feat: enforce Guanghu-native HoloLake runtime laws

product-source/hololake-platform/AGENTS.md

@@ -4,7 +4,7 @@
 
 ### Start working on a task
 
-**Before writing a single line of code:** inspect the available quality tooling. If CodeScene credentials are already configured, run `mcp__codescene__code_health_score` and enforce `.codescene-thresholds`. If CodeScene is unavailable or unconfigured, record that fact and continue with the repository-owned lint, type-check, test, coverage, and security gates. Do not create an account, start a trial, buy a subscription, or block Git publication merely to obtain an optional external score.
+**Before writing a single line of code:** read GLS-0101, GLS-0247, and GLS-0844, then inspect the repository-owned validation commands. HoloLake accepts only a GHNQG receipt bound to the exact commit and tree. The only terminal states are `GHNQG_PASS_100` and `GHNQG_FAIL_0`; no external score, account, subscription, badge, or service can authorize or block Guanghu publication.
 
 - Read task description and all comments fully
 - For To Rework: the ❌ QA failed comment tells you exactly what to fix
@@ -21,7 +21,7 @@
   - an explicitly authorized Fifth Domain prototype may publish an allowlisted branch through `HoloLake -> Guanghu Router -> JD-FD-PRIMARY -> code channel`, with an exact remote-head check and a `repo_push_succeeded` receipt;
   - a Router branch receipt proves repository publication only. It is not a merge to `main`, a release, a deployment, or service health.
 - Commit every 20–30 min: `feat:`, `fix:`, `refactor:`, `test:`, `docs:`
-- Pre-commit is a lightweight lint gate only. Pre-push runs the full repository-owned check suite (build + tests + coverage + core Playwright smoke) and adds CodeScene only when its credentials are already configured. Prefer three Chunk sidecar lanes for automatic test/coverage work: frontend lint/build/coverage, Rust coverage, and Playwright smoke.
+- Pre-commit is a lightweight lint gate only. Pre-push runs the repository-owned checks, validates the active-authority surfaces, and emits the native GLS-0844 result. Prefer three sidecar lanes for observation and execution speed: frontend lint/build/tests, Rust tests, and Playwright smoke. Sidecars never become quality authorities.
 - A production-promotion task is not done until `git push origin main` succeeds. A scoped Fifth Domain prototype publication is not done until the Router returns the published SHA and a fresh public read-back matches it. If a repository-owned hook blocks, fix the failing check and retry. **⛔ NEVER use --no-verify**
 
 ### TDD (mandatory)
@@ -46,45 +46,25 @@ New features should almost always emit a PostHog event so we can see whether use
 
 When adding or changing a meaningful user-facing feature, include the event name(s) in the Todoist completion comment alongside QA, docs, and code health. If intentionally not instrumenting a feature, explain why in the completion comment.
 
-### Code health (mandatory)
+### Guanghu native quality authority (mandatory)
 
-Repository-owned lint, type checks, tests, coverage, and security analysis are mandatory. CodeScene is an additional ratcheted gate only when the repository already has valid CodeScene credentials. Its absence is not a transport failure and must not trigger account creation or payment. Never add `// eslint-disable`, `#[allow(...)]`, or `as any`.
+GLS-0844 (GHNQG) is the sole quality authority. Repository-owned lint, type checks, tests, protocol validation, format checks, security invariants, exact source fingerprints, and auditable core coverage are required evidence. Never add `// eslint-disable`, `#[allow(...)]`, or `as any`.
 
-**When CodeScene is available:** treat it as a before/after gate, not just a final score. Record the starting state before edits and the final state after edits. If touched code gets worse, refactor before committing.
+- Every required gate is either complete (`100`) or incomplete (`0`).
+- The aggregate result is `PASS_100` only when every required gate is complete; any incomplete gate makes the aggregate `FAIL_0`.
+- Percent-above-minimum, weighted scores, waivers, “mostly passing”, and unconfigured-observer states are not acceptance states.
+- Coverage is exact only for a declared auditable scope. Undeclared scope is incomplete, not implicitly accepted.
+- External services may be used as non-authoritative observations only when a human explicitly requests them. Their configuration and result never enter a HoloLake gate or receipt.
+- Before commit, run `bash scripts/test-guanghu-native-authority.sh`. Before publication, run the GLS-0844 executor and bind its receipt to the exact commit and tree.
 
