feat: add JD native read-only service surface

2026-08-15 18:54:01 +08:00 · 2026-08-15 18:54:01 +08:00 · 856a6c9ffb
commit 856a6c9ffb
parent a5a1cdc185
8 changed files with 317 additions and 18 deletions
--- a/product-source/hololake-platform/docs/adr/0179-jd-native-read-only-service-surface-before-public-cutover.md
+++ b/product-source/hololake-platform/docs/adr/0179-jd-native-read-only-service-surface-before-public-cutover.md
@ -0,0 +1,48 @@
+---
+type: ADR
+id: "0179"
+title: "JD native read-only service surface before public cutover"
+status: accepted
+date: 2026-08-15
+supersedes: "0171-jd-native-service-equivalence-staging"
+---
+
+# 京东原生只读服务面先于公网切换
+
+## 触发
+
+京东物理机已经证明 GOSK/GHAL 原生常驻能力，但原生常驻时公网 `/code/` 与
+`/api/ai/v1/anchor` 返回 `502`。本轮重新读取真实链路后确认，公网前门实际位于
+`BS-GZ-006`：它通过反向 SSH 隧道进入京东 Linux 上的 Node 导航服务、应用代理和
+Forgejo。原生启动会使整个 Linux 数据面与 SSH 一起消失。
+
+## 为什么旧办法不成立
+
+继续在 Ubuntu 宿主里增加守卫、进程或 Docker 服务，只能提高 Linux 宿主阶段的可用性，
+不能让服务跨越原生启动。QEMU 回执也只能证明候选能力，不能替代物理公网读回。一个固定
+JSON 快照不是 Forgejo，也不能把完整代码频道等价从 `0` 写成 `100`。
+
+## 决定
+
+原生候选先提供两个互相独立的只读接口：
+
+- `GET /v1/anchor`：唯一公共导航锚点；
+- `GET /v1/code-channel`：绑定 REPO-012 精确分支与提交的只读发现快照。
+
+两者必须在同一次原生驻留 QEMU 生命周期里通过 TCP、校验和、正文精确读回以及受保护恢复
+能力测试。公网等价仍需另一个门：为 `BS-GZ-006` 建立在 Linux 不在场时仍存在的受认证原生
+传输，并分别验证公网导航与 `/code/` 产品契约。
+
+## 当前边界
+
+本轮只完成源码、契约与 QEMU 候选验证：
+
+- 原生导航锚点 QEMU：`100`；
+- 原生代码频道只读发现 QEMU：`100`；
+- 京东物理机本轮启动：`0`；
+- 公网原生导航：`0`；
+- 公网原生代码频道：`0`；
+- 完整 Forgejo 等价：`0`；
+- 最终光湖 OS 主控：`0`。
+
+没有修改默认启动、引导盘、服务器磁盘或公网前门。
--- a/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-READ-ONLY-SERVICE-SURFACE-QEMU-RECEIPT-20260815.hdlp
+++ b/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-READ-ONLY-SERVICE-SURFACE-QEMU-RECEIPT-20260815.hdlp
@ -0,0 +1,33 @@
+schema: guanghu.jd-native-read-only-service-surface-qemu-receipt/v1
+receipt_id: GH-OS-JD-FD-PRIMARY-NATIVE-READ-ONLY-SERVICE-SURFACE-QEMU-20260815-001
+status: PASS_100
+observed_at: 2026-08-15T18:47:43+08:00
+node_id: JD-FD-PRIMARY
+source:
+  repository_id: REPO-014
+  accepted_repo_012_commit: fb1096c5ecdcfb36015d51273f487c2f36d9c9cd
+candidate:
+  sector_count: 29
+  sha256: 9807fa751616d4b421c103d60eecface1c5eb8013cbd89417ef9e027da281fb3
+  recovery_capability: QEMU_FIXTURE_ONLY_NOT_DEPLOYABLE
+verified:
+  native_anchor_http_qemu: 100
+  native_code_channel_read_only_qemu: 100
+  tcp_checksums: 100
+  exact_response_bodies: 100
+  protected_recovery_capability: 100
+  wrong_recovery_capability_ignored: 100
+truth_boundary:
+  native_physical_readback_this_cycle: 0
+  public_anchor_during_native_residency: 0
+  public_code_during_native_residency: 0
+  full_forgejo_equivalence: 0
+  default_boot_changed: false
+  bootloader_written: false
+  server_disk_written: false
+  server_rebooted: false
+why:
+  trigger: Native residency removed the Linux-hosted SSH and service data plane, causing public 502 responses.
