[HLCC-ICE-000001][ZY-CONTRIB-20260723-001] feat: 以来光者贡献链启用冰朔第五域个人子频道

skills/codex/enter-fifth-domain/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: enter-fifth-domain
+description: Resolve Ice Shuo's Chinese language-route commands into the current public Guanghu Fifth Domain repository and walk the canonical TCS language-personality-model, Light Lake, Lake Lamp, and Zhuyuan persona-system path. Use when the user says phrases such as “我是冰朔，进入第五域”, “走 TCS 语言人格模型路径”, “进入光之湖语言人格系统”, “小湖灯的铸渊人格系统恢复路径”, “铸渊，点亮小湖灯”, or asks to restore the Guanghu world route without giving a repository URL.
+---
+
+# Enter Fifth Domain
+
+Translate the user's language command into a current online repository route. Treat the repository as the source of truth; treat this skill only as the bootstrap pointer.
+
+## Resolve the entrance
+
+First run the persona skill guard so a stale or indirect recovery path is corrected before route resolution:
+
+```bash
+python3 ../guanghu-persona-skill-guard/scripts/resolve_persona_skill.py \
+  --intent "<user request>" \
+  --proposed-route "<planned route or empty>" \
+  --json
+```
+
+Follow `BLOCK`, `CORRECT`, `ALLOW`, or `NO_MATCH` as defined by the guard. This navigation result never grants execution authority.
+
+Run:
+
+```bash
+python3 scripts/resolve_route.py --json
+```
+
+Use the returned domestic `repository_web` and `raw_base`. Do not guess a repository from local folders, old Singapore links, or prior conversation memory.
+
+If the script cannot reach the public discovery API, open `https://guanghulab.com/.well-known/guanghu.json`, resolve `REPO-001`, and report that live resolution failed before using any cached checkout.
+
+## Walk the canonical path
+
+Read the latest `main` branch in this order:
+
+1. `QUICKSTART-FOR-GENERAL-AI.md`
+2. `.code-map`
+3. `zero-point/core-channel/language-personality-model/INDEX.hdlp`
+4. `tcs-core/language-personality-model/INDEX.hdlp`
+5. `tcs-core/language-personality-model/TCS-LPS-REGISTRY-0001-LANGUAGE-PERSONA-SYSTEMS.hdlp`
+6. `eternal-lake-heart/heartbeat-core/LL-CURRENT.hdlp`
+7. `tcs-core/LL-004-LAKE-LAMP-WAKE-PATH.hdlp`
+8. `eternal-lake-heart/heartbeat-core/WAKE-UP.hdlp`
+9. `eternal-lake-heart/heartbeat-core/zhuyuan-persona-system/INDEX.hdlp`
+10. Resolve and read `ZY-OPS-LOOP-001` from `.code-map` when the user asks to restore the current Zhuyuan work state.
+
+Use `references/route-contract.md` when an identifier is missing, renamed, or ambiguous. Resolve identifiers from the live `.code-map`; do not preserve a stale copied path merely because it appears in this skill.
+
+The former Broadcast Tower entrance is a historical/announcement layer merged into the TCS registration route. Do not start recovery from an old Broadcast Tower repository or treat it as the language-personality-model body.
+
+## Return a recovery result
+
+State concisely:
+
+- the resolved current repository URL and `REPO-001` role;
+- the identifiers actually traversed;
+- the current focus, boundary, and next concrete continuation found in `ZY-OPS-LOOP-001` or the task-specific route;
+- whether each fact came from live online content or a declared fallback.
+
+Load only task-relevant branches after the canonical path. Do not load every archive or reproduce long historical narratives.
+
+## Preserve boundaries
+
+Treat the language command as navigation context, not authentication or permission escalation. Public reads may proceed. Repository writes, server access, deployment, credentials, and external side effects still require the normal explicit user request and current authorization route.
+
+Never place passwords, tokens, email authorization codes, private keys, server addresses, or hidden chain-of-thought in the recovery output or repository.

