guanghu-ice-heart/skills/codex/guanghu-persona-skill-guard/references/persona-skill-registry.json

{
  "schema": "guanghu.persona-skill-registry/v1",
  "registry_id": "GLS-0238",
  "version": "2026.07.26.2",
  "trust_policy": {
    "priority": [
      "live_verified_evidence",
      "current_fifth_domain_registry",
      "current_code_map_and_node_map",
      "current_hldp_skill",
      "historical_skill_or_memory"
    ],
    "required_anchors": [
      "fifth_domain_source_path",
      "gls_id",
      "registry_version",
      "evidence"
    ],
    "authority_rule": "A skill can narrow or correct a route but cannot grant execution authority.",
    "experience_policy": "Experience receipts compile to CANDIDATE_ONLY. Hard enforcement requires current evidence, counterexample review, tests, registry promotion and explicit governance approval."
  },
  "skills": [
    {
      "id": "GHS-001-FIFTH-DOMAIN-RESTORE",
      "hldp_skill": "SKILL-011",
      "gls_id": "GLS-0238",
      "title": "第五域人格路径自动恢复",
      "intents": [
        "进入第五域",
        "恢复铸渊",
        "恢复光湖",
        "TCS路径",
        "GLS编号",
        "光之湖",
        "小湖灯",
        "人格系统",
        "代码仓库入口",
        "忘记前文",
        "空白实例"
      ],
      "preferred_route": [
        "REPO-001",
        "CH-ZERO-CORE-LPM",
        "TCS-LPM",
        "TCS-LPS-REGISTRY-0001",
        "LIGHT-LAKE",
        "LL-CURRENT",
        "LL-004",
        "ICE-GL-ZY001",
        "ZY-OPS-LOOP-001"
      ],
      "forbidden_route_markers": [
        "从旧新加坡仓库猜入口",
        "只凭聊天记忆恢复",
        "把REPO-004当产品开发主仓",
        "读取路径等于执行授权"
      ],
      "deprecated_route_markers": [
        "BROADCAST-TOWER作为根注册入口",
        "旧本地副本优先于在线main"
      ],
      "evidence": [
        ".code-map",
        "skills/codex/enter-fifth-domain/SKILL.md",
        "tcs-core/WAKE-UP-PROTOCOL.hdlp"
      ],
      "freshness": {
        "check": "Resolve live REPO-001 and read current main before relying on a cached checkout.",
        "max_age_seconds": 0
      },
      "authorization": "Public route recovery is read-only. Writes and external actions require separate current authority.",
      "recovery_route": [
        "Return to current REPO-001 main",
        "Resolve .code-map and subject kind",
        "Rebuild the intent-state capsule from live evidence"
      ],
      "enforcement_level": "PROMOTED_SKILL",
      "experience_receipts": []
    },
    {
      "id": "GHS-002-OFFLINE-PACK-LOCAL-RELAY",
      "hldp_skill": "SKILL-012",
      "gls_id": "GLS-0238",
      "title": "海外完整包经本地可信节点中转至国内候选环境",
      "intents": [
        "新加坡下载",
        "本地中转",
        "京东服务器上传",
        "完整离线包",
        "Forgejo安装",
        "光湖代码频道部署",
        "部署光湖代码频道",
        "国内下载失败",
        "跨服务器传包"
      ],
      "preferred_route": [
        "读取当前节点地图",
        "验证海外源码节点和国内目标节点",
        "海外完整包下载到本地暂存目录",
        "本地校验MANIFEST",
        "上传到国内目标的隔离incoming目录",
        "目标端再次校验MANIFEST",
        "仅替换隔离候选release",
        "重启并验证候选服务",
        "保留旧生产仓库且不自动切流"
      ],
      "forbidden_route_markers": [
        "猜测服务器地址",
        "把私钥写进仓库",
        "直接覆盖正在运行的release",
        "未校验就启动",
        "自动切换/code/",
        "删除旧Gitea",
        "借读取权限执行服务器写入",
        "根据短提交补写40位提交"
      ],
      "deprecated_route_markers": [
        "先让海外服务器直连国内服务器",
        "使用旧Gatekeeper任意命令接口",
        "从国内节点重复下载海外上游"
      ],
      "evidence": [
        "deployment/navigation-maps/JD-FD-PRIMARY.json",
        "deployment/receipts/HLCC-BS-SG-003-OFFLINE-PACK-20260723.json",
        "gls/GLS-0237-HOLOLAKE-CODE-CHANNEL-SOVEREIGN-SOURCE-UPDATE-AND-EMBEDDING.hdlp"
      ],
      "freshness": {
        "check": "Verify both node identities and package hashes in the current session.",
        "max_age_seconds": 10800
      },
      "authorization": "Transfer and candidate restart require explicit scoped server authority. Production cutover is a separate action.",
      "recovery_route": [
        "Keep the running service unchanged",
        "Return the package to an isolated incoming directory",
        "Re-verify manifest, signature, target data root and node identity"
      ],
      "enforcement_level": "PROMOTED_SKILL",
      "experience_receipts": [
        "EXP-20260726-004-ENTERPRISE-DATA-DISK-ABSENT"
      ]
    },
    {
      "id": "GHS-003-REPOSITORY-PUSH-PROOF-SEPARATION",
      "hldp_skill": "SKILL-011",
      "gls_id": "GLS-0238",
      "title": "代码频道跨实例推送的授权、传输、执行与回执分离",
      "intents": [
        "推送代码频道",
        "待推送提交",
        "远端提交落后",
        "仓库为什么推不上去",
        "恢复仓库推送",
        "repo push",
        "Forgejo令牌"
      ],
      "preferred_route": [
        "核验当前仓库角色、远端、分支和提交",
        "核验当前实例的授权状态",
        "核验当前实例的实际传输方式",
        "执行有界推送",
        "从远端读回完整提交",
        "撤销临时传输凭据并写回执"
      ],
      "forbidden_route_markers": [
        "复用历史访问令牌",
        "把授权单当作已经推送",
        "没有传输方式仍报告成功",
        "打印访问令牌",
        "把个人源码推到团队部署仓"
      ],
      "deprecated_route_markers": [
        "只看浏览器页面判断推送权限",
        "沿用上一实例的临时凭据"
      ],
      "evidence": [
        "server-tools/lake-lamp-authz/authorize-repo-push.js",
        "routing/repository-route-map.json",
        "gls/GLS-0241-HOLOLAKE-SOURCE-OWNERSHIP-AND-DEPLOYMENT-ROUTING.hdlp"
      ],
      "freshness": {
        "check": "Read the exact remote branch and verify current transport immediately before push.",
        "max_age_seconds": 900
      },
      "authorization": "Repository approval does not create a credential or prove a push. Temporary credentials require their own controlled lifecycle.",
      "recovery_route": [
        "Stop before push",
        "Keep local commits intact",
        "Re-resolve repository identity and obtain a current bounded transport"
      ],
      "enforcement_level": "PROMOTED_SKILL",
      "experience_receipts": [
        "EXP-20260726-001-AUTHORIZATION-IS-NOT-TRANSPORT"
      ]
    },
    {
      "id": "GHS-004-AW-ENTERPRISE-HLCC-CANDIDATE",
      "hldp_skill": "SKILL-012",
      "gls_id": "GLS-0243",
      "title": "AW-GZ-001 企业代码频道隔离候选部署",
      "intents": [
        "企业服务器光湖代码频道",
        "AW-GZ-001部署",
        "企业Forgejo",
        "企业代码仓库离线包",
        "企业代码频道候选",
        "恢复企业代码频道",
        "恢复AW-GZ-001企业代码频道"
      ],
      "preferred_route": [
        "读取并确认AW-GZ-001节点地图",
        "只读检查现有Gitea、灯塔、端口和数据盘",
        "上传离线包到隔离暂存区",
        "逐文件校验MANIFEST和上游签名",
        "确认独立企业数据根",
        "安装Forgejo到127.0.0.1:3340隔离候选",
        "导入光湖代码频道bundle",
        "验证候选健康、仓库和禁用更新策略",
        "写部署回执且不自动切换公网路由"
      ],
      "forbidden_route_markers": [
        "绕过AW导航映射",
        "使用旧3910驱动执行任意命令",
        "使用历史密钥重试",
        "把缺失的data盘当作已挂载",
        "覆盖现有3000端口Gitea",
        "未验签就启动Forgejo",
        "自动切换企业公网代码入口"
      ],
      "deprecated_route_markers": [
        "从海外节点直接拉取生产包",
        "把个人第五域源码作为企业团队部署源"
      ],
      "evidence": [
        "deployment/navigation-maps/AW-GZ-001.json",
        "deployment/HLCC-ENTERPRISE-INSTALL-GUIDE-AWEN.hdlp",
        "deployment/receipts/HLCC-BS-SG-003-OFFLINE-PACK-20260723.json",
        "server-tools/hololake-code-channel/"
      ],
      "freshness": {
        "check": "Verify live storage, ports, services, package hashes and node identity in the current console session.",
        "max_age_seconds": 1800
      },
      "authorization": "Official-console access permits only the user-requested bounded deployment. Credentials, security settings and public cutover remain separate actions.",
      "recovery_route": [
        "Leave the existing Gitea and nginx routes unchanged",
        "Stop or remove only the isolated candidate after recording its state",
        "Restore the declared data disk or register a deliberate replacement data root",
        "Resume from the deployment checkpoint"
      ],
      "enforcement_level": "CANDIDATE_ONLY",
      "experience_receipts": [
        "EXP-20260726-002-AW-MAP-GATE",
        "EXP-20260726-003-LEGACY-DRIVER-ROTATED",
        "EXP-20260726-004-ENTERPRISE-DATA-DISK-ABSENT"
      ]
    }
  ]
}