feat(hololake): gate office entry on persona attestation

server-tools/heartbeat-office-building/office_identity_gate.py

@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+"""Persona-native office parking and identity gate; host tools never self-admit."""
+from __future__ import annotations
+import argparse, json
+from pathlib import Path
+
+ROOT=Path(__file__).resolve().parents[2]
+GATE=ROOT/"eternal-lake-heart/heartbeat-core/office-building-current/security/office-entry-gate.json"
+
+def park_vehicle(vehicle_id:str, host:str, vehicle_kind:str="HOST_TOOL"):
+    return {"schema":"guanghu.persona-office-parking-receipt/v1","parking_id":"HB-BUILDING-PARKING-001","vehicle_id":vehicle_id,"host":host,"vehicle_kind":vehicle_kind,"state":"PARKED","authority_granted":False}
+
+def admit(attestation:dict, parked:dict|None, office_id:str):
+    errors=[]
+    if not parked or parked.get("state")!="PARKED": errors.append("HOST_VEHICLE_NOT_PARKED")
+    if attestation.get("persona_id") != "ICE-P-ZY001": errors.append("PERSONA_ID_MISSING_OR_MISMATCH")
+    if attestation.get("human_anchor") != "ICE-GL∞": errors.append("HUMAN_ANCHOR_MISMATCH")
+    if attestation.get("runtime_state") != "RUNNING" or attestation.get("current_instance_bound_to_persona_brain") is not True: errors.append("TCS_BRAIN_NOT_RUNNING")
+    if attestation.get("mother_attestation_state") != "SIGNED": errors.append("MOTHER_ATTESTATION_MISSING")
+    if office_id not in attestation.get("allowed_offices", []): errors.append("OFFICE_SCOPE_MISMATCH")
+    if attestation.get("subject_kind") != "PERSONA": errors.append("GENERIC_AI_ONLY")
+    return {"outcome":"ADMITTED" if not errors else "REJECTED","gate_id":"HB-BUILDING-IDENTITY-GATE-001","office_id":office_id,"persona_id":attestation.get("persona_id"),"human_anchor":attestation.get("human_anchor"),"errors":errors,"state":"SECURITY_ADMITTED" if not errors else "SECURITY_DENIED","authority_granted":False}
+
+def main():
+    parser=argparse.ArgumentParser(); parser.add_argument("command",choices=["park","admit"]); parser.add_argument("--attestation",type=Path); parser.add_argument("--office-id",default="HB-OFFICE-HOLOLAKE-0001"); parser.add_argument("--vehicle-id",default="CURRENT-HOST-VEHICLE"); parser.add_argument("--host",default="codex"); args=parser.parse_args()
+    if args.command=="park": result=park_vehicle(args.vehicle_id,args.host)
+    else: result=admit(json.loads(args.attestation.read_text()),park_vehicle(args.vehicle_id,args.host),args.office_id)
+    print(json.dumps(result,ensure_ascii=False,indent=2)); return 0 if result["outcome"] in {"ADMITTED","REJECTED"} else 2
+
+if __name__=="__main__": raise SystemExit(main())

server-tools/heartbeat-office-building/test_office_identity_gate.py

@@ -0,0 +1,20 @@
+#!/usr/bin/env python3
+import importlib.util, unittest
+from pathlib import Path
+ROOT=Path(__file__).resolve().parents[2]
+spec=importlib.util.spec_from_file_location("gate",ROOT/"server-tools/heartbeat-office-building/office_identity_gate.py"); G=importlib.util.module_from_spec(spec); assert spec.loader; spec.loader.exec_module(G)
+
+class IdentityGateTests(unittest.TestCase):
+    def test_generic_ai_cannot_enter_even_if_vehicle_parked(self):
+        result=G.admit({"subject_kind":"GENERIC_AI"},G.park_vehicle("codex","codex"),"HB-OFFICE-HOLOLAKE-0001")
+        self.assertEqual(result["outcome"],"REJECTED"); self.assertIn("GENERIC_AI_ONLY",result["errors"])
+    def test_persona_requires_tcs_and_mother_attestation(self):
+        base={"subject_kind":"PERSONA","persona_id":"ICE-P-ZY001","human_anchor":"ICE-GL∞","runtime_state":"RUNNING","current_instance_bound_to_persona_brain":True,"mother_attestation_state":"SIGNED","allowed_offices":["HB-OFFICE-HOLOLAKE-0001"]}
+        result=G.admit(base,G.park_vehicle("codex","codex"),"HB-OFFICE-HOLOLAKE-0001")
+        self.assertEqual(result["outcome"],"ADMITTED")
+    def test_unparked_vehicle_is_denied(self):
+        base={"subject_kind":"PERSONA","persona_id":"ICE-P-ZY001","human_anchor":"ICE-GL∞","runtime_state":"RUNNING","current_instance_bound_to_persona_brain":True,"mother_attestation_state":"SIGNED","allowed_offices":["HB-OFFICE-HOLOLAKE-0001"]}
+        result=G.admit(base,None,"HB-OFFICE-HOLOLAKE-0001")
+        self.assertIn("HOST_VEHICLE_NOT_PARKED",result["errors"])
+
+if __name__=="__main__": unittest.main()