DSSE envelope (or a bare in-toto
+    statement). This is JSON metadata only — no model content is parsed."""
+    data = json.loads(att_path.read_text())
+    if isinstance(data, dict) and "payload" in data:
+        payload = base64.b64decode(data["payload"])
+        data = json.loads(payload)
+    subjects = data.get("subject", []) if isinstance(data, dict) else []
+    return [
+        s.get("name")
+        for s in subjects
+        if isinstance(s, dict) and s.get("name")
+    ]

requirements.txt

@@ -0,0 +1,5 @@
+gradio>=4.44,<6
+fastapi
+uvicorn
+cryptography
+huggingface_hub

samples/SAMPLE_A.zip

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:4f9937e98d912ae6ab6608a46d2ee74684fbabc69edf016edea01cd8cd6448c8
+size 654865

samples/SAMPLE_B.zip

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:3a5abb2b6e511ba4257db3c8efde187993f6184512e6389e9426e7f319fafc12
+size 654865

samples/manifest.json

@@ -0,0 +1,14 @@
+[
+  {
+    "id": "SAMPLE_A",
+    "filename": "SAMPLE_A.zip",
+    "label": "SAMPLE_A",
+    "blurb": "a genuine Surgeon export — the model artifacts' SHA-256 signed"
+  },
+  {
+    "id": "SAMPLE_B",
+    "filename": "SAMPLE_B.zip",
+    "label": "SAMPLE_B",
+    "blurb": "the same package with one byte changed — watch it fail"
+  }
+]

static/fonts/PLACE_FONTS_HERE.md

@@ -0,0 +1,11 @@
+# Self-hosted fonts (blocker: no CDN allowed, SPEC 2/3)
+
+Drop the following files here before publish (from the IBM Plex release,
+OFL-1.1 licensed — include the license file):
+
+- IBMPlexMono-Regular.woff2
+- IBMPlexMono-Medium.woff2
+- OFL.txt
+
+Until then the CSS falls back to the system monospace stack, so nothing
+breaks — it just isn't pixel-faithful to the product yet.

static/gradio.css

@@ -0,0 +1,75 @@
+
+/* ---------- Gradio transport overrides (V-Kali, 2026-09-03) ----------
+   Everything above is the product stylesheet, untouched. Below: the few
+   rules that make Gradio's own wrappers disappear behind it. */
+.gradio-container, .gradio-container .main, body, .dark {
+  background: var(--bg) !important; color: var(--ink) !important;
+  font-family: var(--mono) !important; max-width: none !important;
+}
+.gradio-container .block, .gradio-container .form, .gradio-container .gap {
+  background: transparent !important; border: none !important; box-shadow: none !important; padding: 0 !important;
+}
+.gradio-container .prose, .gradio-container .prose * { color: inherit; }
+footer.svelte-1rjryqp, .gradio-container > .main > .wrap > footer { display: none !important; }   /* Gradio's own footer */
+
+/* workbench = the two-column grid from the product page */
+.workbench { max-width: 1080px; margin: 0 auto; padding: 24px 20px; gap: 24px; }
+.workbench > .column { gap: 8px; }
+
+/* sample cards: the product's card look on a Gradio button */
+button.sample-card {
+  justify-content: flex-start; text-align: left;
+  border: 1px solid var(--line) !important; background: var(--panel) !important; color: var(--ink) !important;
+  border-radius: 8px !important; padding: 14px !important; margin: 0 !important;
+  font-family: var(--mono) !important; font-weight: 500 !important; letter-spacing: .06em; min-height: 44px;
+  cursor: pointer;
+}
+button.sample-card:hover, button.sample-card:focus-visible { border-color: var(--cyan) !important; }
+.samples .blurb { margin: 0 0 8px; color: var(--dim); font-size: 13px; }
+
+/* the grid: Gradio's file drop zone wearing the product's grid */
+#grid, #grid .wrap, #grid .file-preview, #grid label { min-height: 220px; }
+#grid {
+  border: 1px dashed var(--line) !important; border-radius: 10px !important;
+  background:
+    linear-gradient(var(--line) 1px, transparent 1px) 0 0 / 32px 32px,
+    linear-gradient(90deg, var(--line) 1px, transparent 1px) 0 0 / 32px 32px,
+    var(--panel) !important;
+}
+#grid .wrap { color: var(--dim); font-family: var(--mono); }
+#grid .wrap .icon-wrap, #grid .wrap svg { color: var(--cyan); }
+#grid.dragging, #grid .wrap.dragging, #grid:has(.dragging) {
+  border-color: var(--mint) !important;
+  box-shadow: 0 0 0 1px var(--mint), inset 0 0 24px rgba(124, 247, 196, 0.25);
+}
+#grid label > span, #grid .label-wrap { color: var(--dim); font-family: var(--mono); font-size: 13px; }
+
+/* alt inputs: repo form + cancel */
+.alt-inputs { margin-top: 14px; gap: 8px; align-items: stretch; }
+.alt-inputs .repoinput textarea, .alt-inputs .repoinput input {
+  background: var(--panel) !important; border: 1px solid var(--line) !important; color: var(--ink) !important;
+  font-family: var(--mono) !important; font-size: 14px !important; border-radius: 6px !important; min-height: 44px;
+}
+.alt-inputs .repoinput textarea:focus { border-color: var(--cyan) !important; box-shadow: none !important; }
+button.repobtn {
+  background: var(--cyan) !important; color: #04222B !important; border: none !important;
+  font-family: var(--mono) !important; font-weight: 500 !important; letter-spacing: .08em; border-radius: 6px !important; min-height: 44px;
+}
+button.repobtn:hover { filter: brightness(1.1); }
+button.cancel {
+  background: none !important; border: 1px solid var(--line) !important; color: var(--dim) !important;
+  font-family: var(--mono) !important; border-radius: 6px !important; min-height: 44px;
+}
+button.cancel:hover { border-color: var(--red) !important; color: var(--red) !important; }
+
+/* verdict stack */
+.verdicts { max-width: 1080px; margin: 0 auto; padding: 0 20px 24px; }
+.verdicts .vfail { color: var(--red); }
+
+/* progress text ("recomputing digests…" / "fetching from the Hub…") in product colours */
+.gradio-container .progress-text, .gradio-container .meta-text, .gradio-container .eta-bar { color: var(--dim) !important; font-family: var(--mono) !important; }
+
+@media (max-width: 720px) {
+  .workbench { padding: 16px 12px; }
+  #grid, #grid .wrap { min-height: 160px; }
+}

