"""estateview - the estate map as a cockpit view.
The same model as ESTATE.md (the canonical committed version), rendered
interactively for humans, with RUNTIME as a first-class dimension: every
entity dossier states whether anything is actually running, where, and
when it starts and stops. A sync test guards name-level drift between
this page and ESTATE.md.
"""
ESTATE_HTML = r'''LTL estate map — repos, services, loops
LTL estate map
Every persisting entity of the Lean Transparency Log endeavour, arranged as five lanes of custody — click any card for its dossier. The two colored routes are the loops that make this estate hard to hold in one head.
log 13 leavesroot 3488a2d0…key 874c8a00…paper v0.9 · 23 pp · camera-readyattested components 5pacta suite 144 greenSLH-DSA campaign open — 0 certificatesstate as of 2026-07-22
ALWAYS ON droplet: caddy (TLS, static blog) · LTL web service (read-only container) · Forgejo (+ 03:00 mirror cron)ON-DEMAND operator machine: append/publish/sign ceremonies · cockpit · MCP — exist only while invokedNOT RUNNING warden: implemented prototype, no deployed instance, no funds watchedeverything else: static files or external parties — no process at all
internal consumer — quorum of 4 attested fork verifiers
Agents
MCP tools · custody card with embedded inclusion proofs
swisspost-evoting-go-poc
prospective — dalek family-level match only, no receipt code
prospective
External reviewers
GPT-5.6 + Claude — adversarial consumers of paper, corpus, log
'''
# ─────────────────────────────────────────────────────────────────────────────
# MEASURED PROGRESS PANEL
#
# Everything above this line is hand-written prose. That is why, between
# 2026-07-22 and 2026-07-30, this page told the operator that the SLH-DSA
# campaign was "in progress" with a button "non-green by design" while it had
# eleven proven certificates and a green button, and that the ed25519 forks had
# "16 reviewed certificates" while they had 31 bound and 3022 inventoried. A
# page that asserts cannot notice it has gone out of date; only a page that
# measures can.
#
# So this panel renders ONLY what formal-verification-control's
# tools/estate-progress.py derived from the repositories, and it states three
# things a reader would otherwise have to assume: when it was measured, whether
# the repositories have moved since, and which parts of this page are measured
# at all. If there is no snapshot it renders that fact loudly rather than
# quietly rendering nothing.
# ─────────────────────────────────────────────────────────────────────────────
import json as _json
import os as _os
import subprocess as _sp
PROGRESS_JSON = _os.environ.get(
"PACTA_PROGRESS_JSON",
"/home/oho/GitClone/FormalVerification/formal-verification-control/ESTATE-PROGRESS.json")
ESTATE_ROOT = _os.environ.get(
"ESTATE_ROOT", "/home/oho/GitClone/Claude/FormalVerification")
def _live_head(repo: str):
try:
r = _sp.run(["git", "-C", _os.path.join(ESTATE_ROOT, repo),
"rev-parse", "--short", "HEAD"],
capture_output=True, text=True, timeout=5)
return r.stdout.strip() or None
except Exception:
return None
def _panel(cls: str, title: str, body: str) -> str:
return (f'
{title}
{body}')
def progress_panel() -> str:
"""The measured half of this page. Never falls back to prose."""
style = """
"""
if not _os.path.exists(PROGRESS_JSON):
return style + _panel("bad", "Progress: NOT MEASURED", f"""
No snapshot at {PROGRESS_JSON}, so this page is showing
you nothing rather than something stale. That is deliberate:
the previous version of this page displayed hand-typed claims that were
eight days out of date, and looked exactly as confident as this one.
To populate it:
formal-verification-control/tools/estate-progress.py --json
""")
try:
d = _json.load(open(PROGRESS_JSON))
except Exception as e:
return style + _panel("bad", "Progress: SNAPSHOT UNREADABLE", f"
{e}
")
moved = []
for repo, recorded in (d.get("repo_heads") or {}).items():
live = _live_head(repo)
if live and recorded and live != recorded:
moved.append((repo, recorded, live))
rows = []
for c in d["campaigns"]:
ax = c["axes"]
for axis, label in (("proof", "act one · proof"), ("attestation", "act two · attestation")):
if axis not in ax:
continue
a = ax[axis]
unm = (f' '
f'+{a["unmeasurable"]} unmeasurable' if a["unmeasurable"] else "")
rows.append(
f'
{c["title"]}
{label}
'
f'
{a["earned"]} / {a["identified"]}
'
f'
'
f'
{a["pct"]}%{unm}
'
f'
{c["reproduction_note"]}
')
t = d["totals"]
head = (f'
act one — proof {t["proof"]["pct"]}% · '
f'act two — attestation {t["attestation"]["pct"]}% '
f'(two numbers, never one: a single figure is what let the '
f'old metric report 100% for work nobody had attacked)
')
table = ('
campaign
axis
band-points
'
'
verified
reproduction
'
+ "".join(rows) + "
")
contra = ""
if d.get("contradictions"):
items = "".join(f"
{c['id']}: {c['detail']}
"
for c in d["contradictions"])
contra = (f'
The ledger contradicts the repositories. '
f'These numbers are not trustworthy until this list is empty:
{items}
')
note = (f'
Measured {d["generated_at"]} by {d["generator"]}, '
f'from the repositories as they were at that moment. Nothing here is cached or '
f'carried forward. Everything on this page ABOVE this panel is '
f'hand-written prose and can be out of date; only this panel is derived.
')
if moved:
rowsm = "".join(f"
{r}: measured at {a}, "
f"now {b}
" for r, a, b in moved)
return style + _panel(
"warn", "Progress: MEASURED, BUT THE REPOSITORIES HAVE MOVED SINCE",
f'
{len(moved)} repository(ies) changed after this snapshot, so the figures '
f'below describe an earlier state:
{rowsm}
{head}{table}{contra}{note}'
f'
Re-run tools/estate-progress.py --json to refresh.
')
return style + _panel("", "Progress — measured, not asserted",
head + table + contra + note)