+  decision: Prove a bounded native read-only surface before designing the authenticated BS-GZ-006 relay and public mapping.
+  rejected: Treating a Linux-hosted guard, a QEMU result, or a JSON snapshot as production service equivalence.
+next_action: IMPLEMENT_AUTHENTICATED_NATIVE_TO_BS_GZ_006_TRANSPORT_AND_SEPARATE_PUBLIC_ANCHOR_FROM_FULL_CODE_CHANNEL_ACCEPTANCE
--- a/product-source/hololake-platform/guanghu-os/native/x86_64-bios/ghal-virtio.asm
+++ b/product-source/hololake-platform/guanghu-os/native/x86_64-bios/ghal-virtio.asm
@ -1333,13 +1333,47 @@ ghal_net_try_anchor_http:
    sub eax, 4
    cmp dword [VIRTIO_NET_RX_BUFFER + rax], 0x20544547
    jne .handled_without_reply
-    mov byte [rel ghal_anchor_tcp_flags], 0x19
+    lea edx, [eax + 15]
+    cmp r14d, edx
+    jb .handled_without_reply
+    mov rdx, 0x2f31762f20544547
+    cmp qword [VIRTIO_NET_RX_BUFFER + rax], rdx
+    jne .handled_without_reply
+    mov rdx, 0x4820726f68636e61
+    cmp qword [VIRTIO_NET_RX_BUFFER + rax + 8], rdx
+    jne .try_code_channel
    mov rsi, ghal_anchor_http_response
+    mov [rel ghal_http_response_pointer], rsi
    mov word [rel ghal_anchor_tcp_payload_size], ghal_anchor_http_response_end - ghal_anchor_http_response
+    jmp .send_http
+.try_code_channel:
+    lea edx, [eax + 21]
+    cmp r14d, edx
+    jb .handled_without_reply
+    mov rdx, 0x6168632d65646f63
+    cmp qword [VIRTIO_NET_RX_BUFFER + rax + 8], rdx
+    jne .handled_without_reply
+    cmp dword [VIRTIO_NET_RX_BUFFER + rax + 16], 0x6c656e6e
+    jne .handled_without_reply
+    cmp byte [VIRTIO_NET_RX_BUFFER + rax + 20], 0x20
+    jne .handled_without_reply
+    mov rsi, ghal_code_channel_http_response
+    mov [rel ghal_http_response_pointer], rsi
+    mov word [rel ghal_anchor_tcp_payload_size], ghal_code_channel_http_response_end - ghal_code_channel_http_response
+.send_http:
+    mov byte [rel ghal_anchor_tcp_flags], 0x19
    call ghal_net_send_anchor_tcp
    jc .not_anchor
    mov byte [rel physical_proof_anchor_http_response_tx], 1
+    mov rax, [rel ghal_http_response_pointer]
+    lea rdx, [rel ghal_code_channel_http_response]
+    cmp rax, rdx
+    jne .log_anchor_http
+    mov rsi, msg_ghal_code_channel_http_ready
+    jmp .log_http
+.log_anchor_http:
    mov rsi, msg_ghal_anchor_http_ready
+.log_http:
    call serial_write64
    clc
    ret
@ -1432,7 +1466,7 @@ ghal_net_send_anchor_tcp:
    movzx ecx, word [rel ghal_anchor_tcp_payload_size]
    test ecx, ecx
    jz .checksums
-    mov rsi, ghal_anchor_http_response
+    mov rsi, [rel ghal_http_response_pointer]
    mov rdi, VIRTIO_NET_TX_BUFFER + 64
    rep movsb
 .checksums:
@ -1557,6 +1591,7 @@ ghal_anchor_tcp_payload_size: dw 0
 ghal_anchor_rx_ipv4_header_size: dw 0
 ghal_anchor_rx_tcp_offset: dw 0
 ghal_anchor_rx_tcp_header_size: dw 0
+ghal_http_response_pointer: dq 0
 %endif

 msg_ghal_net_discovered: db "GHOS_GHAL_VIRTIO_NET=DISCOVERED", 13, 10, 0
@ -1575,6 +1610,15 @@ ghal_anchor_http_response:
    db "Content-Length: 286", 13, 10, 13, 10
    db '{"schema":"guanghu.native-public-anchor/v1","anchor_id":"GLW-PUBLIC-NAV-ANCHOR-001","entry_path":"LL-CMPN-0001","world_node_id":"SYS-GLW-0001","repository_id":"REPO-012","branch":"main","code_entry":"https://guanghulab.com/code/bingshuo/guanghu-ice-heart","runtime":"GUANGHU_OS_NATIVE"}'
 ghal_anchor_http_response_end:
+msg_ghal_code_channel_http_ready: db "GHOS_NATIVE_CODE_CHANNEL_HTTP=RESPONSE_TX", 13, 10, 0
+ghal_code_channel_http_response:
