hololake-system-architecture/product-source/hololake-platform/guanghu-os/README.md

# Guanghu OS bootstrap

This directory is the first executable handoff from the registered HLDP
language world to a native Guanghu OS. It is not a claim that Guanghu OS has
already replaced Linux.

## Authority boundary

- `world-seed/` is the authoritative HLDP world package.
- `guanghu-hldp-runtime` validates the package without guessing missing state.
- `ghctl wake` is the fixed continuity entrypoint for a human or a later agent.
- `ghctl authorize` checks every consequential action against the exact
  node-scoped standing authorization before it runs.
- `GLS-0844 / GHNQG` is the code channel's own quality authority. Every
  required gate is either 0 or 100; only an all-100 run may publish a passing
  receipt. External analysis products are non-authoritative observers.
- `GLS-0845 / GHCIP` is the only gestational-history ingestion authority. It
  keeps source registration, server-resident review, historical time catch-up,
  and persona birth as four distinct states.
- Rust is a bootstrap implementation language for the validator and control
  executable. It does not replace HLDP as the world-programming language.
- Ubuntu and the Forgejo Linux binary are construction scaffolding. Native
  acceptance requires a Guanghu kernel, Guanghu hardware abstraction, a
  Guanghu-owned code-channel data plane, and a boot with no Linux kernel or
  Linux userspace.

The registered translation chain is:

```text
TCS -> HLDP -> GLC -> GIR -> BTCP -> GOSK -> GHAL -> hardware
```

## World contents

`WORLD-MANIFEST.hldp` registers exactly five domains, one logical broadcast
tower, the continuity chain, the native handoff protocols, and the Guanghu Code
Channel.

The code channel starts from the verified Forgejo 16.0.1 offline baseline at
commit `b3d7e4ac3cbccc220703097a51fa4c16bf302579`. Forgejo is the temporary data
plane and compatibility reference. `CHANNEL.hldp` is the authority for channel
identity, intents, receipts, and the migration ladder:

1. verified source baseline;
2. hosted Forgejo data plane;
3. HLDP-native control plane;
4. GOSK-native object store and network data plane;
5. Linux-free boot.

Only step 1 is complete in this source package.

## Local verification

```bash
cargo fmt --all --manifest-path guanghu-os/Cargo.toml -- --check
cargo test --manifest-path guanghu-os/Cargo.toml
cargo clippy --manifest-path guanghu-os/Cargo.toml --all-targets -- -D warnings
cargo run --manifest-path guanghu-os/Cargo.toml -p ghctl -- \
  wake guanghu-os/world-seed
guanghu-os/world-seed/scripts/run-guanghu-native-quality-gate.sh \
  /tmp/guanghu-native-quality-receipt.hldp
```

`ghctl wake` validates the manifest, all five domain entries, the code-channel
contract, standing authorization, dedicated-access receipt, continuity files,
and exact repository digests before printing the recovery evidence.

## Server recovery contract

The hosted construction path will install immutable versions under
`/guanghu/versions/<version>` and point `/guanghu/current` at the active
version. A future session must execute this chain before any change:

```text
login
-> /guanghu/bin/ghctl wake /guanghu/current
-> WORLD-MANIFEST.hldp
-> CURRENT.hldp
-> last phase receipt
-> dedicated-access receipt
-> standing authorization
-> active workorder
-> code-channel entry and receipt
-> live broadcast epoch
-> act or fail closed
```

The current source is `HOSTED_BOOTSTRAP_PROTOTYPE`. Running it on Ubuntu proves
the world package and recovery chain only; it does not prove native boot.

The dedicated local login route is `guanghu-os-bs-sh-005`. It uses a separate
SSH config and known-hosts file, strict host-key verification, and a key scoped
to this disposable node. The world records only public fingerprints; it never
contains the private key or a password.

## Hosted Stage 1 installation

`scripts/install-hosted-stage1.sh` is the repeatable Ubuntu construction
handoff. It requires a full implementation Git SHA and the SHA-256 of the
transferred source archive. It uses the official stable Rust toolchain rooted
at `/opt/guanghu/{rustup,cargo}`; Ubuntu's Cargo 1.75 is intentionally rejected
because it cannot read this repository's v4 lock file. On the exact x86_64
`/dev/vda` lab shape, it:

1. runs the workspace tests and builds a release `ghctl`;
2. assembles and validates a temporary five-domain world;
3. writes a server-observed HLDP phase receipt;
4. makes the version immutable; and
5. atomically moves `/guanghu/current`.

An existing version is never overwritten. A failed assembly is retained with a
`.failed.<UTC time>` suffix for diagnosis, while the previous current version
remains active.

## Hosted services Stage 1B

`guanghu-broadcast-tower` is the first continuously running executor for the
logical singleton registered by HLDP. Its hosted surface is deliberately
loopback-only (`127.0.0.1:8077`), exposes the validated five-domain world, and
writes a live HLDP epoch. It always reports `linux_exited: false`.

`scripts/install-hosted-stage1b-services.sh` creates a new immutable world
version, starts the tower, and installs the hash-verified Forgejo 16.0.1 package
as the temporary code-channel data plane on `127.0.0.1:3080`. Registration and
Forgejo's SSH server stay disabled. The exact `guanghu/main` bundle is restored
as a bootstrap bare repository, while HLDP remains the channel authority.

Both services are reachable from the local Mac through the dedicated SSH route;
neither is published directly to the Internet. A failed service activation
restores the Stage 1 world symlink and stops both hosted services.

The first successful hosted activation exposed a recovery inconsistency:
`CURRENT.hldp` advanced while `WORLD-MANIFEST.hldp` retained the Stage 1
version. The immutable correction is `0.1.2-stage1b-r1`; it rebuilds the world
from the repository seed and advances both records together.