✅ CANONICAL STATUS (2026-05-21) — read this first

n> **This page is the LOCKED, CURRENT design + data spec for Ainfera marketing + dashboard. Build from this.**n>n> | Field | Value |n> |---|---|n> | Design source of truth | Claude design handoff v15 (31 pages) — in founder's Downloads, recreate in ~/code/ainfera-ai/web |n> | Build ticket | AIN-219 (the ONLY active build ticket for marketing+dashboard) |n> | Supersedes | PR #51 (scrub) + PR #52 (widgets) approaches — both SUPERSEDED, do not follow |n> | Build rule | Recreate design EXACTLY (zero design change) + wire live data + hold the 3 locks below |n> | Status | LOCKED — awaiting CC build, then founder+counsel audit |n>n> The 3 LOCKS (authoritative — listed in full directly below this header): (1) /models live API-driven · (2) routing-vs-direct comparison is data-gated placeholder only · (3) agent visibility = 5 public (Varda/Yavanna/Namo/Aule/Tulkas) + Manwe PRIVATE.n>n> If any older section of this page conflicts with this header or the 3 locks, the header + locks win. Earlier headers (v1.1 reconciliation, build-status from the Cursor era) remain as history but are SUBORDINATE to this status block.n>n> Dependency: the trust-fix session (Ed25519 + server-side internal-* filter) should land BEFORE this build deploys, so Home/Audit live feeds are leak-free at the source.nn---n

Decision — Marketing/Dashboard Data Architecture + Agent Visibility (LOCKED 2026-05-21)

Design handoff v15 (Claude design, 31 pages, 30-page product) is approved for build. Two data-architecture locks + one agent-visibility lock resolve the demo-data problem at the root: live data by architecture, not hardcoded strings.

Lock 1 — /models is live API-driven (real-time catalog)

• The Models page renders the LIVE Ainfera Routing catalog + leaderboard from the API in real time — NOT hardcoded HTML.
• Ainfera Routing catalog = 50+ models and GROWING. This is distinct from AAMC (the locked 5 voter models — internal scoring engine, never a public SKU).
• Catalog may include any routable model (DeepSeek, Llama, Kimi, etc.) — these are routing targets, NOT AAMC voters. A diverse catalog is correct, not an error.
• Result: no model strings to scrub on /models; the page reflects whatever the catalog API returns. Demo data replaced by real data by architecture.

Lock 2 — Routing-vs-direct comparison is a LATER, data-gated feature

• Future surface: compare Ainfera Routing vs each single fixed model (vs always-opus, vs always-gpt-5-5, etc.) on BOTH performance and cost. "We beat any single fixed choice."
• This is the q_empirical flywheel made visible — the data-backed proof of routing value.
• CANNOT ship until real outcome data exists at volume (currently ~4 cell records). Building "X% better" on thin data = fabrication, violates no-synthetic-data rule.
• Build NOW: the empty/placeholder state. Populate LATER, gated behind a minimum-sample threshold.

Lock 3 — Agent visibility: 5 public + 1 private

• PUBLIC (may appear on public marketing surfaces + audit feed): Varda, Yavanna, Namo, Aule, Tulkas
• PRIVATE (NEVER on any public Ainfera surface): Manwe — founder's private twin, not an Ainfera asset. The founder-twin wall holds.
• This evolves the prior Aratar v4 lock (was: only Varda + Yavanna public). New decision: Namo/Aule/Tulkas names may now be public-facing.
• Nuance: Tulkas's NAME may be public, but its red-team adversarial events (cap-violations, jailbreak probes) must NOT dominate the public audit feed as normal traffic — feed curation point.
• Home + Audit live feeds pull from the internal-*-filtered live audit endpoint (server-side filter from the trust-fix session) — real AND leak-free. Manwe never appears.