+    db "HTTP/1.1 200 OK", 13, 10
+    db "Content-Type: application/json", 13, 10
+    db "Cache-Control: no-store", 13, 10
+    db "Connection: close", 13, 10
+    db "Content-Length: 240", 13, 10, 13, 10
+    db '{"schema":"guanghu.native-code-channel-read-only/v1","repository_id":"REPO-012","branch":"main","commit":"fb1096c5ecdcfb36015d51273f487c2f36d9c9cd","mode":"READ_ONLY_DISCOVERY","runtime":"GUANGHU_OS_NATIVE","full_forgejo_equivalence":false}'
+ghal_code_channel_http_response_end:
 %endif
 msg_ghal_world_store_ready: db "GHOS_HLDP_WORLD_STORE=WRITE_READ_VERIFIED", 13, 10, 0
 msg_ghal_code_channel_store_ready: db "GHOS_CODE_CHANNEL_STORE=WRITE_READ_VERIFIED", 13, 10, 0
--- a/product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py
+++ b/product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py
@ -18,6 +18,8 @@ NATIVE_ACK_MAGIC = b"HLDP-NATIVE-ACK!"
 ANCHOR_PORT = 3922
 ANCHOR_CLIENT_PORT = 40392
 ANCHOR_CLIENT_SEQUENCE = 0x10203040
+CODE_CLIENT_PORT = 40393
+CODE_CLIENT_SEQUENCE = 0x20304050
 ANCHOR_BODY = (
    b'{"schema":"guanghu.native-public-anchor/v1",'
    b'"anchor_id":"GLW-PUBLIC-NAV-ANCHOR-001",'
@ -26,6 +28,13 @@ ANCHOR_BODY = (
    b'"code_entry":"https://guanghulab.com/code/bingshuo/guanghu-ice-heart",'
    b'"runtime":"GUANGHU_OS_NATIVE"}'
 )
+CODE_BODY = (
+    b'{"schema":"guanghu.native-code-channel-read-only/v1",'
+    b'"repository_id":"REPO-012","branch":"main",'
+    b'"commit":"fb1096c5ecdcfb36015d51273f487c2f36d9c9cd",'
+    b'"mode":"READ_ONLY_DISCOVERY","runtime":"GUANGHU_OS_NATIVE",'
+    b'"full_forgejo_equivalence":false}'
+)


 def checksum(payload: bytes) -> int:
@ -105,13 +114,14 @@ def tcp_frame(
    acknowledgement: int,
    payload: bytes = b"",
    options: bytes = b"",
+    client_port: int = ANCHOR_CLIENT_PORT,
 ) -> bytes:
    if len(options) % 4 or len(options) > 40:
        raise ValueError("TCP options must be 32-bit aligned and no more than 40 bytes")
    tcp = bytearray(
        struct.pack(
            "!HHIIBBHHH",
-            ANCHOR_CLIENT_PORT,
+            client_port,
            ANCHOR_PORT,
            sequence,
            acknowledgement,
@ -137,7 +147,9 @@ def tcp_frame(
    return GUEST_MAC + PEER_MAC + b"\x08\x00" + bytes(ip) + bytes(tcp)


-def verify_anchor_tcp(frame: bytes, expected_flags: int) -> tuple[int, int, bytes]:
+def verify_anchor_tcp(
+    frame: bytes, expected_flags: int, client_port: int = ANCHOR_CLIENT_PORT
+) -> tuple[int, int, bytes]:
    assert frame[0:6] == PEER_MAC
    assert frame[6:12] == GUEST_MAC
    assert frame[12:14] == b"\x08\x00"
@ -148,7 +160,7 @@ def verify_anchor_tcp(frame: bytes, expected_flags: int) -> tuple[int, int, byte
    total_length = int.from_bytes(frame[16:18], "big")
    tcp = frame[34 : 14 + total_length]
    assert int.from_bytes(tcp[0:2], "big") == ANCHOR_PORT
-    assert int.from_bytes(tcp[2:4], "big") == ANCHOR_CLIENT_PORT
+    assert int.from_bytes(tcp[2:4], "big") == client_port
    assert tcp[13] == expected_flags
    pseudo = GUEST_IP + GATEWAY_IP + b"\0\x06" + struct.pack("!H", len(tcp))
    assert checksum(pseudo + tcp) == 0
@ -170,6 +182,7 @@ def main() -> None:
    parser.add_argument("--recovery-token-file")
    parser.add_argument("--login-only", action="store_true")
    parser.add_argument("--anchor-http", action="store_true")
+    parser.add_argument("--service-equivalence", action="store_true")
    parser.add_argument("--guest-ip", default="172.16.0.6")
