CI: sync Gap-Finder Space (d1507c1)

README.md

@@ -30,17 +30,23 @@ manifest, public key, and instructions beside it are convenience copies.
 
 ```
 unzip uofa-pack-*.zip
-uofa verify uofa.jsonld \
-  --pubkey keys/uofa-issuer.pub \
-  --decision-pubkey keys/demo-reviewer.pub
+uofa verify uofa.jsonld --pubkey keys/uofa-issuer.pub
 ```
 
 **What a valid signature means here.** Only that the file is unmodified since
 this demo produced it. It is not a review and not an acceptance decision. The
 signing key is a *demonstration issuer key* held by the demo, not a research or
-production key, and not anyone's decision key — so a demo package can never be
-mistaken for a formally issued one (it does not verify against the default trust
-anchor; `--pubkey` is required, deliberately).
+production key — so a demo package can never be mistaken for a formally issued
+one (it does not verify against the default trust anchor; `--pubkey` is
+required, deliberately).
+
+**The Space applies an issuer seal only, and signs no decision.** A service key
+cannot stand in for a human reviewer, so the pack carries no decision block and
+`--decision-pubkey` has nothing here to check. Until 2026-09-08 this file
+documented that flag against `keys/demo-reviewer.pub`, which is not one of the
+pack's five members, so the command failed on a missing file and implied an
+attestation the Space deliberately does not make. See
+`docs/UofA_Spec_Unified_Signing_Surface_v1_0.md`.
 
 The public key travels inside the zip so verification works offline. A trust
 anchor shipped inside the artifact it validates only proves self-consistency, so
@@ -48,7 +54,6 @@ compare it against this independent copy:
 
 ```
 keys/uofa-issuer.pub    sha256:ead2e1e1068f8c6da14b2c9c384e4d00d8900308ad2e406fe294330ce0edd81d
-keys/demo-reviewer.pub  sha256:3605a146f4880d9f7a29db6ef5629655091d2ecd0c2b9919cbe49d90d65d83c8
 ```
 
 ## Privacy

space/DEPLOY.md

@@ -84,34 +84,58 @@ never evidence content.
 
 ---
 
-## 3b. Package signing key (`UOFA_DEMO_SIGNING_KEY`)
-
-The "Download UofA package" control signs each package with a **dedicated demo
-issuer key**. Deliberately *not* `keys/research.key`: a demo artifact must never
-be cryptographically indistinguishable from a research package, so the demo key
-is its own identity. Signing now takes TWO keys, one per attestor kind:
-`UOFA_ISSUER_SIGNING_KEY` seals the measurement view (anchor
-`keys/uofa-issuer.pub`) and `UOFA_DEMO_SIGNING_KEY` signs the decision
-(anchor `keys/demo-reviewer.pub`). One signature may never span both.
+## 3b. Package signing key (`UOFA_ISSUER_SIGNING_KEY`)
+
+The "Download UofA package" control seals each package with a **dedicated issuer
+key**. Deliberately *not* `keys/research.key`: a demo artifact must never be
+cryptographically indistinguishable from a research package, so the issuer key
+is its own identity.
+
+**One key, one scope: an issuer seal.** `UOFA_ISSUER_SIGNING_KEY` attests
+integrity and origin — this package came from this service and has not been
+altered since. Anchor: `keys/uofa-issuer.pub`. The signer renders as
+`UofA issuer (keys/uofa-issuer.pub)`.
+
+**The Space does not sign a decision, and must not.** A service key cannot stand
+in for a human reviewer, so there is no second signature and no decision
+attestor. Per `docs/UofA_Spec_Unified_Signing_Surface_v1_0.md`, which supersedes
+the earlier two-attestor design, the web path applies an issuer seal only. A
+valid signature here means *this artifact is intact and came from us*. It does
+not mean anyone accepted the model.
+
+> **Corrected 2026-09-08.** This section previously described a second secret,
+> `UOFA_DEMO_SIGNING_KEY`, said to sign a decision against
+> `keys/demo-reviewer.pub`. **No code has ever read that variable.**
+> `space/pipeline.py` defines `UOFA_ISSUER_SIGNING_KEY` and
+> `UOFA_ISSUER_SIGNING_KEY_FILE` and nothing else, and the Space's own tests
+> already assert the emitted package carries no decision block. The document
+> described a capability the implementation deliberately does not have, on the
+> most sensitive question the tool answers. Pinned by
+> `tests/space/test_deploy_doc_env_names.py` so the names cannot drift again.
 
