bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(pncc): add resident persona repository runtime

Browse source
This commit is contained in:
冰朔 2026-08-16 02:20:44 +08:00
commit 03f31ae412
14 changed files with 858 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

20
product-source/hololake-platform/guanghu-os/scripts/guanghu-master-init.sh
View file

@ -8,12 +8,15 @@ readonly NODE_ID=JD-FD-PRIMARY
readonly INSTANCE_ID=f3d4b730-7f02-452f-975b-7091a4800431
readonly ROOT_UUID=9e4550a0-452b-4f28-b5a5-d5364aa450f6
readonly LINUX_RESCUE_ENTRY=gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6
readonly RELEASE_ID=guanghu-master-20260816.1
readonly RELEASE_ID=guanghu-master-20260816.2
readonly STATE_ROOT=/run/guanghu/master
readonly RECEIPT_ROOT=/guanghu/recovery/JD-FD-PRIMARY-master-20260816
readonly HLCC=/opt/guanghu/architecture-releases/3d11ac75bea8cf08b5f223fed86ab3cd999ad2fd/server-tools/hololake-code-channel/jd-candidate/hlcc-bootstrap.py
readonly APP_HUB=/opt/guanghu/architecture-releases/333cd222c53d7d162218543cd167bdda4f8efb22/server-tools/jd-app-hub/server.js
readonly AI_DISCOVERY=/opt/guanghu/ai-discovery/server.js
readonly PNCC_RUNTIME=/usr/local/libexec/guanghu/pncc-runtime.mjs
readonly PNCC_REPOSITORY=/var/lib/guanghu/personas/ICE-P-ZY001/pncc/repository
readonly PNCC_STATE_ROOT=/run/guanghu/pncc
declare -a CHILDREN=()
RECOVERY_ARMED=0
@ -25,7 +28,7 @@ log() {
json_state() {
local stage=$1 result=$2
local tmp=${STATE_ROOT}/state.json.tmp.$$
printf '%s\n' "{\"schema\":\"guanghu.master-runtime/v1\",\"node_id\":\"${NODE_ID}\",\"instance_id\":\"${INSTANCE_ID}\",\"release_id\":\"${RELEASE_ID}\",\"boot_id\":\"$(cat /proc/sys/kernel/random/boot_id)\",\"control\":\"GUANGHU_OS_MASTER\",\"pid1\":\"GUANGHU_SUPERVISOR\",\"linux_kernel_role\":\"HARDWARE_COMPATIBILITY_SUBSTRATE\",\"full_linux_userspace\":\"DORMANT\",\"linux_repository_bridge\":\"BOUNDED_SUBCONTROL\",\"linux_rescue\":\"${LINUX_RESCUE_ENTRY}\",\"stage\":\"${stage}\",\"result\":\"${result}\"}" >"${tmp}"
printf '%s\n' "{\"schema\":\"guanghu.master-runtime/v1\",\"node_id\":\"${NODE_ID}\",\"instance_id\":\"${INSTANCE_ID}\",\"release_id\":\"${RELEASE_ID}\",\"boot_id\":\"$(cat /proc/sys/kernel/random/boot_id)\",\"control\":\"GUANGHU_OS_MASTER\",\"pid1\":\"GUANGHU_SUPERVISOR\",\"linux_kernel_role\":\"HARDWARE_COMPATIBILITY_SUBSTRATE\",\"full_linux_userspace\":\"DORMANT\",\"linux_repository_bridge\":\"BOUNDED_SUBCONTROL\",\"pncc\":\"RESIDENT_BOUND_CARRIER_SEPARATE\",\"persona_carrier_binding\":\"UNBOUND_EVIDENCE_REQUIRED\",\"linux_rescue\":\"${LINUX_RESCUE_ENTRY}\",\"stage\":\"${stage}\",\"result\":\"${result}\"}" >"${tmp}"