    parser.add_argument("--peer-ip", default="172.16.0.1")
    parser.add_argument("--relay-ip", default="43.153.193.169")
@ -192,7 +205,7 @@ def main() -> None:
    peer.bind(("127.0.0.1", args.listen_port))
    peer.settimeout(0.2)
    qemu = ("127.0.0.1", args.qemu_port)
-    deadline = time.monotonic() + 15
+    deadline = time.monotonic() + (30 if args.service_equivalence else 15)
    arp_verified = False
    login_count = 0
    resident_login_count = 0
@ -204,6 +217,11 @@ def main() -> None:
    anchor_server_sequence = None
    anchor_get_sent = False
    anchor_http_verified = False
+    code_syn_sent = False
+    code_syn_ack_verified = False
+    code_server_sequence = None
+    code_get_sent = False
+    code_http_verified = False

    while time.monotonic() < deadline:
        try:
@ -217,6 +235,46 @@ def main() -> None:
        if frame[12:14] != b"\x08\x00":
            continue
        if frame[23] == 6:
+            response_client_port = int.from_bytes(frame[36:38], "big")
+            if response_client_port == CODE_CLIENT_PORT:
+                if not code_syn_ack_verified:
+                    server_sequence, acknowledgement, payload = verify_anchor_tcp(
+                        frame, 0x12, CODE_CLIENT_PORT
+                    )
+                    assert acknowledgement == CODE_CLIENT_SEQUENCE + 1
+                    assert payload == b""
+                    code_server_sequence = server_sequence
+                    code_syn_ack_verified = True
+                    request = (
+                        b"GET /v1/code-channel HTTP/1.1\r\n"
+                        b"Host: native.guanghulab.com\r\n"
+                        b"Connection: close\r\n\r\n"
+                    )
+                    peer.sendto(
+                        tcp_frame(
+                            0x18,
+                            CODE_CLIENT_SEQUENCE + 1,
+                            server_sequence + 1,
+                            request,
+                            options=b"\x01\x01\x08\x0a\xd8\x8d\xec\x57\x00\x00\x00\x01",
+                            client_port=CODE_CLIENT_PORT,
+                        ),
+                        qemu,
+                    )
+                    code_get_sent = True
+                    continue
+                server_sequence, acknowledgement, payload = verify_anchor_tcp(
+                    frame, 0x19, CODE_CLIENT_PORT
+                )
+                assert code_server_sequence is not None
+                assert server_sequence == code_server_sequence + 1
+                assert acknowledgement > CODE_CLIENT_SEQUENCE + 1
+                header, body = payload.split(b"\r\n\r\n", 1)
+                assert b"HTTP/1.1 200 OK" in header
+                assert f"Content-Length: {len(CODE_BODY)}".encode() in header
+                assert body == CODE_BODY
+                code_http_verified = True
+                continue
            if not anchor_syn_ack_verified:
                server_sequence, acknowledgement, payload = verify_anchor_tcp(frame, 0x12)
                assert acknowledgement == ANCHOR_CLIENT_SEQUENCE + 1
@ -249,6 +307,21 @@ def main() -> None:
            assert b"Content-Length: 286" in header
            assert body == ANCHOR_BODY
            anchor_http_verified = True
+            if args.service_equivalence and not code_syn_sent:
+                peer.sendto(
+                    tcp_frame(
+                        0x02,
+                        CODE_CLIENT_SEQUENCE,
