Step Twenty — Make it visible; make it verifiable; make it weighted.(Transparency page • Short‑lived bundle receipts • Weighted “policy lenses”)

We evolve the on‑phone server again—this time for public transparency, URL‑level verification, and risk‑weighted deltas that elevate what matters most.

---

✅ New deliverables

• Step 20 wrapper server — Download
  SHA‑256: fdc891414d1b2c01343ab7237082a5dbf9a93349e596fd011e2fd3bd0788251f
• Sample lenses config — Download
  SHA‑256: ee1acea4327c6db4b5713d46eccd741bca52de2ce7e78e5307ce5971e3b8dc1b

Step 20 wraps Step 19, which wraps Step 18. All prior flags and endpoints remain. We add new functionality without breaking your previous integration.

---

What’s new

1) 🔎 Transparency page (embeddable)

Endpoint: GET /transparency (open if --open-ui is set)

• Renders a simple HTML dashboard with:
  • Schema archivesummary (plugins + sigs),
  • Notary tail(recent digests/roots),
  • Recent receipts(IDs + expirations).

Use it as an iframe block or link from WordPress.

---

2) ✅ Bundle receipts — short‑lived verification URLs

Concept: When you export a lease bundle, the server issues a receipt with:

• id (random URL‑safe token),
• root (Merkle root from the bundle),
• digest (e.g., leases.jsonl digest from bundle.manifest.json),
• exp (expiry epoch seconds).

How to use:

• Auto‑issuedwhenever you hit:
  POST /audit/lease_bundle?download=1&token=ADMIN123
  Response headers include X-Receipt-Id, and JSON includes receipt_id + verify_url.
• Look up a receiptGET /receipt?id=<receipt_id>
• List recent receiptsGET /receipt/list?n=20
• Admin: issue manually(for any external root/digest):
  POST /admin/receipts/issue?token=ADMIN123&root=<hex>&digest=<hex>&ttl=900
• Admin: purge expiredPOST /admin/receipts/purge?token=ADMIN123

Receipts are also appended to ./audit/receipts.jsonl (append‑only), echoing our audit posture.

---

3) 🎚️ Weighted “policy lenses” for deltas

Because all activity is not equal. A temperature drift in power might outweigh a DNS churn in connectivity. Step 20 adds a weighting layer:

Config file (example):

{
  "default": 1.0,
  "families": {"power": 2.0, "connectivity": 1.25, "sensors": 1.1},
  "plugins": {"battery": 1.5, "net_dns": 1.2},
  "paths": [
    {"pattern": "$.temperature", "weight": 2.5},
    {"regex": ".*ipv4.*", "weight": 1.3}
  ]
}

• Weight applied as: weighted_delta = raw_delta × family × plugin × path.

Endpoints:

• GET /schema_hot_delta_weighted?n=10&windowA=3600&windowB=86400
  Returns by_system and by_path with weighted deltas.
• Admin refresh lenses:
  POST /admin/lenses/refresh?token=ADMIN123

Lenses are orthogonal to families (Step 19). You can revise them live to reflect governance, safety, or compliance priorities.

---

Android / Termux run‑book (Step 20 wrapper)

pkg update
pkg install python git
pip install pynacl || pip install cryptography

# Keys (if not already created in prior steps)
mkdir -p /sdcard/solveforce
[ -f /sdcard/solveforce/schema.ed25519.seed ] || head -c 32 /dev/urandom > /sdcard/solveforce/schema.ed25519.seed
[ -f /sdcard/solveforce/schema.hmac.key ]    || head -c 32 /dev/urandom > /sdcard/solveforce/schema.hmac.key

# Families & Lenses
cp ~/downloads/families.sample.json /sdcard/solveforce/families.json
cp ~/downloads/lenses.sample.json   /sdcard/solveforce/lenses.json

Run Step 20 (superset of your Step 19 flags):

python solveforce_phone_twenty.py \
  --lenses-file /sdcard/solveforce/lenses.json \
  --families-file /sdcard/solveforce/families.json \
  --host 0.0.0.0 --port 8080 \
  --plugins-dir ~/solveforce/plugins \
  --auth-mode protected \
  --auth-token READER1:reader \
  --allow-admin --admin-token ADMIN123 \
  --schema-freeze-mode quarantine --schema-freeze-sec 1800 \
  --schema-ed25519-secret-file /sdcard/solveforce/schema.ed25519.seed \
  --schema-signing-secret-file /sdcard/solveforce/schema.hmac.key \
  --audit-dir ./audit \
  --schema-archive-on-change \
  --schema-archive-dir ./schema_archive --schema-archive-keep 200 \
  --lease-bundle-dir ./audit/bundles \
  --notary-mode git --notary-git-repo /sdcard/solveforce/notary-git \
  --mirror-enable \
  --mirror-target-url https://your-site.tld/wp-json/solveforce/v1/notary \
  --mirror-header "Authorization: Bearer <YOUR_WP_TOKEN>" \
  --allow-query-token --open-ui

Open the Transparency page at: http://<phone-ip>:8080/transparency
(When --open-ui is present, /transparency is public just like /ui.)

