feat(education): publish Guanghu subdomain stage one

product-source/guanghu-education-industry-os/scripts/package-server-release.mjs

@@ -0,0 +1,29 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import crypto from 'node:crypto'
+
+const root = path.resolve(import.meta.dirname, '..')
+const target = path.join(root, 'release/server-artifact')
+
+fs.rmSync(target, { recursive: true, force: true })
+fs.mkdirSync(path.join(target, 'app'), { recursive: true })
+fs.mkdirSync(path.join(target, 'protocol'), { recursive: true })
+fs.cpSync(path.join(root, 'dist'), path.join(target, 'app'), { recursive: true })
+for (const name of ['module-registry.json', 'update-authority.json', 'deployment-profile.json']) {
+  fs.copyFileSync(path.join(root, 'protocol', name), path.join(target, 'protocol', name))
+}
+
+const files = []
+function collect(directory) {
+  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    const absolute = path.join(directory, entry.name)
+    if (entry.isDirectory()) collect(absolute)
+    else files.push(absolute)
+  }
+}
+collect(target)
+const manifest = files.sort().map((file) => ({
+  path: path.relative(target, file),
+  sha256: crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex'),
+}))
+fs.writeFileSync(path.join(target, 'ARTIFACT-MANIFEST.json'), `${JSON.stringify({ schema: 'guanghu.artifact-manifest/v1', sourceIncluded: false, files: manifest }, null, 2)}\n`)

product-source/guanghu-education-industry-os/scripts/pre-deploy-guard.mjs

@@ -0,0 +1,36 @@
+import fs from 'node:fs'
+import path from 'node:path'
+
+const root = path.resolve(import.meta.dirname, '..')
+const artifact = path.join(root, 'release/server-artifact')
+const update = JSON.parse(fs.readFileSync(path.join(root, 'protocol/update-authority.json'), 'utf8'))
+const profile = JSON.parse(fs.readFileSync(path.join(root, 'protocol/deployment-profile.json'), 'utf8'))
+const failures = []
+
+if (update.controlMode !== 'GUANGHU_IS_PRIMARY_UPSTREAM') failures.push('GUANGHU_NOT_PRIMARY_UPSTREAM')
+if (update.upstreamSync !== 'DISABLED') failures.push('UPSTREAM_SYNC_NOT_DISABLED')
+if (update.automaticUpstreamFetch || update.automaticUpstreamMerge || update.automaticComponentUpdate) failures.push('AUTOMATIC_UPSTREAM_PATH_ENABLED')
+if (update.serverSourceCheckout || update.serverSourcePresence !== 'FORBIDDEN') failures.push('SERVER_SOURCE_POLICY_INVALID')
+if (profile.sourceCodeOnServer !== false) failures.push('SOURCE_CODE_ALLOWED_BY_PROFILE')
+if (profile.nodeId === 'PENDING_LIGHTHOUSE_REGISTRATION') failures.push('TARGET_NODE_NOT_REGISTERED')
+if (profile.nodeId !== 'XX-GZ-001') failures.push('TARGET_NODE_MISMATCH')
+if (!profile.lighthouseSourceCommit || !profile.expectedDmiInstanceUuid) failures.push('TARGET_IDENTITY_EVIDENCE_MISSING')
+if (!fs.existsSync(artifact)) failures.push('SERVER_ARTIFACT_MISSING')
+
+const forbiddenNames = new Set(['src', '.git', 'node_modules', 'Cargo.toml', 'Cargo.lock', 'package.json', 'pnpm-lock.yaml', 'package-lock.json', 'vite.config.ts', 'tsconfig.json'])
+const forbiddenExtensions = new Set(['.ts', '.tsx', '.rs', '.map'])
+function scan(directory) {
+  if (!fs.existsSync(directory)) return
+  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    const absolute = path.join(directory, entry.name)
+    if (forbiddenNames.has(entry.name) || (!entry.isDirectory() && forbiddenExtensions.has(path.extname(entry.name)))) failures.push(`FORBIDDEN_SOURCE_PAYLOAD:${path.relative(artifact, absolute)}`)
+    if (entry.isDirectory()) scan(absolute)
+  }
+}
+scan(artifact)
+
+if (failures.length) {
+  process.stderr.write(`${JSON.stringify({ state: 'BLOCK_0', gate: 'GH-EDU-SERVER-ARTIFACT-ONLY-001', failures }, null, 2)}\n`)
+  process.exit(1)
+}
+process.stdout.write(`${JSON.stringify({ state: 'PASS_100', gate: 'GH-EDU-SERVER-ARTIFACT-ONLY-001', upstreamSync: 'DISABLED', sourceIncluded: false, nodeId: profile.nodeId }, null, 2)}\n`)