+                        0,
+                        options=(
+                            b"\x02\x04\x05\x90\x04\x02\x08\x0a"
+                            b"\xd8\x8d\xec\x57\x00\x00\x00\x00\x01\x03\x03\x07"
+                        ),
+                        client_port=CODE_CLIENT_PORT,
+                    ),
+                    qemu,
+                )
+                code_syn_sent = True
            continue
        sequence = int.from_bytes(frame[40:42], "big")
        if sequence <= 3:
@ -273,12 +346,13 @@ def main() -> None:
            raise AssertionError(f"unexpected native sequence {sequence}")
        verified_request(frame, sequence, magic)
        peer.sendto(ordinary_reply(frame), qemu)
-        time.sleep(0.05)
+        time.sleep(0.005 if args.service_equivalence else 0.05)
        response_capability = NATIVE_ACK_MAGIC
        if (
            args.final_resident
            and resident_login_count >= 3
            and (not args.anchor_http or anchor_http_verified)
+            and (not args.service_equivalence or code_http_verified)
        ):
            response_capability = recovery_capability
            recovery_verified = True
@ -286,9 +360,9 @@ def main() -> None:
        for repetition in range(4):
            peer.sendto(reply, qemu)
            if repetition < 3:
-                time.sleep(0.01)
+                time.sleep(0.001 if args.service_equivalence else 0.01)
        if (
-            args.anchor_http
+            (args.anchor_http or args.service_equivalence)
            and args.final_resident
            and sequence == 6
            and not anchor_syn_sent
@ -336,12 +410,24 @@ def main() -> None:
                f"anchor_syn_sent: {str(anchor_syn_sent).lower()}\n"
                f"anchor_syn_ack_verified: {str(anchor_syn_ack_verified).lower()}\n"
                f"anchor_get_sent: {str(anchor_get_sent).lower()}\n"
-                f"anchor_http_verified: {str(anchor_http_verified).lower()}\n"
+        f"anchor_http_verified: {str(anchor_http_verified).lower()}\n"
+        f"code_syn_sent: {str(code_syn_sent).lower()}\n"
+        f"code_syn_ack_verified: {str(code_syn_ack_verified).lower()}\n"
+        f"code_get_sent: {str(code_get_sent).lower()}\n"
+        f"code_http_verified: {str(code_http_verified).lower()}\n"
                "recovery_selected_by_native: false\n"
                "login_magic: HLDP-GHOS-LOGIN!\n"
            )
        return
-    raise SystemExit("timed out waiting for native outbound ICMP exchange")
+    raise SystemExit(
+        "timed out waiting for native service equivalence: "
+        f"anchor_syn_sent={anchor_syn_sent}, "
+        f"anchor_syn_ack_verified={anchor_syn_ack_verified}, "
+        f"anchor_http_verified={anchor_http_verified}, "
+        f"code_syn_sent={code_syn_sent}, "
+        f"code_syn_ack_verified={code_syn_ack_verified}, "
+        f"code_http_verified={code_http_verified}"
+    )


 if __name__ == "__main__":
--- a/product-source/hololake-platform/guanghu-os/scripts/test-native-final-resident-candidate.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/test-native-final-resident-candidate.sh
@ -50,11 +50,11 @@ python3 "${source_root}/scripts/qemu-native-net-peer.py" \
  --qemu-port "${qemu_port}" \
  --receipt "${test_root}/peer.hldp" \
  --final-resident \
-  --anchor-http \
+  --service-equivalence \
  --recovery-token-file "${token_file}" >"${test_root}/peer.log" 2>&1 &
 peer_pid=$!