 **Setup (one-time).** Generate the pair *outside the repo* and install the
 private half as a Space secret:
 
 ```bash
-uofa keygen ~/secure/uofa-demo.key     # writes uofa-demo.key + uofa-demo.pub
-cp ~/secure/uofa-demo.pub keys/demo-reviewer.pub   # public half is committed
+uofa keygen ~/secure/uofa-issuer.key   # writes uofa-issuer.key + uofa-issuer.pub
+cp ~/secure/uofa-issuer.pub keys/uofa-issuer.pub   # public half is committed
 ```
 
 Space → **Settings → Variables and secrets → New secret**:
 
 | Name | Value |
 |---|---|
-| `UOFA_DEMO_SIGNING_KEY` | the full PEM contents of `uofa-demo.key` |
+| `UOFA_ISSUER_SIGNING_KEY` | the full PEM contents of `uofa-issuer.key` |
+
+Without that secret the Space still runs, but the result reports
+`Authenticity: Unverified (demo)` and **no download control appears** — an
+unsigned package is not offered rather than offered unsigned.
 
 The PEM is read into memory at request time and never written to the container
 filesystem — the process serves user downloads out of a temp directory, and a
 private key on that filesystem is one path bug away from being one of them. For
-local development, `UOFA_DEMO_SIGNING_KEY_FILE=/path/to/demo.key` works instead.
+local development, `UOFA_ISSUER_SIGNING_KEY_FILE=/path/to/issuer.key` works
+instead.
 
 **The key can never travel as a file.** `space/deploy_to_hf.py` filters `.key`,
 `.pem`, and `.env` out of the upload set *and* hard-refuses the deploy if one

space/README.md

@@ -30,17 +30,23 @@ manifest, public key, and instructions beside it are convenience copies.
 
 ```
 unzip uofa-pack-*.zip
-uofa verify uofa.jsonld \
-  --pubkey keys/uofa-issuer.pub \
-  --decision-pubkey keys/demo-reviewer.pub
+uofa verify uofa.jsonld --pubkey keys/uofa-issuer.pub
 ```
 
 **What a valid signature means here.** Only that the file is unmodified since
 this demo produced it. It is not a review and not an acceptance decision. The
 signing key is a *demonstration issuer key* held by the demo, not a research or
-production key, and not anyone's decision key — so a demo package can never be
-mistaken for a formally issued one (it does not verify against the default trust
-anchor; `--pubkey` is required, deliberately).
+production key — so a demo package can never be mistaken for a formally issued
+one (it does not verify against the default trust anchor; `--pubkey` is
+required, deliberately).
+
+**The Space applies an issuer seal only, and signs no decision.** A service key
+cannot stand in for a human reviewer, so the pack carries no decision block and
+`--decision-pubkey` has nothing here to check. Until 2026-09-08 this file
+documented that flag against `keys/demo-reviewer.pub`, which is not one of the
+pack's five members, so the command failed on a missing file and implied an
+attestation the Space deliberately does not make. See
+`docs/UofA_Spec_Unified_Signing_Surface_v1_0.md`.
 
