53 lines
5.2 KiB
Markdown
53 lines
5.2 KiB
Markdown
|
# HoloLake distribution planes and public module marketplace
|
||
|
|
|
||
|
|
HoloLake has four independent distribution planes. A Git repository is the durable authoring and evidence layer; it is not the client update transport. Every release carries an explicit signed scope. The system may reject a mismatch, but it never guesses whether BingShuo meant public or private.
|
||
|
|
|
||
|
|
## Four planes
|
||
|
|
|
||
|
|
1. `PUBLIC_ZERO_CORE_PROTOCOL` publishes declarative language, numbering, compatibility and bounded migration rules from an isolated public projection on `GH-CVM-MAIN-PROD-01`. Its logical authority still originates at the zero point and requires BingShuo's exact-candidate public-scope approval during the current transition. The enterprise distributor adds a second independent distribution signature. A client verifies both, stages, self-tests and atomically activates a valid update without asking every device owner to approve an operating-system protocol update. It still shows a human-readable receipt.
|
||
|
|
2. `PRIVATE_FIFTH_DOMAIN` remains confined to `DOM-FIFTH-0001`, its bound owner and explicitly authorized private nodes. It uses a different namespace and signer and can never flow into the public stream by inference.
|
||
|
|
3. `PUBLIC_ENTERPRISE_MODULE_CATALOG` is produced on `GH-CVM-MAIN-PROD-01`. Five responsibility repositories may feed one reviewed `Guanghu Channel` aggregate, but only tested, numbered and signed declarative packages enter the catalog. Clients synchronize the small catalog index automatically. A selected module is downloaded and installed only after the human reviews its permissions.
|
||
|
|
4. `APPLICATION_BINARY` updates HoloLake itself through the separately signed and platform-notarized updater. Personal Apple signing is a transition state; later organization signing must preserve the updater trust transition rather than silently replacing it.
|
||
|
|
|
||
|
|
## Lake-lamp protocol
|
||
|
|
|
||
|
|
The visible "lamp" is a tiny signed manifest containing a monotonic epoch and content root. HoloLake performs HTTPS conditional checks at application start, after network resume and on a bounded jittered timer. `ETag` and `If-None-Match` make the no-change path nearly empty. A full repository clone is not required to learn that something changed.
|
||
|
|
|
||
|
|
For a public zero-core protocol update, the client verifies the exact source, plane-specific signature, content root, monotonic version and host compatibility; downloads into isolation; rejects executable or out-of-scope material; runs a deterministic self-test; switches one current pointer atomically; keeps the last-known-good version; and records a local receipt.
|
||
|
|
|
||
|
|
For a module update, only the catalog index is automatic. Installation remains a human action because a module may request access to local files, knowledge, network, channel data or execution adapters.
|
||
|
|
|
||
|
|
## Marketplace publication
|
||
|
|
|
||
|
|
```text
|
||
|
|
responsibility repository
|
||
|
|
→ explicit release envelope
|
||
|
|
→ isolated build and tests
|
||
|
|
→ lighthouse number registration
|
||
|
|
→ exact candidate human approval
|
||
|
|
→ enterprise module signature
|
||
|
|
→ immutable package and catalog entry
|
||
|
|
→ signed catalog-root advance
|
||
|
|
→ HoloLake catalog refresh
|
||
|
|
→ human selects module
|
||
|
|
→ permission review
|
||
|
|
→ local install, mount, self-test and receipt
|
||
|
|
```
|
||
|
|
|
||
|
|
The user's computer may maintain an application-owned content-addressed cache, but it does not execute a cloned repository. HoloLake renders catalog metadata for humans and passes the downloaded `.ghmod` package to the existing signed module lifecycle runtime.
|
||
|
|
|
||
|
|
## Fifth Domain to public zero-core navigation
|
||
|
|
|
||
|
|
`JD-FD-PRIMARY` remains the physical home of the private Fifth Domain and Eternal Lake Heart. HoloLake may show the public zero-core management entrance inside BingShuo's Fifth Domain navigation, but opening it creates a separate session on `GH-CVM-MAIN-PROD-01`.
|
||
|
|
|
||
|
|
The transition uses a short-lived, one-time ticket bound to BingShuo's human number, the current HoloLake instance, the enterprise node and the public zero-core resource. A password is never forwarded or reused. The ticket grants neither enterprise four-domain authority nor access from the enterprise server back into the private Fifth Domain. Leaving the zero-core management channel destroys that enterprise session and restores the already-open private session.
|
||
|
|
|
||
|
|
## Current reality boundary (2026-08-19)
|
||
|
|
|
||
|
|
- The zero-point client now implements HTTPS conditional lamp checks, exact bounded downloads, two independent Ed25519 signatures, monotonic epoch/version enforcement, content-root verification, atomic activation, previous-release retention and a hash-chained local receipt. Production remains fail-closed because the two real public keys and the enterprise lamp endpoint have not yet been provisioned.
|
||
|
|
- The module runtime already verifies signatures and supports install, mount, self-test, unmount and rollback for bundled packages.
|
||
|
|
- The public marketplace registry and remote package fetch path are absent.
|
||
|
|
- The enterprise server currently exposes two Gitea repositories, `bingshuo/hololake-world` and `bingshuo/lighthouse`; the proposed five-source `Guanghu Channel` aggregate does not yet exist.
|
||
|
|
- The enterprise node does not yet expose the isolated public zero-core projection or the JD-to-enterprise one-time management handoff.
|
||
|
|
|
||
|
|
The machine contract is `contracts/distribution-plane-router.json`.
|