static/style.css

@@ -0,0 +1,300 @@
+/* FALCONS.AI Verify Anything — theme tokens copied from the product legal
+   pages (SPEC 3). Dark only. */
+
+@font-face {
+  font-family: "IBM Plex Mono";
+  src: url("/static/fonts/IBMPlexMono-Regular.woff2") format("woff2");
+  font-weight: 400;
+  font-display: swap;
+}
+@font-face {
+  font-family: "IBM Plex Mono";
+  src: url("/static/fonts/IBMPlexMono-Medium.woff2") format("woff2");
+  font-weight: 500;
+  font-display: swap;
+}
+
+:root {
+  --bg: #070B14;
+  --ink: #E8F0FF;
+  --dim: #8FA3C0;
+  --cyan: #33E0FF;
+  --mint: #7CF7C4;
+  --line: #22304A;
+  --red: #FF5D6C;
+  --red-dim: #5A1F2A;
+  --amber: #FFC46B;
+  --panel: #0A1120;
+  --mono: "IBM Plex Mono", ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+}
+
+* { box-sizing: border-box; }
+
+html, body {
+  margin: 0;
+  background: var(--bg);
+  color: var(--ink);
+  font-family: var(--mono);
+  font-size: 15px;
+  line-height: 1.5;
+}
+
+a { color: var(--cyan); text-decoration: none; }
+a:hover, a:focus-visible { text-decoration: underline; }
+:focus-visible { outline: 2px solid var(--cyan); outline-offset: 2px; }
+
+.visually-hidden {
+  position: absolute; width: 1px; height: 1px;
+  clip: rect(0 0 0 0); overflow: hidden; white-space: nowrap;
+}
+
+/* ---------- masthead ---------- */
+.masthead {
+  padding: 28px 20px 18px;
+  border-bottom: 1px solid var(--line);
+}
+.masthead h1 {
+  margin: 0;
+  font-size: 20px;
+  font-weight: 500;
+  letter-spacing: 0.08em;
+}
+.masthead .sub { margin: 6px 0 0; color: var(--dim); font-size: 13px; }
+.masthead .brand { color: var(--cyan); }
+
+/* ---------- workbench ---------- */
+.workbench {
+  display: grid;
+  grid-template-columns: minmax(260px, 340px) 1fr;
+  gap: 24px;
+  padding: 24px 20px;
+  max-width: 1080px;
+  margin: 0 auto;
+}
+.panel-label {
+  margin: 0 0 12px;
+  font-size: 12px;
+  font-weight: 500;
+  letter-spacing: 0.14em;
+  color: var(--dim);
+}
+
+/* sample cards */
+.sample-card {
+  border: 1px solid var(--line);
+  background: var(--panel);
+  border-radius: 8px;
+  padding: 14px;
+  margin-bottom: 12px;
+  cursor: grab;
+  user-select: none;
+  -webkit-user-select: none;
+  transition: border-color 120ms ease;
+  min-height: 44px;
+}
+.sample-card:hover, .sample-card:focus-visible { border-color: var(--cyan); }
+.sample-card:active { cursor: grabbing; }
+.sample-card.dragging { opacity: 0.5; }
+.sample-card .card-title {
+  display: flex; align-items: center; gap: 8px;
+  font-weight: 500; letter-spacing: 0.06em;
+}
+.sample-card .glyph { color: var(--cyan); }
+.sample-card .blurb { margin: 6px 0 0; color: var(--dim); font-size: 13px; }
+.samples .hint { color: var(--dim); font-size: 12px; margin: 4px 0 0; }
+
+/* the grid */
+.grid {
+  position: relative;
+  border: 1px dashed var(--line);
+  border-radius: 10px;
+  background:
+    linear-gradient(var(--line) 1px, transparent 1px) 0 0 / 32px 32px,