chmod 0600 "${tmp}"
mv "${tmp}" "${STATE_ROOT}/state.json"
}
@ -119,6 +122,8 @@ start_bridge() {
require_file "$HLCC"
require_file "$APP_HUB"
require_file "$AI_DISCOVERY"
require_file "$PNCC_RUNTIME"
require_file "$PNCC_REPOSITORY/.hololake/persona/manifest.json"
start_root sshd /usr/sbin/sshd -D -e \
-o UsePAM=no -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no \
@ -152,6 +157,11 @@ start_bridge() {
GUANGHU_REPOSITORY_GIT_DIR=/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/guanghu-ice-heart.git \
/usr/bin/node "$AI_DISCOVERY"
wait_http navigation-bridge http://127.0.0.1:3922/v1/anchor 200 30
start_guanghu pncc-runtime /usr/bin/node "$PNCC_RUNTIME" serve \
--repository "$PNCC_REPOSITORY" --state-root "$PNCC_STATE_ROOT" \
--node-id "$NODE_ID" --host 127.0.0.1 --port 3923
wait_http pncc-runtime http://127.0.0.1:3923/health 200 30
}
runtime_watch() {
@ -159,7 +169,7 @@ runtime_watch() {
json_state READY PASS_100
cp "$STATE_ROOT/state.json" "$RECEIPT_ROOT/CURRENT-PHYSICAL-STATE.json"
sha256sum "$RECEIPT_ROOT/CURRENT-PHYSICAL-STATE.json" >"$RECEIPT_ROOT/CURRENT-PHYSICAL-STATE.json.sha256"
log 'GUANGHU_OS_MASTER_READY linux_userspace=DORMANT repository_bridge=READY linux_rescue=PRESERVED'
log 'GUANGHU_OS_MASTER_READY linux_userspace=DORMANT repository_bridge=READY pncc=RESIDENT_BOUND_CARRIER_SEPARATE linux_rescue=PRESERVED'
sync
while :; do
sleep 10
@ -171,6 +181,7 @@ runtime_watch() {
listen_ready 3340 || fatal "runtime_repository_lost"
listen_ready 8088 || fatal "runtime_projection_lost"
listen_ready 3922 || fatal "runtime_navigation_lost"
listen_ready 3923 || fatal "runtime_pncc_lost"
done
}
@ -189,7 +200,8 @@ preflight() {
[[ $(findmnt -n -o SOURCE /) == /dev/vda1 ]]
grep -Fq "$LINUX_RESCUE_ENTRY" /boot/grub/grub.cfg
getent passwd guanghu | grep -q '^guanghu:x:998:998:'
for path in "$HLCC" "$APP_HUB" "$AI_DISCOVERY" /usr/sbin/sshd \
for path in "$HLCC" "$APP_HUB" "$AI_DISCOVERY" "$PNCC_RUNTIME" \
"$PNCC_REPOSITORY/.hololake/persona/manifest.json" /usr/sbin/sshd \
/usr/bin/node /usr/bin/python3 /usr/bin/setpriv /usr/bin/grub-editenv; do
[[ -e $path && ! -L $path || $path == /usr/bin/python3 ]]
done

