feat(domain): project verified runtime policy to desktop

product-source/guanghu-knowledge-base/src/domain-entry-state.ts

@@ -20,7 +20,14 @@ export function canEnterSelectedDomainRuntime(target: DomainEntryTarget | null,
   if (access.nodeType !== target.nodeType) return false;
   // The present desktop bundle contains only the Fifth Domain renderer. The four
   // enterprise domains must provide their own signed runtime package and endpoint.
-  return target.domain.routeId === 'fifth';
+  if (target.domain.routeId !== 'fifth') return false;
+  const policy = access.runtimePolicy;
+  return Boolean(policy
+    && /^[a-f0-9]{64}$/.test(policy.manifestDigest)
+    && policy.themeOwner === 'fifth-domain'
+    && policy.themePackageRef.startsWith('theme://origin-domain/')
+    && policy.routeRef.startsWith('domain-route://origin-domain/')
+    && policy.allowedSessionScopes.includes('domain:enter'));
 }
 
 export function projectDomainRuntimeBoundary(target: DomainEntryTarget | null, access: DomainAccessProjection): string {
@@ -34,7 +41,8 @@ export function projectDomainRuntimeBoundary(target: DomainEntryTarget | null, a
   if (target.domain.routeId !== 'fifth') {
     return `${target.domain.displayName}的独立运行端点与主题包尚未登记；当前只能查看公开门厅。`;
   }
-  return access.runtimeReady
-    ? '第五域运行端点、签名清单、会话能力与在线回执已经匹配。'
-    : '第五域入口保持关闭，直到四项真实接入证据全部匹配。';
+  if (!access.runtimeReady) return '第五域入口保持关闭，直到四项真实接入证据全部匹配。';
+  return canEnterSelectedDomainRuntime(target, access)
+    ? '第五域运行端点、签名清单、主题策略、会话能力与在线回执已经匹配。'
+    : '域接入证据声称已就绪，但可信运行策略缺失或不匹配；第五域入口保持关闭。';
 }