evidence: verify JD repository bridge lifecycle
This commit is contained in:
parent
c9eb7e8c08
commit
9d411a252a
6 changed files with 127 additions and 10 deletions
|
|
@ -51,11 +51,12 @@ Linux 被唤醒时会真实运行内核、驱动、进程、网络与文件系
|
|||
|
||||
## 京东服务器现在到底到哪里
|
||||
|
||||
当前状态是 `LANGUAGE_PRIMARY_ON_LINUX_HOSTED_TRANSITION`：
|
||||
当前状态是 `LINUX_HOSTED_MAINTENANCE_WITH_GUANGHU_SUPERVISOR_BRIDGE_AND_QEMU_VERIFIED_CROSS_ROOT_SUPERVISOR`：
|
||||
|
||||
| 能力 | 当前值 |
|
||||
|---|---:|
|
||||
| 有界光湖语言服务控制层 | 100 |
|
||||
| 京东真实 Forgejo 隔离副本的有界唤醒、读回与收回 | 100 |
|
||||
| 光湖独立先启动并掌握整机启动权 | 0 |
|
||||
| 完整 Linux 平时休眠、由光湖按需唤醒与收回 | 0 |
|
||||
| Linux 救援通道保留 | 100 |
|
||||
|
|
@ -65,6 +66,11 @@ Linux 被唤醒时会真实运行内核、驱动、进程、网络与文件系
|
|||
现有 Ubuntu、`guanghu-language-primary.target`、发现服务、守门服务、公共锚点和裸机候选
|
||||
都作为迁移资产保留，不删除、不抹除，但也不冒充最后一层。
|
||||
|
||||
`REQ-JD-REPO-003` 已进一步证明：根监督器能够只授予 `repository-main-readback`，唤醒
|
||||
真实 Forgejo 16.0.1 的隔离数据副本，核验固定 `main` 后把它收回到 `DORMANT`；公网仓库
|
||||
进程 760 未被停止或替换。它证明的是桥的控制方式，不是物理机已经从光湖启动。下一步把
|
||||
同一生命周期装入跨根启动候选，并先在 QEMU 做服务等价验收。
|
||||
|
||||
## 从迁移态到最终态
|
||||
|
||||
1. 当前轮先修正人格大脑、机器导航、架构仓和代码仓的旧完成条件；
|
||||
|
|
|
|||
|
|
@ -16,3 +16,8 @@ development_id: "DEV-20260815-001"
|
|||
|
||||
真实公网 Forgejo 与 PID 760 不参与隔离门。现实验证使用独立数据副本、独立回环端口和独立进程；
|
||||
只有最终状态重新休眠且公网仓库不受影响时，才能把这一个隔离谓词记为 100。
|
||||
|
||||
京东节点上的 `REQ-JD-REPO-003` 已完成这一个隔离谓词：真实 Forgejo 16.0.1 从
|
||||
`DORMANT` 被有界唤醒，读回隔离快照固定的 `main`，验证后回收到 `DORMANT`。失败的直连路径
|
||||
和诊断残留也分别证明了“失败即回收”和“非休眠即拒绝”。这仍不是物理光湖启动，也不把完整
|
||||
Linux 按需副控记为完成；下一门是把同一生命周期接入跨根光湖启动候选，并先在 QEMU 证明服务等价。
|
||||
|
|
|
|||
|
|
@ -134,7 +134,12 @@ state and one allowlisted repository readback request. It wakes a registered
|
|||
backend, verifies the pinned `main`, and reclaims the backend on both success
|
||||
and failure. `scripts/forgejo-repository-shadow-backend.sh` provides a separate
|
||||
loopback-only Forgejo data plane for physical-node isolation tests; it never
|
||||
targets the public repository process. See ADR-0178.
|
||||
targets the public repository process. JD request `REQ-JD-REPO-003` now proves
|
||||
the real Forgejo shadow lifecycle from `DORMANT` through verified readback and
|
||||
back to `DORMANT`, including fail-closed cleanup. This raises only the isolated
|
||||
repository lifecycle predicate to `100`; physical Guanghu boot, full Linux
|
||||
on-demand subcontrol, and final master control remain `0`. See ADR-0178 and
|
||||
`deployments/JD-FD-PRIMARY/REPOSITORY-BRIDGE-LIFECYCLE-RECEIPT-20260816.hldp`.