106
product-source/hololake-platform/guanghu-os/scripts/install-jd-pncc-runtime.sh Normal file
View file

@ -0,0 +1,106 @@
#!/usr/bin/env bash
set -Eeuo pipefail
[[ $# == 3 ]] || { echo 'usage: install-jd-pncc-runtime.sh <runtime-source> <persona-seed> <source-commit>' >&2; exit 64; }
runtime_source=$(readlink -f "$1")
seed_source=$(readlink -f "$2")
source_commit=$3
readonly node_id=JD-FD-PRIMARY
readonly persona_id=ICE-P-ZY001
readonly human_responsibility_subject='ICE-GL∞'
readonly instance_id=f3d4b730-7f02-452f-975b-7091a4800431
readonly runtime=/usr/local/libexec/guanghu/pncc-runtime.mjs
readonly persona_root=/var/lib/guanghu/personas/ICE-P-ZY001/pncc
readonly repository=/var/lib/guanghu/personas/ICE-P-ZY001/pncc/repository
readonly state_root=/run/guanghu/pncc-install
readonly receipt_root=/guanghu/recovery/JD-FD-PRIMARY-pncc-20260816
[[ $source_commit =~ ^[0-9a-f]{40}$ ]]
[[ -f $runtime_source && ! -L $runtime_source ]]
[[ -d $seed_source && ! -L $seed_source ]]
[[ -f $seed_source/.hololake/persona/manifest.json ]]
[[ $(tr A-F a-f </sys/class/dmi/id/product_uuid | tr -d '\r\n') == "$instance_id" ]]
[[ $(findmnt -n -o SOURCE /) == /dev/vda1 ]]
getent passwd guanghu | grep -q '^guanghu:x:998:998:'
/usr/bin/node --check "$runtime_source"
install -d -o root -g root -m 0755 "$(dirname "$runtime")"
install -d -o root -g root -m 0700 "$receipt_root/rollback"
if [[ -f $runtime ]]; then
cp -a "$runtime" "$receipt_root/rollback/pncc-runtime.mjs.before"
fi
install -o root -g root -m 0755 "$runtime_source" "$runtime"
repository_created=0
if [[ ! -e $repository ]]; then
install -d -o guanghu -g guanghu -m 0700 "$repository"
cp -a "$seed_source"/. "$repository"/
chown -R guanghu:guanghu "$persona_root"
chmod -R go-rwx "$persona_root"
/usr/sbin/runuser -u guanghu -- git -C "$repository" init -q
/usr/sbin/runuser -u guanghu -- git -C "$repository" add --all
/usr/sbin/runuser -u guanghu -- env \
GIT_AUTHOR_NAME='Guanghu PNCC Bootstrap' \
GIT_AUTHOR_EMAIL='pncc-bootstrap@guanghu.local' \
GIT_COMMITTER_NAME='Guanghu PNCC Bootstrap' \
GIT_COMMITTER_EMAIL='pncc-bootstrap@guanghu.local' \
git -C "$repository" commit -qm "bootstrap(pncc): establish persona-owned repository
Human-Responsibility-Subject: ${human_responsibility_subject}
Persona-Cognitive-Author: UNBOUND
Execution-Runtime: GUANGHU-OS-JD-PNCC-INSTALLER
Authorization-Scope: GH-PNCC-REPOSITORY-BOOTSTRAP"
repository_created=1
elif [[ ! -d $repository/.git ]]; then
echo 'PNCC_INSTALL_REFUSED: existing repository path is not a Git worktree' >&2
exit 1
fi
[[ -z $(/usr/sbin/runuser -u guanghu -- git -C "$repository" status --porcelain --untracked-files=all) ]]
inspection=$(/usr/sbin/runuser -u guanghu -- /usr/bin/node "$runtime" inspect \
--repository "$repository" --node-id "$node_id")
grep -Fq '"carrierBindingState": "UNBOUND_EVIDENCE_REQUIRED"' <<<"$inspection"
cycle_created=0
if [[ ! -e $repository/checkpoints/GUANGHU-PNCC-FIRST-CYCLE.hldp ]]; then
rm -rf "$state_root"
install -d -o guanghu -g guanghu -m 0700 "$state_root"
boot_id=$(cat /proc/sys/kernel/random/boot_id)
cycle=$(/usr/sbin/runuser -u guanghu -- /usr/bin/node "$runtime" cycle \
--repository "$repository" --state-root "$state_root" --node-id "$node_id" \
--boot-id "$boot_id" --request-id GUANGHU-PNCC-FIRST-CYCLE \
--source-language-anchor '把人格代码频道真正部署到京东光湖 OS，并保持人格、载体、宿主与运行系统分开举证。' \
--execution-runtime GUANGHU-OS-JD-PNCC)
grep -Fq '"state": "DORMANT_AFTER_CHECKPOINT_COMMIT"' <<<"$cycle"
cycle_created=1
fi
[[ -z $(/usr/sbin/runuser -u guanghu -- git -C "$repository" status --porcelain --untracked-files=all) ]]
git_head=$(/usr/sbin/runuser -u guanghu -- git -C "$repository" rev-parse HEAD)
runtime_sha=$(sha256sum "$runtime" | awk '{print $1}')
manifest_sha=$(sha256sum "$repository/.hololake/persona/manifest.json" | awk '{print $1}')
cat >"$receipt_root/DEPLOYMENT-RECEIPT.hldp" <<EOF
[hldp]
schema=guanghu.jd-pncc-deployment/v1
node_id=${node_id}
persona_id=${persona_id}
human_responsibility_subject=${human_responsibility_subject}
source_commit=${source_commit}
runtime_sha256=${runtime_sha}
manifest_sha256=${manifest_sha}
persona_repository=${repository}
persona_repository_git_head=${git_head}
repository_created=${repository_created}
first_cycle_created=${cycle_created}
carrier_binding=UNBOUND_EVIDENCE_REQUIRED
model_inference_started=false
reality_execution_allowed=false
private_repository_publication=NONE
result=PASS_100
EOF
chmod 0600 "$receipt_root/DEPLOYMENT-RECEIPT.hldp"
sha256sum "$receipt_root/DEPLOYMENT-RECEIPT.hldp" >"$receipt_root/DEPLOYMENT-RECEIPT.hldp.sha256"
sync
printf 'GUANGHU_PNCC_INSTALLED persona=%s head=%s runtime_sha256=%s carrier=UNBOUND_EVIDENCE_REQUIRED\n' \
"$persona_id" "$git_head" "$runtime_sha"