-**⛔ NEVER edit `.codescene-thresholds` to lower the values.** If the gate blocks you, improve the code — do not lower the bar.
-
-**CodeScene access order:** use CodeScene MCP tools if already connected. Otherwise use the installed `cs` CLI only when a valid `CS_ACCESS_TOKEN` is already available, and use the CodeScene API only when `CODESCENE_PAT` plus `CODESCENE_PROJECT_ID` are already configured. If none are configured, mark CodeScene `not_run_unconfigured` and run all repository-owned gates.
-
-**When CodeScene is available, before editing any existing code file:** capture its current file-level score. After your edits, re-run the same review and verify the score is higher. If the file already starts at `10.0`, it must remain `10.0`.
-
-**When CodeScene is available, new files:** every new scorable code file must reach CodeScene score `10.0` before commit. If CodeScene reports `null` / "no scorable code", it must still have zero CodeScene findings/warnings.
-
-**Before every commit:** run the mandatory repository-owned checks. Add CodeScene file-level review for every touched code file only when CodeScene is configured. The Boy Scout Rule still applies through review, tests, complexity control, and refactoring even when the external score is unavailable.
-
-**If a configured CodeScene gate blocks your push:** find the worst file, refactor it, commit, and push again. Do not disable the gate or lower thresholds.
-
-### Security scan with Codacy (mandatory)
-
-Use Codacy as a security and static-analysis gate before a task is considered releasable.
-
-- Prefer the Codacy MCP inside Codex to inspect repository/file issues for every touched code file.
-- If MCP is unavailable, use the local CLI wrapper, e.g. `.codacy/cli.sh analyze <path> --format sarif`; choose the relevant tool when useful (`eslint`, `opengrep`, `trivy`, `lizard`).
-- **Always fix Critical and High severity findings introduced by your change.** Do not move the task to In Review with new Critical/High Codacy issues.
-- Review Medium findings. Fix them when they are real defects or security-sensitive; otherwise explain why they are acceptable in the completion comment.
-- Never silence a Codacy rule just to pass the scan. Prefer small code changes that remove the finding.
-
-### Check suite (runs on every push)
+### Evidence suite (runs before the native receipt)
 ```bash
-pnpm lint && npx tsc --noEmit && pnpm test && pnpm test:coverage  # frontend ≥70%
-cargo test && cargo llvm-cov --manifest-path src-tauri/Cargo.toml --no-clean --fail-under-lines 85
+pnpm test:native-authority
+pnpm lint && pnpm exec tsc --noEmit && pnpm test
+cargo test --manifest-path src-tauri/Cargo.toml
 ```
 
-Coverage is a release gate, not a vanity metric:
-- Frontend coverage must stay ≥70%.
-- Rust line coverage must stay ≥85%.
-- For bug fixes, add a regression test when practical.
-- For new behavior, add targeted coverage close to the changed code; do not rely only on broad E2E coverage.
+For bug fixes, add a regression test when practical. For new behavior, add targeted coverage close to the changed code; do not rely only on broad E2E coverage. Observed coverage may guide work, but only the declared auditable GHNQG core scope can produce the exact native coverage gate.
 
 ### UI and native QA
 
@@ -118,12 +98,10 @@ Before pushing or moving a task to In Review, verify the release gates and add a
 - What was implemented (a few lines covering logic and UX/UI).
 - QA: what was tested and how (Playwright / native screenshot / osascript).
 - Tests/coverage: commands run and final coverage result.
-- CodeScene: before/after touched-file checks and final scores when configured; otherwise record `not_run_unconfigured` and confirm the repository-owned gates passed.
-- Coverage commands passed (`pnpm test:coverage` and `cargo llvm-cov ... --fail-under-lines 85`) or the change is docs-only.
-- Codacy: MCP/CLI scan summary; confirm no new Critical/High findings.
+- GHNQG: `PASS_100` or `FAIL_0`, plus the exact commit, tree, receipt path, and declared coverage scope.
 - Localization: any user-facing copy lives in `src/lib/locales/en.json`, `pnpm l10n:translate` was run, and `pnpm l10n:validate` passes. If no copy changed, say “Localization: no UI copy changes”.
 - PostHog: meaningful new user actions/events are instrumented with safe metadata; noisy/minor changes explicitly say “PostHog: no event needed because …”.
-- Refactoring: any files refactored to meet the CodeScene gate, or "none needed".
+- Refactoring: any files refactored to satisfy native invariants, or "none needed".
 - ADRs: any new/updated ADRs, or "none".
 - Docs: any updated docs (`ARCHITECTURE.md`, `ABSTRACTIONS.md`, etc.), or "none".
 - Demo vault dirt checked: `git status --short -- demo-vault demo-vault-v2` is empty unless fixture changes are intentional.