|
||||
|
||||
## Language-primary boot target
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,64 @@
|
|||
schema: guanghu.server-deployment-receipt/v1
|
||||
receipt_id: JD-FD-PRIMARY-repository-lifecycle-0d1ded1
|
||||
observed_at: 2026-08-16T00:22:30+08:00
|
||||
target:
|
||||
node_id: JD-FD-PRIMARY
|
||||
dmi_product_uuid: f3d4b730-7f02-452f-975b-7091a4800431
|
||||
physical_boot_id: 68d4a3c9-c866-4f4a-be2e-0aa5f41a61b1
|
||||
source:
|
||||
commit: c9eb7e8c08bfe4120fe3c788523477d7f641ace6
|
||||
tree: d25f6e620a69ea9c5546698df9f167f2b038ff66
|
||||
isolated_snapshot_main: 0d1ded1196d38a002d9a31f6fd23122bdc96ae93
|
||||
public_main_after: c9eb7e8c08bfe4120fe3c788523477d7f641ace6
|
||||
trigger: Cross-root Guanghu supervisor persistence was proved, but its bounded control of a real repository bridge was still zero.
|
||||
emergence: A live root-supervisor fixture controlled an actual Forgejo 16.0.1 process backed by a consistent isolated copy of JD repository data on loopback port 39301.
|
||||
lock: Request REQ-JD-REPO-003 may perform only repository-main-readback; success requires DORMANT -> READY -> verified pinned main -> DORMANT.
|
||||
why: Linux remains the repository-bearing subordinate and rescue system. Guanghu becomes its master only by granting a narrow capability, observing the result, and reclaiming the subordinate on both success and failure.
|
||||
rejected:
|
||||
- Stopping, restarting, or sharing storage with the public Forgejo service.
|
||||
- Treating Linux execution or a continuously running Linux service as Guanghu authority.
|
||||
- Accepting arbitrary shell execution through the bridge.
|
||||
- Treating an isolated proof as physical Guanghu boot or completed Linux on-demand subcontrol.
|
||||
corrections:
|
||||
- The first real attempt used the public reverse-proxy prefix /code against direct Forgejo and failed readiness; direct Forgejo correctly uses /api/v1/version and /bingshuo/hololake-system-architecture.git.
|
||||
- A manual diagnostic probe temporarily left its own shadow child resident; the lifecycle controller refused to start from non-DORMANT state, and the exact isolated child was reclaimed before the accepted run.
|
||||
- A later local probe incorrectly tested port 39300; the public bootstrap is on 3341 and Forgejo is on 3340. This probe did not change either service and is not used as acceptance evidence.
|
||||
accepted_run:
|
||||
request_id: REQ-JD-REPO-003
|
||||
capability: repository-main-readback
|
||||
result: PASS_100
|
||||
initial_state: DORMANT
|
||||
active_state: READY
|
||||
observed_main: 0d1ded1196d38a002d9a31f6fd23122bdc96ae93
|
||||
final_state: DORMANT
|
||||
lifecycle_receipt: /var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/recovery/JD-FD-PRIMARY-repository-lifecycle-0d1ded1/receipts/REQ-JD-REPO-003.json
|
||||
lifecycle_receipt_sha256: 6aee31f6f0ab36fa6ddd090fc7044b43e62abf457dcf69484a51eecd262b8d87
|
||||
isolation_readback:
|
||||
isolated_forgejo_version: 16.0.1
|
||||
isolated_loopback_port: 39301
|
||||
isolated_listener_after: ABSENT
|
||||
isolated_forgejo_process_after: ABSENT
|
||||
root_supervisor_fixture_pid: 3604097
|
||||
root_supervisor_fixture_after: STOPPED
|
||||
public_readback:
|
||||
repository_service: active
|
||||
repository_bootstrap_pid_before_and_after: 760
|
||||
forgejo_loopback_port: 3340
|
||||
bootstrap_loopback_port: 3341
|
||||
public_code_http: 200
|
||||
public_repository_http: 200
|
||||
public_main: c9eb7e8c08bfe4120fe3c788523477d7f641ace6
|
||||
physical_reboot_performed: false
|
||||
physical_boot_files_changed: false
|
||||
predicates:
|
||||
bounded_root_supervisor_to_repository_bridge_lifecycle: 100
|
||||
jd_real_forgejo_repository_shadow_lifecycle: 100
|
||||
physical_guanghu_first_boot: 0
|
||||
linux_on_demand_subcontrol: 0
|
||||
final_guanghu_os_master: 0
|
||||
next_gate: Integrate the same bounded repository lifecycle into the cross-root Guanghu boot candidate and prove service equivalence in QEMU before any physical boot change.
|
||||
sources:
|
||||
- /var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/recovery/JD-FD-PRIMARY-repository-lifecycle-0d1ded1/WORKORDER.hldp
|
||||
- /var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/recovery/JD-FD-PRIMARY-repository-lifecycle-0d1ded1/root-supervisor.log
|
||||
- /var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/recovery/JD-FD-PRIMARY-repository-lifecycle-0d1ded1/lifecycle-pass.stdout
|
||||
- product-source/hololake-platform/docs/adr/0178-guanghu-bounded-repository-bridge-lifecycle.md
|
||||
Loading…
Reference in a new issue