 The public key travels inside the zip so verification works offline. A trust
 anchor shipped inside the artifact it validates only proves self-consistency, so
@@ -48,7 +54,6 @@ compare it against this independent copy:
 
 ```
 keys/uofa-issuer.pub    sha256:ead2e1e1068f8c6da14b2c9c384e4d00d8900308ad2e406fe294330ce0edd81d
-keys/demo-reviewer.pub  sha256:3605a146f4880d9f7a29db6ef5629655091d2ecd0c2b9919cbe49d90d65d83c8
 ```
 
 ## Privacy

space/app.py

@@ -20,7 +20,7 @@ import gradio as gr
 from space import (curated, leadcapture, llm_env, pipeline, ratelimit, reviewer,
                    solver_panel, wizard)
 from space.gloss import gloss_for, load_gloss
-from uofa_cli import paths
+from uofa_cli import paths, report_state
 
 PACK_LABELS = {"vv40": "ASME V&V 40", "nasa-7009b": "NASA-STD-7009B"}
 PACK_CHOICES = [(label, pid) for pid, label in PACK_LABELS.items()]
@@ -370,14 +370,25 @@ def _render_results(p):
         gaps.append("**Weakeners fired:**")
         for w in p["weakeners"]:
             fac = f", {', '.join(w['factors'])}" if w.get("factors") else ""
-            gaps.append(f"- `{w['patternId']}` [{w.get('severity')}] ×{w.get('hits')}{fac}")
+            # sev_label, not the raw key: a reader must never see "Medium" here
+            # and "Moderate" in the Reviewer view for the same weakener.
+            sev = report_state.sev_label(w.get("severity"))
+            gaps.append(f"- `{w['patternId']}` [{sev}] ×{w.get('hits')}{fac}")
     else:
         gaps.append("**Weakeners:** none fired. 🎉")
     if c["missing"]:
         gaps.append("\n**Not assessed:** " + ", ".join(c["missing"]))
     gaps_md = "\n".join(gaps)
 
-    tail = [f"**Completeness:** {c['n_assessed']} of {c['n_expected']} factors assessed."]
+    # Say WHICH count this is. The Reviewer view reports a different, also
+    # correct number (it demotes any factor an open High/Moderate concern
+    # disputes), and side by side the two read as a contradiction unless each
+    # names its own basis. Observed live 2026-09-08: Author "13 of 13" against
+    # Reviewer "11 of 13" on the same run, with nothing explaining the gap.
+    tail = [f"**Completeness (raw extracted statuses):** {c['n_assessed']} of "
+            f"{c['n_expected']} factors assessed. The Reviewer view reports a "
+            "lower count because it does not treat a factor as evidenced while "
+            "an open High or Moderate concern disputes it."]
     if c["excluded"]:
         tail.append("**Excluded (scoped-out / N/A):** " + ", ".join(c["excluded"]))
     struct = p["structural"]
@@ -651,8 +662,14 @@ def build() -> gr.Blocks:
             def render_factors(result):
                 rows = pipeline.factor_rows(result) if result else []
                 for row in rows:
+                    # interactive=True is explicit, not decorative. Gradio infers
+                    # interactivity from whether a component is an input to some
+                    # event, and that inference does not reach components built
+                    # inside @gr.render: every factor radio shipped DISABLED, so
+                    # the confirm step -- the only surface a human may correct --
+                    # could not be corrected. Pinned by test_confirm_step_editable.
                     rad = gr.Radio(choices=STATUS_CHOICES, value=row["status"],
-                                   label=_factor_label(row))
+                                   label=_factor_label(row), interactive=True)
                     # The factor name is already in the radio label above, so the
                     # accordion just says "what we read" (no redundant name echo).
                     # Lead with the shared gloss so a non-expert understands the factor.

space/pipeline.py

@@ -398,6 +398,14 @@ def _authenticity_block(*, signed: bool = False, package_hash: str | None = None
         "package_hash": package_hash,
         "signer": signer or SIGNER_LABEL,
         "statement": _SIGNED_STATEMENT,
+        # Built from the same constants that name the zip's members, so the
+        # command a reader is shown cannot drift from the files they receive.
+        # The reviewer view previously hardcoded `keys/demo.pub`, which is not
+        # a member of the pack, so copying the on-screen command failed on a
+        # missing file. Carried in the payload rather than assembled in the
+        # renderer because that module renders state and interprets nothing.
+        "verify_command": (f"uofa verify {PACK_MEMBER_JSONLD} "
+                           f"--pubkey {PACK_MEMBER_PUBKEY}"),
     }
 
