feat(hololake): project resident PNCC state

product-source/hololake-native-desktop/scripts/pncc-stage-one.test.mjs

@@ -57,17 +57,41 @@ test('neither webview nor external AI can register an arbitrary PNCC source', ()
   assert.doesNotMatch(broker, /RegisterPncc(Repository|Remote)Mount/)
 })
 
+test('JD live projection stays private, minimum and read-only', () => {
+  const projection = contract.jd_server_projection
+  assert.equal(projection.mode, 'LIVE_READ_ONLY_MINIMUM_STATUS')
+  assert.equal(projection.transport, 'DEDICATED_SSH_TO_SERVER_LOOPBACK')
+  assert.equal(projection.public_endpoint_created, false)
+  assert.equal(projection.repository_path_returned, false)
+  assert.equal(projection.repository_content_returned, false)
+  assert.equal(projection.credentials_returned, false)
+  assert.equal(projection.write_authority, false)
+  assert.equal(projection.carrier_binding_must_remain, 'UNBOUND_EVIDENCE_REQUIRED')
+  assert.equal(projection.model_inference_must_remain, false)
+  assert.equal(projection.reality_execution_must_remain, false)
+  const source = readText('src-tauri/src/pncc_server_projection.rs')
+  assert.match(source, /127\.0\.0\.1:3923\/v1\/status/)
+  assert.match(source, /StrictHostKeyChecking=yes/)
+  assert.doesNotMatch(source, /repository_path:/)
+})
+
 test('foundation and Rust modules report the implemented PNCC boundary', () => {
   assert.equal(foundation.pncc_stage_one_contract, 'contracts/pncc-stage-one.json')
   assert.equal(foundation.pncc_repository_binding_implemented, true)
   assert.equal(foundation.pncc_remote_incremental_object_channel_implemented, true)
   assert.equal(foundation.pncc_receipt_projection_implemented, true)
+  assert.equal(foundation.pncc_jd_live_server_projection_implemented, true)
+  assert.equal(foundation.pncc_jd_live_server_projection_public_endpoint_created, false)
+  assert.equal(foundation.pncc_jd_live_server_projection_repository_content_exposed, false)
+  assert.equal(foundation.pncc_jd_live_server_projection_write_authority, false)
+  assert.equal(foundation.pncc_jd_live_server_projection_carrier_state, 'UNBOUND_EVIDENCE_REQUIRED')
   assert.equal(foundation.pncc_human_mount_registration_implemented, true)
   assert.equal(foundation.pncc_internal_model_inference_implemented, false)
   assert.equal(foundation.pncc_execution_limb_implemented, false)
   for (const relative of [
     'src-tauri/src/pncc_repository_binding.rs',
     'src-tauri/src/pncc_remote_git.rs',
+    'src-tauri/src/pncc_server_projection.rs',
   ]) assert.equal(fs.existsSync(path.join(root, relative)), true)
   const productionBindingSource = readText('src-tauri/src/pncc_repository_binding.rs').split('\n#[cfg(test)]\nmod tests')[0]
   assert.doesNotMatch(productionBindingSource, /modelProvider|model_id|api[_-]?key/i)