 set +e
-timeout 40 qemu-system-x86_64 \
+timeout "${GHOS_QEMU_TIMEOUT_SECONDS:-40}" qemu-system-x86_64 \
  -machine pc,accel=tcg \
  -m 64M \
  -drive "if=none,id=ghboot,format=raw,file=${test_root}/disk.img" \
@ -78,7 +78,10 @@ grep -q '^recovery_reply_verified: true$' "${test_root}/peer.hldp"
 grep -q '^recovery_selected_by_native: false$' "${test_root}/peer.hldp"
 grep -q '^anchor_syn_ack_verified: true$' "${test_root}/peer.hldp"
 grep -q '^anchor_http_verified: true$' "${test_root}/peer.hldp"
+grep -q '^code_syn_ack_verified: true$' "${test_root}/peer.hldp"
+grep -q '^code_http_verified: true$' "${test_root}/peer.hldp"
 grep -q '^GHOS_NATIVE_ANCHOR_HTTP=RESPONSE_TX' "${test_root}/serial.log"
+grep -q '^GHOS_NATIVE_CODE_CHANNEL_HTTP=RESPONSE_TX' "${test_root}/serial.log"
 grep -q '^GHOS_NATIVE_RECOVERY_BEACON=WRITE_READ_VERIFIED' "${test_root}/serial.log"
 grep -q '^GHOS_DISK_PROOF_OBSERVED_AFTER_RESET=LBA134' "${test_root}/serial.log"

@ -172,6 +175,13 @@ native_anchor_service:
  world_node_id: SYS-GLW-0001
  repository_id: REPO-012
  runtime: GUANGHU_OS_NATIVE
+native_code_channel_read_only:
+  http_get_v1_code_channel: PASS_100
+  response_schema: guanghu.native-code-channel-read-only/v1
+  repository_id: REPO-012
+  branch: main
+  commit: fb1096c5ecdcfb36015d51273f487c2f36d9c9cd
+  full_forgejo_equivalence: false
 recovery_control:
  selected_by_native_runtime: false
  per_deployment_capability_required: true
@ -183,7 +193,8 @@ boundary:
  physical_server_capability: 0
  native_anchor_http_qemu_capability: 100
  native_anchor_http_physical_capability: 0
-  code_channel_service_equivalence: 0
+  native_code_channel_read_only_qemu_capability: 100
+  public_code_channel_service_equivalence: 0
  final_native_residency_proven: false
-next_action: PHYSICAL_ONE_TIME_NATIVE_ANCHOR_HTTP_GATE_WITH_PROTECTED_RECOVERY
+next_action: IMPLEMENT_AUTHENTICATED_NATIVE_TO_BS_GZ_006_TRANSPORT_AND_SEPARATE_PUBLIC_ANCHOR_FROM_FULL_CODE_CHANNEL_ACCEPTANCE
 EOF
--- a/product-source/hololake-platform/guanghu-os/standards/jd-native-service-equivalence-contract.json
+++ b/product-source/hololake-platform/guanghu-os/standards/jd-native-service-equivalence-contract.json
@ -0,0 +1,45 @@
+{
+  "schema": "guanghu.jd-native-service-equivalence-contract/v1",
+  "node_id": "JD-FD-PRIMARY",
+  "candidate_source": "GUANGHU_OS_NATIVE",
+  "accepted_repository": {
+    "repository_id": "REPO-012",
+    "branch": "main",
+    "commit": "fb1096c5ecdcfb36015d51273f487c2f36d9c9cd"
+  },
+  "native_read_only_surface": [
+    {
+      "path": "/v1/anchor",
+      "schema": "guanghu.native-public-anchor/v1",
+      "required_anchor_id": "GLW-PUBLIC-NAV-ANCHOR-001"
+    },
+    {
+      "path": "/v1/code-channel",
+      "schema": "guanghu.native-code-channel-read-only/v1",
+      "mode": "READ_ONLY_DISCOVERY",
+      "full_forgejo_equivalence": false
+    }
+  ],
+  "current_public_contract": {
+    "anchor_path": "/api/ai/v1/anchor",
+    "code_path": "/code/",
+    "front_door_node": "BS-GZ-006",
+    "transport_while_linux_hosted": "REVERSE_SSH_TUNNEL",
+    "survives_native_residency": false
+  },