 

space/requirements.txt

@@ -1,5 +1,17 @@
 # App-only deps installed on top of the uofa[extract] wheel (see space/Dockerfile).
 # The uofa package itself and its extract extras (litellm, pdfplumber, etc.) come
 # from the wheel, not from here.
-gradio>=6.0
+# Upper bound is deliberate. This was `>=6.0` with no cap, so the Space
+# installed whatever 6.x existed at build time and the UI could change with no
+# commit in this repo. It did: Gradio infers a component's interactivity from
+# whether it feeds an event, that inference does not reach components built
+# inside `@gr.render`, and every credibility-factor radio on the deployed tool
+# shipped DISABLED. The confirm step, the one surface a human may correct, was
+# read-only in production. See the fix in space/app.py (interactive=True) and
+# the browser test that pins it, tests/space/test_ui_e2e.py.
+#
+# 6.24.0 is the version the browser tests were run against on 2026-09-08. Raise
+# this cap only alongside a run of those tests, since they are the only thing
+# that exercises rendered interactivity.
+gradio>=6.0,<6.25
 huggingface_hub>=0.23   # lead capture -> private HF Dataset (S4)

space/reviewer.py

@@ -109,7 +109,13 @@ def _reconcile_clause(s: ReviewerState) -> str:
             bits.append(f"{m} high-severity {_plural(m, 'concern', 'concerns')} "
                         f"{_plural(m, 'remains', 'remain')} open")
         tail = "; ".join(bits) + " before this is review-ready."
-    return f"{s.completeness_pct}% of all factors evidenced; {tail}"
+    # "after open concerns" is load-bearing. This percentage counts a factor as
+    # evidenced only while no open High or Moderate concern disputes it, so it
+    # can sit below the Author view's raw count of assessed statuses. Both are
+    # correct; unlabelled they read as a contradiction. Observed live
+    # 2026-09-08: this view said 11 of 13 while the Author view said 13 of 13.
+    return (f"{s.completeness_pct}% of all factors evidenced after open "
+            f"concerns; {tail}")
 
 
 def _section_glance(s: ReviewerState) -> str:
@@ -127,7 +133,7 @@ def _section_glance(s: ReviewerState) -> str:
       <h2>At a glance</h2>
       <dl class="ri-glance">
         <div><dt>Completeness</dt><dd>{s.completeness_pct}%</dd></div>
-        <div><dt>Factors evidenced</dt><dd>{s.n_evidenced} of {s.n_expected}</dd></div>
+        <div><dt>Evidenced, after concerns</dt><dd>{s.n_evidenced} of {s.n_expected}</dd></div>
         <div><dt>Concerns (weakeners)</dt><dd>{_e(sev_txt)}</dd></div>
         <div><dt>Authenticity verified</dt><dd>{auth_txt}</dd></div>
         <div><dt>Gate checks passed</dt><dd>{s.gates['passed']} of {s.gates['total']}</dd></div>
@@ -220,7 +226,11 @@ def _section_authenticity(s: ReviewerState) -> str:
         detail = (f"<ul><li><b>Signed by:</b> {_e(auth.get('signer'))}</li>"
                   f"<li><b>Content hash:</b> <code>{_e(auth.get('package_hash'))}</code></li></ul>\n"
                   f"      <p>{_e(auth.get('statement'))}</p>")
-        cmd = "uofa verify uofa.jsonld --pubkey keys/demo.pub"
+        # From the payload, not typed here. The packed pubkey member is named by
+        # pipeline.PACK_MEMBER_PUBKEY, and a second hardcoded copy of that name
+        # in this file drifted: it read `keys/demo.pub`, which the zip does not
+        # contain, so a reader who copied this command hit a missing file.
+        cmd = auth.get("verify_command") or "uofa verify --help"
         howto = ("Download the package below and re-check it yourself. The public "
                  "key and these instructions travel inside the zip:")
     else: