feat(tcs): establish five-domain mother brain runtime

server-tools/code-channel-snapshot-admission/README.md

@@ -0,0 +1,5 @@
+# REPO-012 公共快照服务器入口门禁
+
+本门禁在 `refs/heads/main` 更新前，从待接收提交直接读取公共锚点与其声明地图。任何编号或版本不一致都会拒绝推送，使无效快照无法再进入服务器主分支。
+
+安装时必须串联保留 Forgejo 现有 `pre-receive`，不得覆盖认证、配额或其他安全钩子。安装和回滚路径属于服务器私有部署回执，不在公开仓库记录裸仓绝对路径。

server-tools/code-channel-snapshot-admission/pre-receive

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -eu
+
+validator="$(dirname "$0")/validate-public-snapshot-at-commit.js"
+while read -r old_value new_value ref_name; do
+  [ "$ref_name" = "refs/heads/main" ] || continue
+  [ "$new_value" = "0000000000000000000000000000000000000000" ] && {
+    echo "REPO-012 main deletion is forbidden" >&2
+    exit 1
+  }
+  node "$validator" --git-dir "$(git rev-parse --git-dir)" --commit "$new_value"
+done

server-tools/code-channel-snapshot-admission/validate-public-snapshot-at-commit.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+"use strict";
+
+const { execFileSync } = require("node:child_process");
+
+function parse(argv) {
+  const result = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const key = argv[index];
+    if (key === "--git-dir") result.gitDir = argv[++index];
+    else if (key === "--commit") result.commit = argv[++index];
+    else throw new Error(`unknown_argument:${key}`);
+  }
+  if (!result.gitDir || !/^[0-9a-f]{40}$/.test(result.commit || "")) throw new Error("git_dir_and_commit_required");
+  return result;
+}
+
+function readJson(gitDir, commit, file) {
+  return JSON.parse(execFileSync("git", [`--git-dir=${gitDir}`, "show", `${commit}:${file}`], { encoding: "utf8", maxBuffer: 4 * 1024 * 1024 }));
+}
+
+function validate({ gitDir, commit }) {
+  const anchorPath = "routing/public-navigation-anchor.json";
+  const anchor = readJson(gitDir, commit, anchorPath);
+  if (anchor.schema !== "guanghu.public-navigation-anchor/v1" || anchor.anchor_id !== "GLW-PUBLIC-NAV-ANCHOR-001") throw new Error("invalid_public_anchor");
+  const atomicKeys = ["repository", "nodes", "subjects", "aliases", "identity_authority", "navigation", "lighthouse_paths", "host_skills", "mother_brain"];
+  for (const key of atomicKeys) {
+    const declaration = anchor.maps?.[key];
+    if (!declaration || typeof declaration.path !== "string" || !/^(routing|identity)\/[A-Za-z0-9._/-]+\.json$/.test(declaration.path) || declaration.path.includes("..")) throw new Error(`invalid_snapshot_path:${key}`);
+    const map = readJson(gitDir, commit, declaration.path);
+    if (declaration.id && ![map.map_id, map.registry_id].includes(declaration.id)) throw new Error(`snapshot_map_id_mismatch:${key}`);
+    if (declaration.version && map.version !== declaration.version) throw new Error(`snapshot_map_version_mismatch:${key}`);
+  }
+  return { result: "PASS_100", commit, anchor_version: anchor.version };
+}
+
+try {
+  process.stdout.write(`${JSON.stringify(validate(parse(process.argv.slice(2))))}\n`);
+} catch (error) {
+  process.stderr.write(`REPO012_SNAPSHOT_ADMISSION_FAIL_0:${String(error.message || error)}\n`);
+  process.exitCode = 1;
+}
+
+module.exports = { parse, validate };