fix: support JD host native QEMU validation

product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-READ-ONLY-SERVICE-SURFACE-JD-HOST-QEMU-RECEIPT-20260815.hldp

@@ -0,0 +1,47 @@
+schema: guanghu.jd-physical-host-native-service-qemu-receipt/v1
+receipt_id: GH-OS-JD-FD-PRIMARY-NATIVE-SERVICE-QEMU-20260815-001
+status: PASS_100
+observed_at: 2026-08-15T19:24:56+08:00
+node:
+  node_id: JD-FD-PRIMARY
+  instance_id: f3d4b730-7f02-452f-975b-7091a4800431
+  boot_id_before: 68d4a3c9-c866-4f4a-be2e-0aa5f41a61b1
+  boot_id_after: 68d4a3c9-c866-4f4a-be2e-0aa5f41a61b1
+  hosted_kernel: Linux 5.15.0-60-generic x86_64
+  default_target_before: guanghu-language-primary.target
+  default_target_after: guanghu-language-primary.target
+source:
+  candidate_source_commit: 856a6c9ffbb12718b04ea597526dc4ad309fe5fe
+  candidate_source_tree: 01ff7fe330b95aaf27856cb731ef390ad0153565
+  candidate_sha256: 9807fa751616d4b421c103d60eecface1c5eb8013cbd89417ef9e027da281fb3
+  qemu_peer_sha256: 15d38a14e512b93482ec4472c78a7adfbf9d55ac61d7492fc8254f3e6600baca
+  qemu_test_driver_sha256: cdf26a5b39923d3f4d866481c9a07514fe25ddd929874b1a29c071f18c91a123
+toolchain:
+  qemu_system_x86_64: 6.2.0
+  nasm: 2.15.05
+  installed_from: UBUNTU_22_04_JDCLOUD_MIRROR
+validation:
+  accelerator: TCG_ISOLATED
+  network_backend: socket
+  native_anchor_http: PASS_100
+  native_code_channel_read_only_http: PASS_100
+  wrong_recovery_capability_ignored: PASS_100
+  recovery_beacon_write_read_in_test_disk: PASS_100
+  fixture_candidate_removed_after_receipt: true
+unchanged:
+  physical_disk_boot_region_written: false
+  grub_modified: false
+  default_boot_modified: false
+  rebooted: false
+  public_front_door_modified: false
+boundary:
+  jd_physical_host_isolated_qemu_capability: 100
+  native_physical_residency: 0
+  public_native_anchor: 0
+  public_native_code_channel: 0
+  full_forgejo_equivalence: 0
+  independent_first_boot_supervisor: 0
+  final_guanghu_os_master: 0
+server_owned_receipt: /guanghu/recovery/JD-FD-PRIMARY-native-qemu-856a6c9/RECEIPT.hldp
+server_owned_receipt_sha256: 363eb5f10da6a1eddd0fe212165a34a9ce213b93b922feaa26fe99c7892f2380
+next_action: IMPLEMENT_AUTHENTICATED_NATIVE_TO_BS_GZ_006_TRANSPORT_WITHOUT_DEPLOYING_FIXTURE_RECOVERY_CAPABILITY

product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py

@@ -183,10 +183,13 @@ def main() -> None:
     parser.add_argument("--login-only", action="store_true")
     parser.add_argument("--anchor-http", action="store_true")
     parser.add_argument("--service-equivalence", action="store_true")
+    parser.add_argument("--timeout-seconds", type=float)
     parser.add_argument("--guest-ip", default="172.16.0.6")
     parser.add_argument("--peer-ip", default="172.16.0.1")
     parser.add_argument("--relay-ip", default="43.153.193.169")
     args = parser.parse_args()
+    if args.timeout_seconds is not None and args.timeout_seconds <= 0:
+        raise SystemExit("--timeout-seconds must be greater than zero")
     if sum((args.resident, args.final_resident, args.login_only)) > 1:
         raise SystemExit("--resident, --final-resident and --login-only are mutually exclusive")
     if args.final_resident and not args.recovery_token_file:
@@ -202,10 +205,15 @@ def main() -> None:
     RELAY_IP = socket.inet_aton(args.relay_ip)
 
