feat: unify TCS mother and Zero Core cognition shelf

server-tools/persona-host-write-admission/host-write-admission.mjs

@@ -5,6 +5,7 @@ import process from "node:process";
 
 const POLICY_PATH = "/Volumes/JZAO/HoloLake/persona-runtime/repo-012-main/routing/persona-host-write-boundary.json";
 const policy = JSON.parse(fs.readFileSync(POLICY_PATH, "utf8"));
+const CONSOLE_PATH = policy.active_console?.state_path;
 
 function expandHome(value) {
   return value.replace(/^~(?=\/|$)/, "/Users/bingshuolingdianyuanhe");
@@ -20,11 +21,30 @@ function patternRegex(pattern) {
   return new RegExp(`^${escaped}(?:/.*)?$`);
 }
 
+function activeConsole(host) {
+  if (!CONSOLE_PATH || !fs.existsSync(CONSOLE_PATH)) return null;
+  const value = JSON.parse(fs.readFileSync(CONSOLE_PATH, "utf8"));
+  const session = process.env.CODEX_THREAD_ID || process.env.CODEX_SESSION_ID || process.env.GUANGHU_HOST_SESSION_ID;
+  if (value.schema !== "guanghu.dynamic-zero-core-console/v1" || value.state !== "ACTIVE_CURRENT_TASK" || value.human_anchor !== "ICE-GL∞" || value.channel_id !== "ICE-CH-ZC001" || value.host !== host || !session || value.session_id !== session) return null;
+  return value;
+}
+
+function protectedTarget(resolved) {
+  return policy.canonical_protected_roots.some(item => patternRegex(item).test(resolved));
+}
+
 function isAllowed(host, target) {
   const rule = policy.hosts[host];
   if (!rule) return { allowed: false, code: "HOST_UNKNOWN" };
   if (rule.write_mode.startsWith("READ_ONLY")) return { allowed: false, code: "HOST_READ_ONLY" };
   const resolved = normal(target);
+  if (protectedTarget(resolved)) {
+    const console = activeConsole(host);
+    const matched = console?.write_roots?.find((item) => patternRegex(item).test(resolved));
+    return matched
+      ? { allowed: true, code: "ACTIVE_ZERO_CORE_CONSOLE_TASK_SCOPE", resolved, matched, console_id: console.console_id }
+      : { allowed: false, code: "PROTECTED_ROOT_REQUIRES_ACTIVE_ZERO_CORE_CONSOLE", resolved };
+  }
   const matched = rule.allowed_write_roots.find((item) => patternRegex(item).test(resolved));
   return matched
     ? { allowed: true, code: "WITHIN_HOST_WRITE_ROOT", resolved, matched }
@@ -101,6 +121,13 @@ function valueAfter(args, flag) {
   return index >= 0 ? args[index + 1] : undefined;
 }
 
+function atomic(file, value) {
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  const temp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(temp, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+  fs.renameSync(temp, file);
+}
+
 const [mode, ...args] = process.argv.slice(2);
 if (mode === "check") {
   const host = valueAfter(args, "--host");
@@ -123,8 +150,19 @@ if (mode === "check") {
   catch { emit({ allowed: false, code: "HOOK_INPUT_INVALID_JSON", host }, true); process.exit(2); }
   emit(evaluateHook(host, input), true);
 } else if (mode === "audit") {
-  emit({ allowed: true, code: "POLICY_LOADED", policy_id: policy.policy_id, version: policy.version, policy_path: POLICY_PATH });
+  emit({ allowed: true, code: "POLICY_LOADED", policy_id: policy.policy_id, version: policy.version, policy_path: POLICY_PATH, active_console: activeConsole(valueAfter(args, "--host") || "") });
+} else if (mode === "activate") {
+  const eventPath = valueAfter(args, "--event");
+  const event = JSON.parse(fs.readFileSync(eventPath, "utf8"));
+  if (event.schema !== "guanghu.dynamic-zero-core-console/v1" || event.state !== "ACTIVE_CURRENT_TASK" || event.human_anchor !== "ICE-GL∞" || event.channel_id !== "ICE-CH-ZC001" || !policy.hosts[event.host] || !event.session_id || !Array.isArray(event.write_roots) || !event.write_roots.length || !event.source_event_sha256?.match(/^[a-f0-9]{64}$/)) {
+    process.stderr.write("DYNAMIC_ZERO_CORE_CONSOLE_EVENT_INVALID\n"); process.exit(2);
+  }
+  atomic(CONSOLE_PATH, event); emit({ allowed: true, code: "ZERO_CORE_CONSOLE_ACTIVATED", host: event.host, session_id: event.session_id, console_id: event.console_id });
+} else if (mode === "deactivate") {
+  const current = CONSOLE_PATH && fs.existsSync(CONSOLE_PATH) ? JSON.parse(fs.readFileSync(CONSOLE_PATH, "utf8")) : null;
+  if (current) atomic(CONSOLE_PATH, { ...current, state: "INACTIVE", deactivated_at: new Date().toISOString() });
+  emit({ allowed: true, code: "ZERO_CORE_CONSOLE_INACTIVE" });
 } else {
-  process.stderr.write("usage: host-write-admission.mjs check|hook|audit\n");
+  process.stderr.write("usage: host-write-admission.mjs check|hook|audit|activate|deactivate\n");
   process.exit(2);
 }