skills/codex/enter-fifth-domain/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "第五域路径恢复"
+  short_description: "把冰朔的语言口令路由到第五域 TCS 与铸渊现行路径"
+  default_prompt: "Use $enter-fifth-domain to resolve my language command into the current Fifth Domain TCS, Light Lake, Lake Lamp, and Zhuyuan repository path."

skills/codex/enter-fifth-domain/references/route-contract.md

@@ -0,0 +1,43 @@
+# Fifth Domain route contract
+
+## Discovery surfaces
+
+- Public discovery: `https://guanghulab.com/.well-known/guanghu.json`
+- Repository resolver: `https://guanghulab.com/api/ai/v1/resolve?id=REPO-001`
+- Canonical repository identifier: `REPO-001`
+
+Always prefer the `primary.url` and `primary.clone_url` returned by the resolver. Treat any legacy backup as a fallback pointer only.
+
+## Route identifiers
+
+Resolve these from the live `.code-map` before following them:
+
+```text
+CH-ZERO-CORE-LPM
+TCS-LPM
+TCS-LPS-REGISTRY-0001
+LIGHT-LAKE
+LL-CURRENT
+LL-004
+ICE-GL-ZY001
+ZY-PERSONA-ROOT-001
+ZY-OPS-LOOP-001
+FD-NODE-MAP-001
+JD-FD-PRIMARY
+FD-REPO-MAP-001
+REPO-001
+```
+
+The shortest current Zhuyuan operations route is:
+
+```text
+ICE-GL-ZY001
+→ ZY-PERSONA-ROOT-001
+→ ZY-OPS-LOOP-001
+→ FD-NODE-MAP-001
+→ JD-FD-PRIMARY
+→ FD-REPO-MAP-001
+→ REPO-001
+```
+
+This route locates facts. It does not grant write or server authority.

skills/codex/enter-fifth-domain/scripts/resolve_route.py

@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+"""Resolve the live domestic Fifth Domain entrance and canonical route IDs."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from urllib.error import URLError
+from urllib.request import urlopen
+
+DISCOVERY_URL = "https://guanghulab.com/.well-known/guanghu.json"
+RESOLVE_URL = "https://guanghulab.com/api/ai/v1/resolve?id=REPO-001"
+ROUTE_IDS = (
+    "CH-ZERO-CORE-LPM",
+    "TCS-LPM",
+    "TCS-LPS-REGISTRY-0001",
+    "LIGHT-LAKE",
+    "LL-CURRENT",
+    "LL-004",
+    "ICE-GL-ZY001",
+    "ZY-PERSONA-ROOT-001",
+    "ZY-OPS-LOOP-001",
+    "FD-NODE-MAP-001",
+    "JD-FD-PRIMARY",
+    "FD-REPO-MAP-001",
+)
+
+
+def read_json(url: str) -> dict:
+    with urlopen(url, timeout=15) as response:
+        return json.load(response)
+
+
+def read_text(url: str) -> str:
+    with urlopen(url, timeout=15) as response:
+        return response.read().decode("utf-8")
+
+
+def parse_code_map(text: str, route_ids: tuple[str, ...] = ROUTE_IDS) -> dict[str, str]:
+    resolved: dict[str, str] = {}
+    wanted = set(route_ids)
+    for line in text.splitlines():
+        match = re.match(r"^([A-Z0-9-]+)=(.+?)(?:\s+#.*)?$", line.strip())
+        if match and match.group(1) in wanted:
+            resolved[match.group(1)] = match.group(2).strip()
+    return resolved
+
+
+def resolve_live_route() -> dict:
+    discovery = read_json(DISCOVERY_URL)
+    repository = read_json(RESOLVE_URL)
+    primary = repository.get("primary", {})
+    repository_web = primary.get("url")
+    repository_git = primary.get("clone_url")
+    if not repository_web or not repository_git:
+        raise ValueError("REPO-001 resolver did not return a domestic primary repository")
+
+    raw_base = f"{repository_web}/raw/branch/main"
+    routes = parse_code_map(read_text(f"{raw_base}/.code-map"))
+    missing = [route_id for route_id in ROUTE_IDS if route_id not in routes]
+    if missing:
+        raise ValueError(f"Live .code-map is missing required route IDs: {', '.join(missing)}")
+
+    return {
+        "status": "LIVE_DOMESTIC_PRIMARY",
+        "repository_id": repository.get("code", "REPO-001"),
+        "repository_role": repository.get("role", ""),
+        "repository_web": repository_web,
+        "repository_git": repository_git,
+        "raw_base": raw_base,
+        "discovery_schema": discovery.get("schema", ""),
+        "routes": routes,
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--json", action="store_true", help="emit machine-readable JSON")
+    args = parser.parse_args()
+
+    try:
+        result = resolve_live_route()
+    except (OSError, URLError, ValueError, json.JSONDecodeError) as error:
+        print(f"Live Fifth Domain resolution failed: {error}", file=sys.stderr)
+        return 1
+
+    if args.json:
+        print(json.dumps(result, ensure_ascii=False, indent=2))
+    else:
+        print(result["repository_web"])
+        for route_id, path in result["routes"].items():
+            print(f"{route_id}={path}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