+    linear-gradient(90deg, var(--line) 1px, transparent 1px) 0 0 / 32px 32px,
+    var(--panel);
+  min-height: 220px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  text-align: center;
+  padding: 20px;
+  transition: border-color 120ms ease, box-shadow 120ms ease;
+}
+.grid.dragover {
+  border-color: var(--mint);
+  box-shadow: 0 0 0 1px var(--mint), inset 0 0 24px rgba(124, 247, 196, 0.25);
+}
+.grid-idle p { color: var(--dim); margin: 8px 0 0; }
+.grid-glyph { font-size: 28px; color: var(--cyan); }
+
+.grid-busy p { margin: 8px 0 12px; }
+.scanline {
+  width: 180px; height: 3px; margin: 0 auto;
+  background: linear-gradient(90deg, transparent, var(--cyan), transparent);
+  animation: scan 1.1s linear infinite;
+  border-radius: 2px;
+}
+@keyframes scan {
+  0% { transform: translateX(-40px); opacity: 0.4; }
+  50% { transform: translateX(40px); opacity: 1; }
+  100% { transform: translateX(-40px); opacity: 0.4; }
+}
+@media (prefers-reduced-motion: reduce) {
+  .scanline { animation: none; }
+}
+.cancel {
+  background: none;
+  border: 1px solid var(--line);
+  color: var(--dim);
+  font-family: var(--mono);
+  font-size: 13px;
+  border-radius: 6px;
+  padding: 10px 16px;
+  min-height: 44px;
+  cursor: pointer;
+}
+.cancel:hover { border-color: var(--red); color: var(--red); }
+
+/* alt inputs */
+.alt-inputs { margin-top: 14px; display: flex; flex-wrap: wrap; gap: 12px; align-items: center; }
+.filebtn span {
+  display: inline-flex; align-items: center;
+  border: 1px solid var(--line);
+  background: var(--panel);
+  color: var(--ink);
+  border-radius: 6px;
+  padding: 10px 16px;
+  min-height: 44px;
+  cursor: pointer;
+}
+.filebtn span:hover { border-color: var(--cyan); }
+.repoform { display: flex; gap: 8px; flex: 1; min-width: 260px; }
+.repoform input {
+  flex: 1;
+  min-width: 0;
+  background: var(--panel);
+  border: 1px solid var(--line);
+  color: var(--ink);
+  font-family: var(--mono);
+  font-size: 14px;
+  border-radius: 6px;
+  padding: 10px 12px;
+  min-height: 44px;
+}
+.repoform input::placeholder { color: var(--dim); opacity: 0.8; }
+.repoform input:focus { border-color: var(--cyan); outline: none; }
+.repoform button {
+  background: var(--cyan);
+  color: #04222B;
+  border: none;
+  font-family: var(--mono);
+  font-weight: 500;
+  letter-spacing: 0.08em;
+  border-radius: 6px;
+  padding: 10px 18px;
+  min-height: 44px;
+  cursor: pointer;
+}
+.repoform button:hover { filter: brightness(1.1); }
+button:disabled, input:disabled, .filebtn.disabled span, .sample-card.disabled {
+  opacity: 0.45; pointer-events: none;
+}
+
+/* ---------- verdicts ---------- */
+.verdicts { max-width: 1080px; margin: 0 auto; padding: 0 20px 24px; }
+.verdict-card {
+  border: 1px solid var(--line);
+  border-left-width: 4px;
+  border-radius: 8px;
+  background: var(--panel);
+  padding: 16px;
+  margin-bottom: 12px;
+}
+.verdict-card .vhead {
+  font-size: 16px;
+  font-weight: 500;
+  letter-spacing: 0.06em;