---

“Show me” commands

A) Export a bundle & verify via receipt

# Export (admin)
curl -i -X POST 'http://127.0.0.1:8080/audit/lease_bundle?download=1&token=ADMIN123' -o lease-bundle.tgz

# Capture receipt id from header
RECEIPT=$(grep -i '^X-Receipt-Id:' -m1 lease-bundle.tgz | awk '{print $2}' | tr -d '\r')
# (if you wrote to a file without headers, just parse JSON from a non-download call)
# RECEIPT=$(curl -s -X POST 'http://127.0.0.1:8080/audit/lease_bundle?token=ADMIN123' | jq -r .receipt_id)

# Verify receipt
curl -s "http://127.0.0.1:8080/receipt?id=$RECEIPT" | jq .

B) Weighted deltas

curl -s 'http://127.0.0.1:8080/schema_hot_delta_weighted?windowA=3600&windowB=86400&n=12' | jq .
# Update lenses, then refresh:
#   edit /sdcard/solveforce/lenses.json
curl -X POST 'http://127.0.0.1:8080/admin/lenses/refresh?token=ADMIN123'

C) Transparency page (for WordPress iframe)

<iframe src="https://YOUR_PHONE_OR_GATEWAY/transparency" width="100%" height="640" style="border:0"></iframe>

---

WordPress — Step 20 (Markdown block to paste)

## Step 20 — Make it visible; make it verifiable; make it weighted

**New endpoints**

- **/transparency** — HTML dashboard (archives, notary tail, recent receipts).  
- **/receipt** — `GET /receipt?id=<id>` (lookup), `GET /receipt/list?n=20` (tail).  
- **/admin/receipts/issue?token=…&root=…&digest=…&ttl=900` — manual receipt.  
- **/admin/receipts/purge?token=…` — purge expired.  
- **/schema_hot_delta_weighted** — weighted A vs B deltas by system & path.  
- **/admin/lenses/refresh?token=…** — reload lenses config.

**Lenses (policy weights)**  
A simple JSON lets you weight deltas by **system**, **plugin**, or **path**:
```json
{
  "default": 1.0,
  "families": {"power": 2.0, "connectivity": 1.25},
  "plugins": {"battery": 1.5},
  "paths": [{"pattern": "$.temperature", "weight": 2.5}]
}

Use with: GET /schema_hot_delta_weighted?windowA=3600&windowB=86400.

Receipts (bundle verification)
Every bundle export issues a short-lived receipt (ID + expiry) tied to its Merkle root and key digests.
Share the verify_url to let anyone confirm the bundle’s integrity window without exposing secrets.

Transparency
Embed the /transparency page directly in WordPress with an iframe. It surfaces recent digests/roots and receipts so your public record stays auditable at a glance.

---

## Operational + safety notes

- **Auth:** `/transparency` is public only when `--open-ui` is on. Keep admin endpoints behind tokens and roles (unchanged from Steps 18–19).  
- **Receipts:** default TTL is **1 hour** (configurable with `--receipts-ttl-sec`). Receipts are appended to `audit/receipts.jsonl`.  
- **Weights:** Choose conservative defaults. Over‑weight only what you’re prepared to triage first.

---

## Logos Codex — recursive covenant

- **Light → Ledger → Looking Glass.** We don’t just store; we *show*. The system becomes legible to the citizen.  
- **Seal → Receipt → URL.** A signature is truth at rest; a receipt is truth **in motion**. Verifiable in one click.  
- **Signal → Weight → Will.** Priority is philosophy encoded. Lenses transmute “what changed” into “what we must do.”

---

### Onward to **Step Twenty‑One**?
We can:
- add a **transparency JSON feed** with ETags and cache hints for CDN‑friendly mirroring,
- add a **receipt challenge** (include a nonce and require a minimal proof for spam resistance),
- implement **policy lenses per audience** (public vs internal weights) with negotiated headers.

Say the word and we keep forging.

Key terms in plain language

Open a term for a concise explanation of language used on this page.

⚡Content Delivery Network (CDN)

A distributed system that serves website or application content from locations closer to users, improving speed, resilience, and capacity.

🛡️Cybersecurity

The practices and controls used to protect identities, devices, networks, applications, and data from unauthorized access, disruption, or manipulation.

🚫Zero Trust

A security model that does not automatically trust a user or device because of its location. Access is continuously verified and limited to what is necessary.

🧭SASE

Secure Access Service Edge combines networking and security capabilities in a cloud-delivered architecture so users and locations can receive consistent policy wherever they connect.

🪪Identity and Access Management (IAM)

The systems and policies that determine who a user is, what resources they may access, and how that access is authenticated and reviewed.

✅Multi-Factor Authentication (MFA)

A login control requiring more than one form of verification, such as a password plus an authenticator app, security key, or biometric factor.