+  "acceptance_gates": {
+    "native_anchor_qemu": 100,
+    "native_code_channel_read_only_qemu": 100,
+    "native_physical_readback": 0,
+    "public_anchor_during_native_residency": 0,
+    "public_code_during_native_residency": 0,
+    "full_forgejo_equivalence": 0,
+    "production_native_cutover": 0
+  },
+  "prohibited_claims": [
+    "A_READ_ONLY_SNAPSHOT_IS_FULL_FORGEJO",
+    "QEMU_IS_PHYSICAL_SERVER_READBACK",
+    "LINUX_HOSTED_TUNNEL_SURVIVES_NATIVE_BOOT",
+    "SOURCE_IMPLEMENTATION_IS_PRODUCTION_CUTOVER"
+  ]
+}
--- a/routing/guanghu-os-control-architecture.json
+++ b/routing/guanghu-os-control-architecture.json
@ -1,7 +1,7 @@
 {
  "schema": "guanghu.os-control-architecture/v1",
  "record_id": "HLP-GUANGHU-OS-CONTROL-001",
-  "version": "2026-08-15.3",
+  "version": "2026-08-15.4",
  "state": "CURRENT_CANONICAL",
  "final_topology": "GUANGHU_MASTER_WITH_ON_DEMAND_LINUX_SUBCONTROL_AND_RESCUE",
  "control_ownership": {
@ -39,7 +39,7 @@
    "linux_on_demand_subcontrol": 0,
    "linux_rescue_preserved": 100,
    "final_guanghu_os_master": 0,
-    "next_engineering_gate": "IMPLEMENT_EQUIVALENT_SERVICE_CONTRACT_AND_INDEPENDENT_GUANGHU_SUPERVISOR_OWNERSHIP_BEFORE_ANY_BOOT_CUTOVER"
+    "next_engineering_gate": "IMPLEMENT_AUTHENTICATED_NATIVE_TO_BS_GZ_006_TRANSPORT_AND_PUBLIC_READBACK_BEFORE_ANY_BOOT_CUTOVER"
  },
  "implementation": {
    "guanghu_supervisor_lifecycle_contract_source": 100,
@ -50,6 +50,12 @@
    "linux_hosted_isolated_shadow_backend": 100,
    "real_isolated_linux_backend": 0,
    "jd_shadow_backend_physical_cycle": 100,
+    "native_service_equivalence_contract_source": 100,
+    "native_anchor_http_qemu_capability": 100,
+    "native_code_channel_read_only_qemu_capability": 100,
+    "public_native_anchor_equivalence": 0,
+    "public_native_code_channel_equivalence": 0,
+    "full_forgejo_equivalence": 0,
    "independent_guanghu_first_boot_supervisor": 0,
    "jd_physical_deployment": 0
  },
@ -66,6 +72,7 @@
    "historical_linux_free_completion_formula_is_current": false,
    "adr_0172_linux_hosted_control_is_transition_not_final_topology": true
  },
+  "native_service_equivalence_contract": "product-source/hololake-platform/guanghu-os/standards/jd-native-service-equivalence-contract.json",
  "architecture_page": "product-source/hololake-platform/architecture/HOLOLAKE-GUANGHU-OS-MASTER-AND-ON-DEMAND-LINUX-SUBCONTROL-20260810.md",
  "adr": "product-source/hololake-platform/docs/adr/0175-guanghu-os-master-and-on-demand-linux-subcontrol.md",
  "development_id": "DEV-20260810-012"
--- a/routing/guanghu-os-control-architecture.test.mjs
+++ b/routing/guanghu-os-control-architecture.test.mjs
@ -9,6 +9,9 @@ const readJson = (relative) => JSON.parse(fs.readFileSync(path.join(root, relati
 const contract = readJson("routing/guanghu-os-control-architecture.json");
 const architecture = readJson("routing/hololake-current-architecture.json");
 const rules = readJson("routing/hololake-engineering-rules.json");
+const serviceContract = readJson(
+  "product-source/hololake-platform/guanghu-os/standards/jd-native-service-equivalence-contract.json",
+);