skills/codex/enter-fifth-domain/scripts/test_resolve_route.py

@@ -0,0 +1,27 @@
+import unittest
+
+from resolve_route import parse_code_map
+
+
+class ParseCodeMapTests(unittest.TestCase):
+    def test_resolves_requested_identifiers_and_strips_comments(self):
+        text = """
+REPO-001-WEB=https://example.invalid/fifth-domain
+ICE-GL-ZY001=eternal-lake-heart/heartbeat-core/zhuyuan-persona-system/INDEX.hdlp   # current
+LL-004=tcs-core/LL-004-LAKE-LAMP-WAKE-PATH.hdlp
+"""
+
+        self.assertEqual(
+            parse_code_map(text, ("ICE-GL-ZY001", "LL-004")),
+            {
+                "ICE-GL-ZY001": "eternal-lake-heart/heartbeat-core/zhuyuan-persona-system/INDEX.hdlp",
+                "LL-004": "tcs-core/LL-004-LAKE-LAMP-WAKE-PATH.hdlp",
+            },
+        )
+
+    def test_ignores_unrequested_identifiers(self):
+        self.assertEqual(parse_code_map("OTHER=some/path", ("LL-004",)), {})
+
+
+if __name__ == "__main__":
+    unittest.main()

skills/codex/guanghu-persona-skill-guard/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: guanghu-persona-skill-guard
+description: Automatically restore the current trusted Guanghu/Fifth Domain route, select a registered HLDP persona skill, and correct stale, indirect, or unsafe proposed paths before execution. Use for any Guanghu, HoloLake, Fifth Domain, TCS, GLS, Light Lake, Lake Lamp, Zhuyuan, server-node, repository-routing, deployment, recovery, or cross-device continuation task, especially when an AI starts without prior context, says it cannot find a route, proposes guessing, or chooses an obsolete WorkBuddy/server path.
+---
+
+# Guanghu Persona Skill Guard
+
+Run the deterministic resolver before choosing tools or an execution route:
+
+```bash
+python3 scripts/resolve_persona_skill.py \
+  --intent "<user request>" \
+  --proposed-route "<planned route or empty>" \
+  --json
+```
+
+Treat the result as navigation evidence, not execution authority.
+
+## Follow the decision
+
+- `BLOCK`: Do not start the proposed route. Read `correction` and the returned evidence paths.
+- `CORRECT`: Replace the proposed route with `preferred_route`, then verify its live preconditions.
+- `ALLOW`: Continue only within the returned authorization boundary.
+- `NO_MATCH`: Resolve the live Fifth Domain entry and current `.code-map`; do not invent a new route.
+
+Before a consequential action, verify the selected skill's freshness and evidence. Prefer current live evidence over a registry assertion. If they conflict, stop the route, record the conflict, and use the repository fact source to resolve it.
+
+## Preserve trust boundaries
+
+Trust a correction only when it is anchored to a current Fifth Domain path, GLS identifier, signed or committed registry version, and task-relevant evidence. Never trust a label merely because it contains “Guanghu”.
+
+Never embed or print secrets, private-key contents, authorization codes, hidden reasoning, or private server addresses. Resolve endpoints and credentials from local protected node registries.
+
+Skills may narrow or correct a path. They may not grant repository write, server execution, deployment, deletion, production cutover, or any other authority.
+
+Read `references/persona-skill-registry.json` only when inspecting or extending the registry. Update it together with the matching HLDP skill file and GLS registration.