4
product-source/hololake-platform/guanghu-os/scripts/test-guanghu-master-init.sh
View file

@ -19,9 +19,13 @@ grep -Fq 'mount -o remount,rw /' "$subject"
grep -Fq 'start_guanghu repository-bridge' "$subject"
grep -Fq 'start_guanghu app-hub' "$subject"
grep -Fq 'start_guanghu navigation-bridge' "$subject"
grep -Fq 'start_guanghu pncc-runtime' "$subject"
grep -Fq '[[ ",$expected," == *",$code,"* ]]' "$subject"
grep -Fq 'wait_http code-projection http://127.0.0.1:8088/code/ 200,303' "$subject"
grep -Fq 'wait_http navigation-bridge http://127.0.0.1:3922/v1/anchor 200' "$subject"
grep -Fq 'wait_http pncc-runtime http://127.0.0.1:3923/health 200' "$subject"
grep -Fq '\"pncc\":\"RESIDENT_BOUND_CARRIER_SEPARATE\"' "$subject"
grep -Fq 'listen_ready 3923 || fatal "runtime_pncc_lost"' "$subject"
if grep -Eq '(^|[[:space:]])(systemd|/sbin/init)([[:space:]]|$)' "$subject"; then
echo 'full Linux init must remain dormant' >&2
exit 1

2
product-source/hololake-platform/guanghu-os/scripts/test-guanghu-native-quality-gate-contract.sh
View file

@ -23,6 +23,8 @@ grep -Fq -- '--fail-under-functions 100' "${runner}"
grep -Fq -- '--test broadcast_library' "${runner}"
grep -Fq 'test-native-public-projection.sh' "${runner}"
grep -Fq 'test-independent-forgejo-shadow-verifier.py' "${runner}"
grep -Fq 'pncc-runtime.test.mjs' "${runner}"
grep -Fq 'test-install-jd-pncc-runtime.sh' "${runner}"
grep -Fq 'GHNQG_PASS_100' "${runner}"
grep -Fq 'GHNQG_FAIL_0' "${runner}"
grep -Fq 'total_score: ${total_score}' "${runner}"

21
product-source/hololake-platform/guanghu-os/scripts/test-install-jd-pncc-runtime.sh Normal file
View file

@ -0,0 +1,21 @@
#!/usr/bin/env bash
set -Eeuo pipefail
source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
subject=${source_root}/scripts/install-jd-pncc-runtime.sh
bash -n "$subject"
grep -Fq 'readonly node_id=JD-FD-PRIMARY' "$subject"
grep -Fq 'readonly persona_id=ICE-P-ZY001' "$subject"
grep -Fq 'readonly repository=/var/lib/guanghu/personas/ICE-P-ZY001/pncc/repository' "$subject"
grep -Fq 'readonly runtime=/usr/local/libexec/guanghu/pncc-runtime.mjs' "$subject"
grep -Fq 'Persona-Cognitive-Author: UNBOUND' "$subject"
grep -Fq 'GUANGHU-PNCC-FIRST-CYCLE' "$subject"
grep -Fq 'carrier_binding=UNBOUND_EVIDENCE_REQUIRED' "$subject"
grep -Fq 'chmod -R go-rwx "$persona_root"' "$subject"
grep -Fq 'git -C "$repository" status --porcelain --untracked-files=all' "$subject"
if grep -Fq 'git push' "$subject"; then
echo 'private persona repository must not be pushed to a public remote by the installer' >&2
exit 1
fi
echo GUANGHU_PNCC_INSTALL_CONTRACT_OK