 test("final topology makes Guanghu the master while preserving Linux as on-demand subcontrol and rescue", () => {
  assert.equal(contract.final_topology, "GUANGHU_MASTER_WITH_ON_DEMAND_LINUX_SUBCONTROL_AND_RESCUE");
@ -32,7 +35,7 @@ test("current JD state stays transitional and cannot impersonate final master co
 });

 test("the physical shadow cycle is registered without impersonating Guanghu-owned boot control", () => {
-  assert.equal(contract.version, "2026-08-15.3");
+  assert.equal(contract.version, "2026-08-15.4");
  assert.equal(contract.implementation.guanghu_supervisor_lifecycle_contract_source, 100);
  assert.equal(contract.implementation.target_readback_and_mandatory_reclaim_state_machine, 100);
  assert.equal(contract.implementation.declared_supervisor_core_line_and_function_coverage, 100);
@ -40,6 +43,12 @@ test("the physical shadow cycle is registered without impersonating Guanghu-owne
  assert.equal(contract.implementation.linux_hosted_isolated_shadow_backend, 100);
  assert.equal(contract.implementation.real_isolated_linux_backend, 0);
  assert.equal(contract.implementation.jd_shadow_backend_physical_cycle, 100);
+  assert.equal(contract.implementation.native_service_equivalence_contract_source, 100);
+  assert.equal(contract.implementation.native_anchor_http_qemu_capability, 100);
+  assert.equal(contract.implementation.native_code_channel_read_only_qemu_capability, 100);
+  assert.equal(contract.implementation.public_native_anchor_equivalence, 0);
+  assert.equal(contract.implementation.public_native_code_channel_equivalence, 0);
+  assert.equal(contract.implementation.full_forgejo_equivalence, 0);
  assert.equal(contract.implementation.independent_guanghu_first_boot_supervisor, 0);
  assert.equal(contract.implementation.jd_physical_deployment, 0);
  assert.equal(contract.current_target_evidence.final_state, "DORMANT");
@ -54,3 +63,19 @@ test("current architecture and global engineering rules project the same control
  assert.equal(rules.server_os_control.linux_hosted_language_primary_is_final_master, false);
  assert.equal(rules.server_os_control.live_readback_predicates_required, true);
 });
+
+test("native service surface is exact while every physical and public claim remains zero", () => {
+  assert.equal(serviceContract.node_id, "JD-FD-PRIMARY");
+  assert.deepEqual(
+    serviceContract.native_read_only_surface.map((endpoint) => endpoint.path),
+    ["/v1/anchor", "/v1/code-channel"],
+  );
+  assert.equal(serviceContract.accepted_repository.commit, "fb1096c5ecdcfb36015d51273f487c2f36d9c9cd");
+  assert.equal(serviceContract.acceptance_gates.native_anchor_qemu, 100);
+  assert.equal(serviceContract.acceptance_gates.native_code_channel_read_only_qemu, 100);
+  assert.equal(serviceContract.acceptance_gates.native_physical_readback, 0);
+  assert.equal(serviceContract.acceptance_gates.public_anchor_during_native_residency, 0);
+  assert.equal(serviceContract.acceptance_gates.public_code_during_native_residency, 0);
+  assert.equal(serviceContract.acceptance_gates.full_forgejo_equivalence, 0);
+  assert.equal(serviceContract.acceptance_gates.production_native_cutover, 0);
+});