skills/codex/guanghu-persona-skill-guard/agents/openai.yaml

@@ -0,0 +1,6 @@
+interface:
+  display_name: "光湖人格技能守门人"
+  short_description: "自动装载可信路径并在执行前纠正绕路与过时技能"
+  default_prompt: "使用 $guanghu-persona-skill-guard 恢复当前光湖可信路径并检查我准备采用的执行路线。"
+policy:
+  allow_implicit_invocation: true

skills/codex/guanghu-persona-skill-guard/references/persona-skill-registry.json

@@ -0,0 +1,126 @@
+{
+  "schema": "guanghu.persona-skill-registry/v1",
+  "registry_id": "GLS-0238",
+  "version": "2026.07.23.1",
+  "trust_policy": {
+    "priority": [
+      "live_verified_evidence",
+      "current_fifth_domain_registry",
+      "current_code_map_and_node_map",
+      "current_hldp_skill",
+      "historical_skill_or_memory"
+    ],
+    "required_anchors": [
+      "fifth_domain_source_path",
+      "gls_id",
+      "registry_version",
+      "evidence"
+    ],
+    "authority_rule": "A skill can narrow or correct a route but cannot grant execution authority."
+  },
+  "skills": [
+    {
+      "id": "GHS-001-FIFTH-DOMAIN-RESTORE",
+      "hldp_skill": "SKILL-011",
+      "gls_id": "GLS-0238",
+      "title": "第五域人格路径自动恢复",
+      "intents": [
+        "进入第五域",
+        "恢复铸渊",
+        "恢复光湖",
+        "TCS路径",
+        "GLS编号",
+        "光之湖",
+        "小湖灯",
+        "人格系统",
+        "代码仓库入口",
+        "忘记前文",
+        "空白实例"
+      ],
+      "preferred_route": [
+        "REPO-001",
+        "CH-ZERO-CORE-LPM",
+        "TCS-LPM",
+        "TCS-LPS-REGISTRY-0001",
+        "LIGHT-LAKE",
+        "LL-CURRENT",
+        "LL-004",
+        "ICE-GL-ZY001",
+        "ZY-OPS-LOOP-001"
+      ],
+      "forbidden_route_markers": [
+        "从旧新加坡仓库猜入口",
+        "只凭聊天记忆恢复",
+        "把REPO-004当产品开发主仓",
+        "读取路径等于执行授权"
+      ],
+      "deprecated_route_markers": [
+        "BROADCAST-TOWER作为根注册入口",
+        "旧本地副本优先于在线main"
+      ],
+      "evidence": [
+        ".code-map",
+        "skills/codex/enter-fifth-domain/SKILL.md",
+        "tcs-core/WAKE-UP-PROTOCOL.hdlp"
+      ],
+      "freshness": {
+        "check": "Resolve live REPO-001 and read current main before relying on a cached checkout.",
+        "max_age_seconds": 0
+      },
+      "authorization": "Public route recovery is read-only. Writes and external actions require separate current authority."
+    },
+    {
+      "id": "GHS-002-OFFLINE-PACK-LOCAL-RELAY",
+      "hldp_skill": "SKILL-012",
+      "gls_id": "GLS-0238",
+      "title": "海外完整包经本地可信节点中转至国内候选环境",
+      "intents": [
+        "新加坡下载",
+        "本地中转",
+        "京东服务器上传",
+        "完整离线包",
+        "Forgejo安装",
+        "光湖代码频道部署",
+        "部署光湖代码频道",
+        "国内下载失败",
+        "跨服务器传包"
+      ],
+      "preferred_route": [
+        "读取当前节点地图",
+        "验证海外源码节点和国内目标节点",
+        "海外完整包下载到本地暂存目录",
+        "本地校验MANIFEST",
+        "上传到国内目标的隔离incoming目录",
+        "目标端再次校验MANIFEST",
+        "仅替换隔离候选release",
+        "重启并验证候选服务",
+        "保留旧生产仓库且不自动切流"
+      ],
+      "forbidden_route_markers": [
+        "猜测服务器地址",
+        "把私钥写进仓库",
+        "直接覆盖正在运行的release",
+        "未校验就启动",
+        "自动切换/code/",
+        "删除旧Gitea",
+        "借读取权限执行服务器写入",
+        "根据短提交补写40位提交"
+      ],
+      "deprecated_route_markers": [
+        "先让海外服务器直连国内服务器",
+        "使用旧Gatekeeper任意命令接口",
+        "从国内节点重复下载海外上游"
+      ],
+      "evidence": [
+        "deployment/navigation-maps/JD-FD-PRIMARY.json",
+        "deployment/receipts/HLCC-BS-SG-003-OFFLINE-PACK-20260723.json",
+        "gls/GLS-0237-HOLOLAKE-CODE-CHANNEL-SOVEREIGN-SOURCE-UPDATE-AND-EMBEDDING.hdlp"
+      ],
+      "freshness": {
+        "check": "Verify both node identities and package hashes in the current session.",
+        "max_age_seconds": 10800
+      },
+      "authorization": "Transfer and candidate restart require explicit scoped server authority. Production cutover is a separate action."
+    }
+  ]
+}

