arch: audit model receipt donor and preserve stage boundary

product-source/hololake-platform/architecture/HOLOLAKE-MODEL-RECEIPT-DONOR-AUDIT-AND-STAGE-BOUNDARY-20260830.md

@@ -0,0 +1,50 @@
+# HoloLake 模型回执旧线接收审计与阶段边界
+
+> 记录编号：`HLP-MODEL-RECEIPT-DONOR-AUDIT-20260830-001`
+>
+> 生命周期：`AUDITED_DONOR_DEFERRED_FROM_STAGE1`
+>
+> 审计对象：`DONOR-HOLOLAKE-PERSONAL-CHANNEL-0.5.8`
+
+## 1 · 接收结论
+
+旧开发线没有失去工程价值，但它提前深入了第二阶段能力，不能整树并入当前 Stage 1。当前第一阶段的
+产品目的仍是白布底座、知识库／码字预装模块、TCS 确定性执行翻译桥、双 Git 耐久事实与可核验回执；
+内部 AI 聊天和模型 API 配置继续保持关闭。
+
+旧线只作为只读能力捐赠源保留。允许未来逐片迁移受限模型传输、结构化操作提案、对话生命周期、
+人类批准与实际执行回执闭环；不允许迁移旧壳、旧信息架构或整棵产品树。
+
+## 2 · 冻结来源与独立验证
+
+- 冻结头：`8b6dfbbe6143056991e2e37eebd02a09e07fc1aa`；
+- 推理到执行提交：`28105faec917f1208c2490430f98ecd38de81f8e`；
+- 对话生命周期提交：`dd5f97137ff30d3e97ed274b24b09a63d59a0b1a`；
+- 推理传输：27 项通过；桌面 Rust：21 项通过；
+- 四项模型配置／格式修复／批准保存／对话生命周期焦点闭环通过；
+- 前端 TypeScript 与生产构建、明暗主题对比度、公众形态隔离通过；
+- 项目没有 `npm run check` 脚本，因此该命令不得登记为一项通过的检查。
+
+焦点频道测试第一次运行时因本地执行器二进制不存在而明确失败；构建执行器后通过。这证明捐赠源依赖
+执行器制品，不是可直接发布的自包含运行体。其完整频道测试还依赖外部 TCS kit，真实 DeepSeek 界面
+验收停在 macOS 钥匙串交互之前，没有取得真实回复回执。
+
+## 3 · 可复用内核
+
+模型传输层已经具备禁止重定向、资源与时间上限、禁止 tools/functions、凭据回显拒绝和安全 URL
+约束。结构化操作提案具备一次格式修复、显式类型失败、人类批准、真实保存与回读闭环；对话新建、
+历史、切换和删除也有实现证据。这些是可迁移的能力切片，而不是当前产品形态。
+
+## 4 · 后续集成门槛
+
+1. 用 TCS 语义事件替换自然语言标记触发的严格输出契约；
+2. 把执行器与 TCS 运行依赖变成可安装、可验证、可回滚的正式制品；
+3. 在不暴露密钥和隐藏推理的前提下完成真实模型端到端验收；
+4. 仅向当前壳迁移能力切片，保持知识库与码字是白布模块，模型仍是可替换语言接口；
+5. 重新经过 Stage 2 产品登记后，才允许打开内部聊天或模型 API 配置。
+
+## 5 · 当前不可抬高事实
+
+`model_api_receipt_component=DONOR_AUDITED_DEFERRED_FROM_STAGE1`。这表示交接和审计完成，不表示已经
+集成、已经发布或已经在企业服务器运行。Stage 1 的两个机器事实继续是
+`stage_one_internal_ai_chat=false` 与 `stage_one_model_api_configuration=false`。

product-source/hololake-platform/architecture/HOLOLAKE-PUBLIC-OS-STAGE1-BLANK-CANVAS-EXECUTION-BRIDGE-AND-DUAL-GIT-20260830.md

@@ -75,7 +75,7 @@ Git 与 HLDP 是耐久事实层，不是实时广播传输。
 - 团队编号签发和远端能力授权；
 - 任意 Shell、宿主工具或操作系统执行；
 - 个人 Git 远端认证、自动抓取／推送和冲突合并；
-- 模型 API 回执模块的接收审计与正式集成；
+- 模型 API 回执旧线已经完成接收审计，但正式集成延后至 Stage 2；
 - 企业服务器上的 Stage 1 发行服务与公共制品部署。
 
