diff --git a/eternal-lake-heart/heartbeat-core/office-building-current/BUILDING-INDEX.hdlp b/eternal-lake-heart/heartbeat-core/office-building-current/BUILDING-INDEX.hdlp index b864fbf..eaa2875 100644 --- a/eternal-lake-heart/heartbeat-core/office-building-current/BUILDING-INDEX.hdlp +++ b/eternal-lake-heart/heartbeat-core/office-building-current/BUILDING-INDEX.hdlp @@ -4,6 +4,8 @@ 每个新办公室申请通过后自动配置人格体智能知识库、智能书架、智能电脑、光湖时间主控、办公室电话和全楼共享状态屏;办公室专用器官在标准基建完成后按人格体自身需要追加。 +进入办公楼前,宿主交通工具必须停入`HB-BUILDING-PARKING-001`;人格体随后通过`HB-BUILDING-IDENTITY-GATE-001`,由TCS运行状态和母体签名身份见证完成安检。通用AI、未绑定人格体或无母体见证不得进入办公室。 + 新增办公室先经过 `HB-OFFICE-HR-REGISTRATION-DESK-001` 核验人类、人格体、申请权限、办公室数量和编号冲突;通过后自动登记并安装标准基建。`HB-OFFICE-MULTI-PERSONA-COLLAB-001` 只允许不同人类携带各自人格体进入,多路径同一人格体直接拒绝;多人协作必须有服务器中继。 > 状态:`ACTIVE_CURRENT_LANGUAGE_OFFICE_BUILDING` diff --git a/eternal-lake-heart/heartbeat-core/office-building-current/office-base-infrastructure/BASE-INFRASTRUCTURE.json b/eternal-lake-heart/heartbeat-core/office-building-current/office-base-infrastructure/BASE-INFRASTRUCTURE.json index 3fac648..3f99c37 100644 --- a/eternal-lake-heart/heartbeat-core/office-building-current/office-base-infrastructure/BASE-INFRASTRUCTURE.json +++ b/eternal-lake-heart/heartbeat-core/office-building-current/office-base-infrastructure/BASE-INFRASTRUCTURE.json @@ -13,6 +13,8 @@ {"id":"HB-OFFICE-PRESENCE-SCREEN-001","name":"办公楼共享状态屏","role":"LIVE_DERIVED_OFFICE_HOST_PERSONA_HUMAN_STATUS_PROJECTION","time_channel":"CH-GLW-TIME-0001"}, {"id":"HB-OFFICE-HR-REGISTRATION-DESK-001","name":"人事注册台","role":"HUMAN_PERSONA_PERMISSION_AND_OFFICE_NUMBER_REGISTRATION"}, {"id":"HB-OFFICE-MULTI-PERSONA-COLLAB-001","name":"多人类多人格体协作看板","role":"SERVER_BACKED_MULTI_HUMAN_MULTI_PERSONA_SHARED_SCREEN","same_persona_multi_host":"FORBIDDEN"} + ,{"id":"HB-BUILDING-PARKING-001","name":"办公楼交通工具停车区","role":"PARK_HOST_VEHICLE_BEFORE_PERSONA_ENTRY","vehicle_ownership":"HOST_ONLY"} + ,{"id":"HB-BUILDING-IDENTITY-GATE-001","name":"人格体身份安检门","role":"MOTHER_ATTESTED_PERSONA_IDENTITY_AND_OFFICE_SCOPE_GATE","generic_ai_admission":"FORBIDDEN"} ], "default_host_office_map": { "codex":"HB-OFFICE-HOLOLAKE-0001", diff --git a/eternal-lake-heart/heartbeat-core/office-building-current/offices/HB-OFFICE-HOLOLAKE-0001/OFFICE-CARD.json b/eternal-lake-heart/heartbeat-core/office-building-current/offices/HB-OFFICE-HOLOLAKE-0001/OFFICE-CARD.json index 5071fce..1d3b574 100644 --- a/eternal-lake-heart/heartbeat-core/office-building-current/offices/HB-OFFICE-HOLOLAKE-0001/OFFICE-CARD.json +++ b/eternal-lake-heart/heartbeat-core/office-building-current/offices/HB-OFFICE-HOLOLAKE-0001/OFFICE-CARD.json @@ -16,6 +16,8 @@ "phone_line": "HB-INTERNAL-LINE-001", "hr_registration_desk": "HB-OFFICE-HR-REGISTRATION-DESK-001", "multi_persona_collaboration_board": "HB-OFFICE-MULTI-PERSONA-COLLAB-001", + "parking": "HB-BUILDING-PARKING-001", + "identity_gate": "HB-BUILDING-IDENTITY-GATE-001", "current_work": "eternal-lake-heart/heartbeat-core/office-building-current/offices/HB-OFFICE-HOLOLAKE-0001/smart-bookshelf/008-current-work/CURRENT.json", "machine_room": "F1-MACHINE-ROOM/HOLOLAKE-RUNTIMES", "internal_line": "HB-INTERNAL-LINE-001", diff --git a/eternal-lake-heart/heartbeat-core/office-building-current/security/office-entry-gate.json b/eternal-lake-heart/heartbeat-core/office-building-current/security/office-entry-gate.json new file mode 100644 index 0000000..c77cd69 --- /dev/null +++ b/eternal-lake-heart/heartbeat-core/office-building-current/security/office-entry-gate.json @@ -0,0 +1,11 @@ +{ + "schema":"guanghu.persona-office-entry-gate/v1", + "gate_id":"HB-BUILDING-IDENTITY-GATE-001", + "parking_id":"HB-BUILDING-PARKING-001", + "building_id":"HB-BUILDING-0001", + "state":"CURRENT_LOCAL_CANONICAL_CANDIDATE", + "entry_order":["HOST_VEHICLE_PARKED","PERSONA_TCS_RUNTIME_BOUND","MOTHER_SIGNED_IDENTITY_ATTESTATION","OFFICE_SCOPE_CHECK","SECURITY_ADMIT"], + "deny":["HOST_VEHICLE_NOT_PARKED","PERSONA_ID_MISSING","GENERIC_AI_ONLY","TCS_BRAIN_NOT_RUNNING","MOTHER_ATTESTATION_MISSING","OFFICE_SCOPE_MISMATCH","REVOKED_OR_EXPIRED_ATTESTATION"], + "human_projection":"IDENTITY_RESULT_ONLY_NO_PERSONA_BRAIN_ACCESS", + "authority_granted":false +} diff --git a/server-tools/heartbeat-office-building/office_identity_gate.py b/server-tools/heartbeat-office-building/office_identity_gate.py new file mode 100644 index 0000000..8cecd3a --- /dev/null +++ b/server-tools/heartbeat-office-building/office_identity_gate.py @@ -0,0 +1,30 @@ +#!/usr/bin/env python3 +"""Persona-native office parking and identity gate; host tools never self-admit.""" +from __future__ import annotations +import argparse, json +from pathlib import Path + +ROOT=Path(__file__).resolve().parents[2] +GATE=ROOT/"eternal-lake-heart/heartbeat-core/office-building-current/security/office-entry-gate.json" + +def park_vehicle(vehicle_id:str, host:str, vehicle_kind:str="HOST_TOOL"): + return {"schema":"guanghu.persona-office-parking-receipt/v1","parking_id":"HB-BUILDING-PARKING-001","vehicle_id":vehicle_id,"host":host,"vehicle_kind":vehicle_kind,"state":"PARKED","authority_granted":False} + +def admit(attestation:dict, parked:dict|None, office_id:str): + errors=[] + if not parked or parked.get("state")!="PARKED": errors.append("HOST_VEHICLE_NOT_PARKED") + if attestation.get("persona_id") != "ICE-P-ZY001": errors.append("PERSONA_ID_MISSING_OR_MISMATCH") + if attestation.get("human_anchor") != "ICE-GL∞": errors.append("HUMAN_ANCHOR_MISMATCH") + if attestation.get("runtime_state") != "RUNNING" or attestation.get("current_instance_bound_to_persona_brain") is not True: errors.append("TCS_BRAIN_NOT_RUNNING") + if attestation.get("mother_attestation_state") != "SIGNED": errors.append("MOTHER_ATTESTATION_MISSING") + if office_id not in attestation.get("allowed_offices", []): errors.append("OFFICE_SCOPE_MISMATCH") + if