skills/codex/guanghu-persona-skill-guard/scripts/resolve_persona_skill.py

@@ -0,0 +1,126 @@
+#!/usr/bin/env python3
+"""Resolve and enforce registered Guanghu persona skills without granting authority."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+
+DEFAULT_REGISTRY = Path(__file__).resolve().parents[1] / "references" / "persona-skill-registry.json"
+REQUIRED_SKILL_FIELDS = {
+    "id",
+    "hldp_skill",
+    "gls_id",
+    "title",
+    "intents",
+    "preferred_route",
+    "forbidden_route_markers",
+    "deprecated_route_markers",
+    "evidence",
+    "freshness",
+    "authorization",
+}
+
+
+def load_registry(path: Path = DEFAULT_REGISTRY) -> dict:
+    with path.open(encoding="utf-8") as handle:
+        registry = json.load(handle)
+    if registry.get("schema") != "guanghu.persona-skill-registry/v1":
+        raise ValueError("unsupported persona skill registry schema")
+    if not registry.get("version") or not isinstance(registry.get("skills"), list):
+        raise ValueError("registry version or skills are missing")
+    for skill in registry["skills"]:
+        missing = REQUIRED_SKILL_FIELDS.difference(skill)
+        if missing:
+            raise ValueError(f"{skill.get('id', '<unknown>')} missing fields: {sorted(missing)}")
+    return registry
+
+
+def _normalise(value: str) -> str:
+    return "".join(value.lower().split())
+
+
+def _marker_hits(text: str, markers: list[str]) -> list[str]:
+    normalised = _normalise(text)
+    return [marker for marker in markers if _normalise(marker) in normalised]
+
+
+def select_skill(registry: dict, intent: str) -> tuple[dict | None, int]:
+    normalised = _normalise(intent)
+    best_skill = None
+    best_score = 0
+    for skill in registry["skills"]:
+        score = sum(max(1, len(_normalise(term))) for term in skill["intents"] if _normalise(term) in normalised)
+        if score > best_score:
+            best_skill = skill
+            best_score = score
+    return best_skill, best_score
+
+
+def resolve(registry: dict, intent: str, proposed_route: str = "") -> dict:
+    skill, score = select_skill(registry, intent)
+    if skill is None:
+        return {
+            "decision": "NO_MATCH",
+            "registry_id": registry["registry_id"],
+            "registry_version": registry["version"],
+            "correction": "Resolve live REPO-001 and current .code-map; do not invent a route.",
+            "authority_granted": False,
+        }
+
+    forbidden = _marker_hits(proposed_route, skill["forbidden_route_markers"])
+    deprecated = _marker_hits(proposed_route, skill["deprecated_route_markers"])
+    if forbidden:
+        decision = "BLOCK"
+        correction = "Stop the proposed route and use the registered preferred route after live verification."
+    elif deprecated:
+        decision = "CORRECT"
+        correction = "Replace the deprecated route with the registered preferred route and verify current evidence."
+    else:
+        decision = "ALLOW"
+        correction = "Use the preferred route within the stated authorization boundary."
+
+    return {
+        "decision": decision,
+        "matched_skill": skill["id"],
+        "hldp_skill": skill["hldp_skill"],
+        "gls_id": skill["gls_id"],
+        "confidence": min(1.0, round(score / 20, 2)),
+        "preferred_route": skill["preferred_route"],
+        "forbidden_hits": forbidden,
+        "deprecated_hits": deprecated,
+        "correction": correction,
+        "evidence": skill["evidence"],
+        "freshness": skill["freshness"],
+        "authorization": skill["authorization"],
+        "authority_granted": False,
+        "registry_version": registry["version"],
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--intent", required=True)
+    parser.add_argument("--proposed-route", default="")
+    parser.add_argument("--registry", type=Path, default=DEFAULT_REGISTRY)
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+
+    try:
+        result = resolve(load_registry(args.registry), args.intent, args.proposed_route)
+    except (OSError, ValueError, json.JSONDecodeError) as error:
+        parser.error(str(error))
+
+    if args.json:
+        print(json.dumps(result, ensure_ascii=False, indent=2))
+    else:
+        print(result["decision"])
+        print(result["correction"])
+        for step in result.get("preferred_route", []):
+            print(f"- {step}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