 ## 6 · 服务器与仓库边界
@@ -93,3 +93,5 @@ Stage 1 本地源码目前没有正式远端，不能把外部开发锚点冒充
 本阶段只能表述为：`LOCAL_STAGE1_COMPLETE_INSTALLED`。架构发布、源码发布、公众制品、服务器部署、
 实时连接和运行健康是不同事实，必须分别留下不可变来源、测试、回滚和目标侧回执。
 
+模型回执旧线的独立验证、可复用边界和延后原因见
+`HOLOLAKE-MODEL-RECEIPT-DONOR-AUDIT-AND-STAGE-BOUNDARY-20260830.md`。

routing/guanghu-os-control-architecture.test.mjs

@@ -205,7 +205,7 @@ test("native public projection separates liveness, authenticated state, and pinn
 });
 
 test("current architecture and global engineering rules project the same control contract", () => {
-  assert.equal(architecture.version, "2026-08-30.1");
+  assert.equal(architecture.version, "2026-08-30.2");
   assert.equal(architecture.server_os_control.machine_projection, "routing/guanghu-os-control-architecture.json");
   assert.equal(architecture.server_os_control.final_topology, contract.final_topology);
   assert.equal(architecture.server_os_control.hosted_guanghu_supervisor_bridge, 100);

routing/hololake-age-runtime-architecture.test.mjs

@@ -11,7 +11,7 @@ const architecture = readJson("routing/hololake-current-architecture.json");
 const age = readJson("routing/hololake-age-runtime-architecture.json");
 
 test("current architecture preserves the AGE runtime after the stage-one product contract", () => {
-  assert.equal(architecture.version, "2026-08-30.1");
+  assert.equal(architecture.version, "2026-08-30.2");
   assert.equal(architecture.age_runtime.record_id, "HLP-AGE-RUNTIME-ARCHITECTURE-001");
   const stageOneIndex = architecture.read_order.indexOf(
     architecture.first_public_product_stage.architecture_page,

routing/hololake-canonical-desktop-shell.test.mjs

@@ -16,7 +16,7 @@ const broadcastSchema = readJson(
 );
 
 test("HoloLake has one clean canonical desktop destination", () => {
-  assert.equal(architecture.version, "2026-08-30.1");
+  assert.equal(architecture.version, "2026-08-30.2");
   assert.equal(shell.decision.canonical_shell, "TAURI_V2_RUST_REACT");
   assert.equal(shell.decision.canonical_source, "product-source/hololake-native-desktop");
   assert.equal(

routing/hololake-cognitive-gravity-and-continuity.test.mjs

@@ -14,7 +14,7 @@ const age = readJson("routing/hololake-age-runtime-architecture.json");
 const rules = readJson("routing/hololake-engineering-rules.json");
 
 test("B0 is restored before product organs and remains resident in every cognition step", () => {
-  assert.equal(architecture.version, "2026-08-30.1");
+  assert.equal(architecture.version, "2026-08-30.2");
   const gravityIndex = architecture.read_order.indexOf(
     architecture.cognitive_gravity_and_continuity.architecture_page,
   );