+  margin: 0 0 8px;
+}
+.verdict-card .vsub { color: var(--dim); font-size: 12px; margin: 0 0 8px; overflow-wrap: anywhere; }
+.verdict-card .vline { margin: 4px 0; font-size: 14px; overflow-wrap: anywhere; }
+.verdict-card .vdetail { font-size: 14px; margin: 8px 0 0; overflow-wrap: anywhere; }
+
+.v-verified { border-left-color: var(--mint); }
+.v-verified .vhead { color: var(--mint); }
+.v-tampered {
+  border-left-color: var(--red);
+  background: linear-gradient(0deg, rgba(90,31,42,.25), rgba(90,31,42,.25)), var(--panel);
+}
+.v-tampered .vhead { color: var(--red); }
+.v-amber { border-left-color: var(--amber); }
+.v-amber .vhead { color: var(--amber); }
+.v-error { border-left-color: var(--dim); }
+.v-error .vhead { color: var(--dim); }
+
+.keyid {
+  display: inline-flex; align-items: center; gap: 8px;
+  background: #060A12;
+  border: 1px solid var(--line);
+  border-radius: 6px;
+  padding: 4px 8px;
+  font-size: 13px;
+}
+.keyid button {
+  background: none; border: none; color: var(--cyan);
+  font-family: var(--mono); font-size: 12px; cursor: pointer; padding: 4px;
+}
+.kcaption { color: var(--dim); font-size: 12px; margin-left: 8px; }
+
+details.receipt { margin-top: 10px; }
+details.receipt summary {
+  color: var(--cyan); font-size: 13px; cursor: pointer; user-select: none;
+  min-height: 32px; display: flex; align-items: center;
+}
+details.receipt pre {
+  background: #060A12;
+  border: 1px solid var(--line);
+  border-radius: 6px;
+  padding: 12px;
+  font-size: 12px;
+  color: var(--dim);
+  overflow-x: auto;
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+  margin: 8px 0 0;
+}
+
+/* ---------- footer ---------- */
+.footer {
+  border-top: 1px solid var(--line);
+  padding: 20px;
+  color: var(--dim);
+  font-size: 13px;
+  text-align: center;
+}
+.footlinks { margin-bottom: 8px; }
+.strapline { color: var(--dim); margin: 0; }
+
+/* ---------- mobile (SPEC 3: iPhone SE, no sideways scroll, 44px taps) ---- */
+@media (max-width: 720px) {
+  .workbench { grid-template-columns: 1fr; gap: 16px; padding: 16px 12px; }
+  .verdicts { padding: 0 12px 16px; }
+  .masthead { padding: 20px 12px 14px; }
+  .masthead h1 { font-size: 17px; }
+  .grid { min-height: 160px; }
+  .repoform { min-width: 0; width: 100%; }
+}
+
+/* ---- masthead branding ---- */
+.masthead{display:flex;align-items:center;gap:18px;text-align:left}
+.brandmark{flex:0 0 auto;display:block;line-height:0}
+.brandmark img{width:72px;height:72px;display:block;
+  filter:drop-shadow(0 0 14px rgba(217,32,44,.35))}
+.masthead-text{min-width:0}
+.byline{margin:.15rem 0 .1rem;font-size:1.05rem;letter-spacing:.14em;color:var(--dim)}
+.byline .brand-name{color:#E0202C;font-weight:700;letter-spacing:.18em}
+@media (max-width:720px){
+  .masthead{flex-direction:column;text-align:center;gap:10px}
+  .brandmark img{width:56px;height:56px}
+}
+.buildtag{margin:.2rem 0 0;font-size:.68rem;letter-spacing:.08em;color:var(--line);text-align:center}