     peer = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    peer.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 4 * 1024 * 1024)
     peer.bind(("127.0.0.1", args.listen_port))
     peer.settimeout(0.2)
     qemu = ("127.0.0.1", args.qemu_port)
-    deadline = time.monotonic() + (30 if args.service_equivalence else 15)
+    deadline = time.monotonic() + (
+        args.timeout_seconds
+        if args.timeout_seconds is not None
+        else (30 if args.service_equivalence else 15)
+    )
     arp_verified = False
     login_count = 0
     resident_login_count = 0
@@ -323,6 +331,11 @@ def main() -> None:
                 )
                 code_syn_sent = True
             continue
+        if args.service_equivalence and anchor_syn_sent and not code_http_verified:
+            # The final-resident fixture keeps emitting ordinary ICMP heartbeats while
+            # the two HTTP probes run. Older QEMU socket backends can otherwise let
+            # that traffic starve the second TCP response in the UDP receive queue.
+            continue
         sequence = int.from_bytes(frame[40:42], "big")
         if sequence <= 3:
             magic = LOGIN_MAGIC
@@ -346,7 +359,8 @@ def main() -> None:
             raise AssertionError(f"unexpected native sequence {sequence}")
         verified_request(frame, sequence, magic)
         peer.sendto(ordinary_reply(frame), qemu)
-        time.sleep(0.005 if args.service_equivalence else 0.05)
+        if not args.service_equivalence:
+            time.sleep(0.05)
         response_capability = NATIVE_ACK_MAGIC
         if (
             args.final_resident
@@ -359,8 +373,8 @@ def main() -> None:
         reply = authenticated_reply(frame, response_capability)
         for repetition in range(4):
             peer.sendto(reply, qemu)
-            if repetition < 3:
-                time.sleep(0.001 if args.service_equivalence else 0.01)
+            if repetition < 3 and not args.service_equivalence:
+                time.sleep(0.01)
         if (
             (args.anchor_http or args.service_equivalence)
             and args.final_resident

product-source/hololake-platform/guanghu-os/scripts/test-native-final-resident-candidate.sh

@@ -13,6 +13,18 @@ source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 native_root=${source_root}/native/x86_64-bios
 test_root=$(mktemp -d)
 peer_pid=
+qemu_netdev_backend() {
+  local id=$1
+  local local_port=$2
+  local remote_port=$3
+  if qemu-system-x86_64 -netdev help 2>&1 | grep -qx 'dgram'; then
+    printf 'dgram,id=%s,local.type=inet,local.host=127.0.0.1,local.port=%s,remote.type=inet,remote.host=127.0.0.1,remote.port=%s' \
+      "${id}" "${local_port}" "${remote_port}"
+  else
+    printf 'socket,id=%s,udp=127.0.0.1:%s,localaddr=127.0.0.1:%s' \
+      "${id}" "${remote_port}" "${local_port}"
+  fi
+}
 cleanup() {
   if [[ -n ${peer_pid} ]]; then
     kill "${peer_pid}" 2>/dev/null || true
@@ -45,12 +57,14 @@ dd if="${candidate}" of="${test_root}/disk.img" \
 
 peer_port=$((33000 + ${BASHPID:-$$} % 1000))
 qemu_port=$((peer_port + 1))
+qemu_netdev=$(qemu_netdev_backend ghnet "${qemu_port}" "${peer_port}")
 python3 "${source_root}/scripts/qemu-native-net-peer.py" \
   --listen-port "${peer_port}" \
   --qemu-port "${qemu_port}" \
   --receipt "${test_root}/peer.hldp" \
   --final-resident \
   --service-equivalence \
+  --timeout-seconds "${GHOS_PEER_TIMEOUT_SECONDS:-30}" \
   --recovery-token-file "${token_file}" >"${test_root}/peer.log" 2>&1 &
 peer_pid=$!
 set +e
@@ -59,7 +73,7 @@ timeout "${GHOS_QEMU_TIMEOUT_SECONDS:-40}" qemu-system-x86_64 \
   -m 64M \
   -drive "if=none,id=ghboot,format=raw,file=${test_root}/disk.img" \
   -device virtio-blk-pci,drive=ghboot,disable-modern=on,bootindex=0 \
-  -netdev "dgram,id=ghnet,local.type=inet,local.host=127.0.0.1,local.port=${qemu_port},remote.type=inet,remote.host=127.0.0.1,remote.port=${peer_port}" \
+  -netdev "${qemu_netdev}" \
   -device virtio-net-pci,netdev=ghnet,disable-modern=on,mac=52:54:00:26:71:98 \
   -display none \
   -monitor none \
@@ -111,6 +125,7 @@ dd if="${candidate}" of="${test_root}/wrong-capability-disk.img" \
   bs=512 seek=105 conv=notrunc status=none
 wrong_peer_port=$((peer_port + 2))
 wrong_qemu_port=$((qemu_port + 2))
+wrong_qemu_netdev=$(qemu_netdev_backend ghnet "${wrong_qemu_port}" "${wrong_peer_port}")
 python3 "${source_root}/scripts/qemu-native-net-peer.py" \
   --listen-port "${wrong_peer_port}" \
   --qemu-port "${wrong_qemu_port}" \
@@ -125,7 +140,7 @@ timeout 5 qemu-system-x86_64 \
   -m 64M \
   -drive "if=none,id=ghboot,format=raw,file=${test_root}/wrong-capability-disk.img" \
   -device virtio-blk-pci,drive=ghboot,disable-modern=on,bootindex=0 \
-  -netdev "dgram,id=ghnet,local.type=inet,local.host=127.0.0.1,local.port=${wrong_qemu_port},remote.type=inet,remote.host=127.0.0.1,remote.port=${wrong_peer_port}" \
+  -netdev "${wrong_qemu_netdev}" \
   -device virtio-net-pci,netdev=ghnet,disable-modern=on,mac=52:54:00:26:71:98 \
   -display none \
   -monitor none \
@@ -161,6 +176,7 @@ candidate:
   lba_start: 105
   sector_count: 29
   sha256: ${image_sha}
+qemu_network_backend: ${qemu_netdev%%,*}
 resident_runtime:
   initial_login_replies: 3
   code_commit_reply_verified: true

routing/guanghu-os-control-architecture.json

@@ -1,7 +1,7 @@
 {
   "schema": "guanghu.os-control-architecture/v1",
   "record_id": "HLP-GUANGHU-OS-CONTROL-001",
-  "version": "2026-08-15.4",
+  "version": "2026-08-15.5",
   "state": "CURRENT_CANONICAL",
   "final_topology": "GUANGHU_MASTER_WITH_ON_DEMAND_LINUX_SUBCONTROL_AND_RESCUE",
   "control_ownership": {
@@ -53,6 +53,7 @@
     "native_service_equivalence_contract_source": 100,
     "native_anchor_http_qemu_capability": 100,
     "native_code_channel_read_only_qemu_capability": 100,
+    "jd_physical_host_isolated_qemu_capability": 100,
     "public_native_anchor_equivalence": 0,
     "public_native_code_channel_equivalence": 0,
     "full_forgejo_equivalence": 0,
@@ -67,6 +68,16 @@
     "final_state": "DORMANT",
     "observed_at": "2026-08-15T18:08:11+08:00"
   },
+  "native_service_qemu_evidence": {
+    "server_receipt": "/guanghu/recovery/JD-FD-PRIMARY-native-qemu-856a6c9/RECEIPT.hldp",
+    "server_receipt_sha256": "363eb5f10da6a1eddd0fe212165a34a9ce213b93b922feaa26fe99c7892f2380",
+    "candidate_source_commit": "856a6c9ffbb12718b04ea597526dc4ad309fe5fe",
+    "candidate_sha256": "9807fa751616d4b421c103d60eecface1c5eb8013cbd89417ef9e027da281fb3",
+    "network_backend": "socket",
+    "observed_at": "2026-08-15T19:24:56+08:00",
+    "native_physical_residency": 0,
+    "public_native_service_equivalence": 0
+  },
   "historical_evidence_policy": {
     "bare_metal_gosk_ghal_receipts_remain_valid_for_observed_capabilities": true,
     "historical_linux_free_completion_formula_is_current": false,

routing/guanghu-os-control-architecture.test.mjs

@@ -34,8 +34,8 @@ test("current JD state stays transitional and cannot impersonate final master co
   assert.equal(contract.jd_fd_primary.final_guanghu_os_master, 0);
 });
 
-test("the physical shadow cycle is registered without impersonating Guanghu-owned boot control", () => {
-  assert.equal(contract.version, "2026-08-15.4");
+test("the physical shadow and host QEMU cycles are registered without impersonating Guanghu-owned boot control", () => {
+  assert.equal(contract.version, "2026-08-15.5");
   assert.equal(contract.implementation.guanghu_supervisor_lifecycle_contract_source, 100);
   assert.equal(contract.implementation.target_readback_and_mandatory_reclaim_state_machine, 100);
   assert.equal(contract.implementation.declared_supervisor_core_line_and_function_coverage, 100);
@@ -46,6 +46,7 @@ test("the physical shadow cycle is registered without impersonating Guanghu-owne
   assert.equal(contract.implementation.native_service_equivalence_contract_source, 100);
   assert.equal(contract.implementation.native_anchor_http_qemu_capability, 100);
   assert.equal(contract.implementation.native_code_channel_read_only_qemu_capability, 100);
+  assert.equal(contract.implementation.jd_physical_host_isolated_qemu_capability, 100);
   assert.equal(contract.implementation.public_native_anchor_equivalence, 0);
   assert.equal(contract.implementation.public_native_code_channel_equivalence, 0);
   assert.equal(contract.implementation.full_forgejo_equivalence, 0);
@@ -53,6 +54,9 @@ test("the physical shadow cycle is registered without impersonating Guanghu-owne
   assert.equal(contract.implementation.jd_physical_deployment, 0);
   assert.equal(contract.current_target_evidence.final_state, "DORMANT");
   assert.match(contract.current_target_evidence.server_receipt_sha256, /^[0-9a-f]{64}$/);
+  assert.equal(contract.native_service_qemu_evidence.native_physical_residency, 0);
+  assert.equal(contract.native_service_qemu_evidence.public_native_service_equivalence, 0);
+  assert.match(contract.native_service_qemu_evidence.server_receipt_sha256, /^[0-9a-f]{64}$/);
 });
 
 test("current architecture and global engineering rules project the same control contract", () => {