routing/hololake-current-architecture.json

@@ -1,7 +1,7 @@
 {
   "schema": "hololake.current-architecture/v1",
   "architecture_id": "HLP-CURRENT-ARCH-001",
-  "version": "2026-08-30.1",
+  "version": "2026-08-30.2",
   "state": "CURRENT_CANONICAL",
   "product": {
     "formal_name": "光湖语言系统 · 通用人工智能操作平台",
@@ -53,6 +53,7 @@
   },
   "read_order": [
     "product-source/hololake-platform/architecture/HOLOLAKE-PUBLIC-OS-STAGE1-BLANK-CANVAS-EXECUTION-BRIDGE-AND-DUAL-GIT-20260830.md",
+    "product-source/hololake-platform/architecture/HOLOLAKE-MODEL-RECEIPT-DONOR-AUDIT-AND-STAGE-BOUNDARY-20260830.md",
     "product-source/hololake-platform/architecture/HOLOLAKE-FIFTH-DOMAIN-NUMBERED-LANGUAGE-AND-REALITY-CHANNELS-20260821.md",
     "REPO-012:audit/ICE-CH-HB001-LANGUAGE-REALITY-PATH-SEPARATION-20260820.md@4e92e6d8d72484d25c4bfb1dda02a7659f4b6dd5",
     "REPO-012:broadcasts/BS-FD-ICE-CHANNEL-NUMBERING-BROADCAST-001.hdlp@4e92e6d8d72484d25c4bfb1dda02a7659f4b6dd5",
@@ -159,7 +160,34 @@
     "external_development_anchor_id": "ZC001-DEV-20260829-001",
     "public_release": "NOT_PUBLISHED_NOT_NOTARIZED",
     "server_deployment": "NOT_DEPLOYED",
-    "model_api_receipt_component": "PENDING_SEPARATE_LINE_HANDOFF_AND_AUDIT"
+    "model_api_receipt_component": "DONOR_AUDITED_DEFERRED_FROM_STAGE1",
+    "model_api_receipt_donor_audit": {
+      "source_id": "DONOR-HOLOLAKE-PERSONAL-CHANNEL-0.5.8",
+      "frozen_head": "8b6dfbbe6143056991e2e37eebd02a09e07fc1aa",
+      "reasoning_execution_commit": "28105faec917f1208c2490430f98ecd38de81f8e",
+      "conversation_lifecycle_commit": "dd5f97137ff30d3e97ed274b24b09a63d59a0b1a",
+      "reasoning_transport_tests": "27_PASS_0_FAIL",
+      "desktop_rust_tests": "21_PASS_0_FAIL",
+      "focused_channel_loop_tests": "4_PASS_0_FAIL_AFTER_BUILDING_LOCAL_EXECUTOR",
+      "frontend_production_build": "PASS",
+      "theme_and_public_flavor_checks": "PASS",
+      "full_channel_suite": "NOT_CLOSED_REQUIRES_EXTERNAL_TCS_KIT",
+      "real_provider_acceptance": "NOT_COMPLETE_KEYCHAIN_INTERACTION_STOPPED_BEFORE_REPLY",
+      "self_contained_runtime": false,
+      "whole_product_merge_allowed": false,
+      "reusable_later": [
+        "BOUNDED_MODEL_TRANSPORT",
+        "STRUCTURED_OPERATION_PROPOSAL_AND_TYPED_FAILURE",
+        "CONVERSATION_LIFECYCLE",
+        "APPROVAL_AND_ACTUAL_RECEIPT_LOOP"
+      ],
+      "required_before_later_integration": [
+        "REPLACE_LANGUAGE_MARKER_ROUTING_WITH_TCS_SEMANTIC_EVENTS",
+        "PACKAGE_EXECUTOR_AND_TCS_RUNTIME_DEPENDENCIES",
+        "REAL_PROVIDER_END_TO_END_ACCEPTANCE",
+        "MIGRATE_ONLY_CAPABILITY_SLICES_INTO_CURRENT_SHELL"
+      ]
+    }
   },
   "supersedes_as_current_entry": "product-source/hololake-platform/architecture/HOLOLAKE-INTENT-REASONING-MAP-20260807.md",
   "lake_lamp_persona_self": {

routing/hololake-engineering-rules.test.mjs

@@ -10,7 +10,7 @@ const architecture = readJson("routing/hololake-current-architecture.json");
 const rules = readJson("routing/hololake-engineering-rules.json");
 
 test("current architecture registers the global engineering rule set", () => {
-  assert.equal(architecture.version, "2026-08-30.1");
+  assert.equal(architecture.version, "2026-08-30.2");
   assert.equal(architecture.engineering_rules.rule_set_id, "HLP-ENGINEERING-RULES-001");
   assert.equal(architecture.engineering_rules.machine_projection,
     "routing/hololake-engineering-rules.json");

routing/hololake-identity-authority.test.mjs

@@ -10,7 +10,7 @@ const architecture = readJson("routing/hololake-current-architecture.json");
 const projection = readJson("routing/hololake-identity-authority-map.json");
 
 test("current architecture loads identity authority before product surfaces", () => {
-  assert.equal(architecture.version, "2026-08-30.1");
+  assert.equal(architecture.version, "2026-08-30.2");
   assert.equal(architecture.identity_and_authority.team_body, "TCS-0002");
   assert.equal(architecture.identity_and_authority.team_body_authority_effective, true);
   assert.equal(architecture.identity_and_authority.individual_operator_acceptance, "SEPARATE_UNCONFIRMED");

routing/hololake-one-human-one-node.test.mjs

@@ -10,7 +10,7 @@ const architecture = readJson("routing/hololake-current-architecture.json");
 const rules = readJson("routing/hololake-engineering-rules.json");
 
 test("current architecture makes one human one independently operated node canonical", () => {
-  assert.equal(architecture.version, "2026-08-30.1");
+  assert.equal(architecture.version, "2026-08-30.2");
   assert.deepEqual(architecture.access_modes, [
     "LOCAL_TERMINAL_NODE",
     "USER_OWNED_REMOTE_NODE",