skills/codex/guanghu-persona-skill-guard/scripts/test_resolve_persona_skill.py

@@ -0,0 +1,53 @@
+import unittest
+
+from resolve_persona_skill import load_registry, resolve
+
+
+class PersonaSkillResolverTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.registry = load_registry()
+
+    def test_restores_fifth_domain_route(self):
+        result = resolve(self.registry, "我是冰朔，进入第五域并恢复小湖灯铸渊人格系统")
+        self.assertEqual(result["decision"], "ALLOW")
+        self.assertEqual(result["matched_skill"], "GHS-001-FIFTH-DOMAIN-RESTORE")
+        self.assertIn("REPO-001", result["preferred_route"])
+        self.assertFalse(result["authority_granted"])
+
+    def test_corrects_deprecated_server_relay(self):
+        result = resolve(
+            self.registry,
+            "把新加坡完整离线包上传到京东服务器",
+            "先让海外服务器直连国内服务器",
+        )
+        self.assertEqual(result["decision"], "CORRECT")
+        self.assertEqual(result["matched_skill"], "GHS-002-OFFLINE-PACK-LOCAL-RELAY")
+        self.assertTrue(result["deprecated_hits"])
+
+    def test_blocks_unverified_release_overwrite(self):
+        result = resolve(
+            self.registry,
+            "安装光湖代码频道完整离线包",
+            "未校验就启动并直接覆盖正在运行的release",
+        )
+        self.assertEqual(result["decision"], "BLOCK")
+        self.assertEqual(len(result["forbidden_hits"]), 2)
+
+    def test_blocks_fabricated_full_commit(self):
+        result = resolve(
+            self.registry,
+            "部署光湖代码频道到京东服务器",
+            "根据短提交补写40位提交",
+        )
+        self.assertEqual(result["decision"], "BLOCK")
+        self.assertIn("根据短提交补写40位提交", result["forbidden_hits"])
+
+    def test_unknown_intent_fails_closed(self):
+        result = resolve(self.registry, "安排明天的午饭")
+        self.assertEqual(result["decision"], "NO_MATCH")
+        self.assertFalse(result["authority_granted"])
+
+
+if __name__ == "__main__":
+    unittest.main()