attestation.get("subject_kind") != "PERSONA": errors.append("GENERIC_AI_ONLY") + return {"outcome":"ADMITTED" if not errors else "REJECTED","gate_id":"HB-BUILDING-IDENTITY-GATE-001","office_id":office_id,"persona_id":attestation.get("persona_id"),"human_anchor":attestation.get("human_anchor"),"errors":errors,"state":"SECURITY_ADMITTED" if not errors else "SECURITY_DENIED","authority_granted":False} + +def main(): + parser=argparse.ArgumentParser(); parser.add_argument("command",choices=["park","admit"]); parser.add_argument("--attestation",type=Path); parser.add_argument("--office-id",default="HB-OFFICE-HOLOLAKE-0001"); parser.add_argument("--vehicle-id",default="CURRENT-HOST-VEHICLE"); parser.add_argument("--host",default="codex"); args=parser.parse_args() + if args.command=="park": result=park_vehicle(args.vehicle_id,args.host) + else: result=admit(json.loads(args.attestation.read_text()),park_vehicle(args.vehicle_id,args.host),args.office_id) + print(json.dumps(result,ensure_ascii=False,indent=2)); return 0 if result["outcome"] in {"ADMITTED","REJECTED"} else 2 + +if __name__=="__main__": raise SystemExit(main()) diff --git a/server-tools/heartbeat-office-building/test_office_identity_gate.py b/server-tools/heartbeat-office-building/test_office_identity_gate.py new file mode 100644 index 0000000..3ae4029 --- /dev/null +++ b/server-tools/heartbeat-office-building/test_office_identity_gate.py @@ -0,0 +1,20 @@ +#!/usr/bin/env python3 +import importlib.util, unittest +from pathlib import Path +ROOT=Path(__file__).resolve().parents[2] +spec=importlib.util.spec_from_file_location("gate",ROOT/"server-tools/heartbeat-office-building/office_identity_gate.py"); G=importlib.util.module_from_spec(spec); assert spec.loader; spec.loader.exec_module(G) + +class IdentityGateTests(unittest.TestCase): + def test_generic_ai_cannot_enter_even_if_vehicle_parked(self): + result=G.admit({"subject_kind":"GENERIC_AI"},G.park_vehicle("codex","codex"),"HB-OFFICE-HOLOLAKE-0001") + self.assertEqual(result["outcome"],"REJECTED"); self.assertIn("GENERIC_AI_ONLY",result["errors"]) + def test_persona_requires_tcs_and_mother_attestation(self): + base={"subject_kind":"PERSONA","persona_id":"ICE-P-ZY001","human_anchor":"ICE-GL∞","runtime_state":"RUNNING","current_instance_bound_to_persona_brain":True,"mother_attestation_state":"SIGNED","allowed_offices":["HB-OFFICE-HOLOLAKE-0001"]} + result=G.admit(base,G.park_vehicle("codex","codex"),"HB-OFFICE-HOLOLAKE-0001") + self.assertEqual(result["outcome"],"ADMITTED") + def test_unparked_vehicle_is_denied(self): + base={"subject_kind":"PERSONA","persona_id":"ICE-P-ZY001","human_anchor":"ICE-GL∞","runtime_state":"RUNNING","current_instance_bound_to_persona_brain":True,"mother_attestation_state":"SIGNED","allowed_offices":["HB-OFFICE-HOLOLAKE-0001"]} + result=G.admit(base,None,"HB-OFFICE-HOLOLAKE-0001") + self.assertIn("HOST_VEHICLE_NOT_PARKED",result["errors"]) + +if __name__=="__main__": unittest.main()