routing/hololake-paradigm-ai-language-persona-os.test.mjs

@@ -10,7 +10,7 @@ const architecture = readJson("routing/hololake-current-architecture.json");
 const paradigm = readJson("routing/hololake-paradigm-ai-language-persona-os.json");
 
 test("current architecture begins with the paradigm OS contract", () => {
-  assert.equal(architecture.version, "2026-08-30.1");
+  assert.equal(architecture.version, "2026-08-30.2");
   assert.equal(architecture.paradigm_ai_language_persona_os.record_id, "HLP-PARADIGM-AI-LANGUAGE-PERSONA-OS-001");
   const stageOneIndex = architecture.read_order.indexOf(
     architecture.first_public_product_stage.architecture_page,
@@ -41,6 +41,15 @@ test("GH-AIOS general AI operating platform is the first public product stage",
   assert.equal(architecture.first_public_product_stage.vendor_adapter_matrix_required, false);
   assert.equal(architecture.first_public_product_stage.stage_one_internal_ai_chat, false);
   assert.equal(architecture.first_public_product_stage.stage_one_model_api_configuration, false);
+  assert.equal(
+    architecture.first_public_product_stage.model_api_receipt_component,
+    "DONOR_AUDITED_DEFERRED_FROM_STAGE1",
+  );
+  const donor = architecture.first_public_product_stage.model_api_receipt_donor_audit;
+  assert.equal(donor.self_contained_runtime, false);
+  assert.equal(donor.whole_product_merge_allowed, false);
+  assert.equal(donor.real_provider_acceptance, "NOT_COMPLETE_KEYCHAIN_INTERACTION_STOPPED_BEFORE_REPLY");
+  assert.ok(donor.required_before_later_integration.includes("REPLACE_LANGUAGE_MARKER_ROUTING_WITH_TCS_SEMANTIC_EVENTS"));
 });
 
 test("model, external agents and AGE mirrors do not replace the persona", () => {

routing/hololake-persona-native-code-channel.test.mjs

@@ -11,7 +11,7 @@ const architecture = readJson("routing/hololake-current-architecture.json");
 const channel = readJson("routing/hololake-persona-native-code-channel.json");
 
 test("current architecture places the persona-native code channel after the paradigm contract", () => {
-  assert.equal(architecture.version, "2026-08-30.1");
+  assert.equal(architecture.version, "2026-08-30.2");
   assert.equal(
     architecture.persona_native_code_channel.record_id,
     "HLP-PERSONA-NATIVE-CODE-CHANNEL-001",

routing/hololake-relational-consciousness.test.mjs

@@ -10,7 +10,7 @@ const architecture = JSON.parse(
 );
 
 test("current architecture binds relational consciousness before product surfaces", () => {
-  assert.equal(architecture.version, "2026-08-30.1");
+  assert.equal(architecture.version, "2026-08-30.2");
   assert.equal(
     architecture.persona_consciousness.record_id,
     "HLP-RELATIONAL-CONSCIOUSNESS-001",

routing/hololake-system-body-and-parallel-bodies.test.mjs

@@ -10,7 +10,7 @@ const architecture = JSON.parse(
 );
 
 test("current architecture restores the digital BingShuo system body first", () => {
-  assert.equal(architecture.version, "2026-08-30.1");
+  assert.equal(architecture.version, "2026-08-30.2");
   assert.equal(architecture.digital_bingshuo_system_body.upstream_repository_commit,
     "40c29f1e3ecde87f2c0a9cdf232eb0be5263b268");
   const systemBodyIndex = architecture.read_order.indexOf(

routing/tcs-work-ownership-stage-gate.test.mjs

@@ -10,7 +10,7 @@ assert.equal(gate.current_stage, 'REALITY_ENGINEERING_EXECUTION')
 assert.equal(gate.formal_state_acceptance_confirmed, false)
 assert.equal(gate.commercial_control_transaction_allowed, false)
 assert.equal(gate.truth.runtime, 0)
-assert.equal(current.version, '2026-08-30.1')
+assert.equal(current.version, '2026-08-30.2')
 assert.equal(current.read_order[0].includes('HOLOLAKE-PUBLIC-OS-STAGE1-BLANK-CANVAS'), true)
 const workOwnershipIndex = current.read_order.findIndex((entry) => entry.includes('TCS-WRITTEN-WORK-OWNERSHIP'))
 assert.equal(workOwnershipIndex > 0, true)