evidence: verify JD repository bridge lifecycle

product-source/hololake-platform/architecture/HOLOLAKE-GUANGHU-OS-MASTER-AND-ON-DEMAND-LINUX-SUBCONTROL-20260810.md

@@ -51,11 +51,12 @@ Linux 被唤醒时会真实运行内核、驱动、进程、网络与文件系
 
 ## 京东服务器现在到底到哪里
 
-当前状态是 `LANGUAGE_PRIMARY_ON_LINUX_HOSTED_TRANSITION`：
+当前状态是 `LINUX_HOSTED_MAINTENANCE_WITH_GUANGHU_SUPERVISOR_BRIDGE_AND_QEMU_VERIFIED_CROSS_ROOT_SUPERVISOR`：
 
 | 能力 | 当前值 |
 |---|---:|
 | 有界光湖语言服务控制层 | 100 |
+| 京东真实 Forgejo 隔离副本的有界唤醒、读回与收回 | 100 |
 | 光湖独立先启动并掌握整机启动权 | 0 |
 | 完整 Linux 平时休眠、由光湖按需唤醒与收回 | 0 |
 | Linux 救援通道保留 | 100 |
@@ -65,6 +66,11 @@ Linux 被唤醒时会真实运行内核、驱动、进程、网络与文件系
 现有 Ubuntu、`guanghu-language-primary.target`、发现服务、守门服务、公共锚点和裸机候选
 都作为迁移资产保留，不删除、不抹除，但也不冒充最后一层。
 
+`REQ-JD-REPO-003` 已进一步证明：根监督器能够只授予 `repository-main-readback`，唤醒
+真实 Forgejo 16.0.1 的隔离数据副本，核验固定 `main` 后把它收回到 `DORMANT`；公网仓库
+进程 760 未被停止或替换。它证明的是桥的控制方式，不是物理机已经从光湖启动。下一步把
+同一生命周期装入跨根启动候选，并先在 QEMU 做服务等价验收。
+
 ## 从迁移态到最终态
 
 1. 当前轮先修正人格大脑、机器导航、架构仓和代码仓的旧完成条件；

product-source/hololake-platform/docs/adr/0178-guanghu-bounded-repository-bridge-lifecycle.md

@@ -16,3 +16,8 @@ development_id: "DEV-20260815-001"
 
 真实公网 Forgejo 与 PID 760 不参与隔离门。现实验证使用独立数据副本、独立回环端口和独立进程；
 只有最终状态重新休眠且公网仓库不受影响时，才能把这一个隔离谓词记为 100。
+
+京东节点上的 `REQ-JD-REPO-003` 已完成这一个隔离谓词：真实 Forgejo 16.0.1 从
+`DORMANT` 被有界唤醒，读回隔离快照固定的 `main`，验证后回收到 `DORMANT`。失败的直连路径
+和诊断残留也分别证明了“失败即回收”和“非休眠即拒绝”。这仍不是物理光湖启动，也不把完整
+Linux 按需副控记为完成；下一门是把同一生命周期接入跨根光湖启动候选，并先在 QEMU 证明服务等价。

product-source/hololake-platform/guanghu-os/README.md

@@ -134,7 +134,12 @@ state and one allowlisted repository readback request. It wakes a registered
 backend, verifies the pinned `main`, and reclaims the backend on both success
 and failure. `scripts/forgejo-repository-shadow-backend.sh` provides a separate
 loopback-only Forgejo data plane for physical-node isolation tests; it never
-targets the public repository process. See ADR-0178.
+targets the public repository process. JD request `REQ-JD-REPO-003` now proves
+the real Forgejo shadow lifecycle from `DORMANT` through verified readback and
+back to `DORMANT`, including fail-closed cleanup. This raises only the isolated
+repository lifecycle predicate to `100`; physical Guanghu boot, full Linux
+on-demand subcontrol, and final master control remain `0`. See ADR-0178 and
+`deployments/JD-FD-PRIMARY/REPOSITORY-BRIDGE-LIFECYCLE-RECEIPT-20260816.hldp`.
 
 ## Language-primary boot target
 

product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/REPOSITORY-BRIDGE-LIFECYCLE-RECEIPT-20260816.hldp

@@ -0,0 +1,64 @@
+schema: guanghu.server-deployment-receipt/v1
+receipt_id: JD-FD-PRIMARY-repository-lifecycle-0d1ded1
+observed_at: 2026-08-16T00:22:30+08:00
+target:
+  node_id: JD-FD-PRIMARY
+  dmi_product_uuid: f3d4b730-7f02-452f-975b-7091a4800431
+  physical_boot_id: 68d4a3c9-c866-4f4a-be2e-0aa5f41a61b1
+source:
+  commit: c9eb7e8c08bfe4120fe3c788523477d7f641ace6
+  tree: d25f6e620a69ea9c5546698df9f167f2b038ff66
+  isolated_snapshot_main: 0d1ded1196d38a002d9a31f6fd23122bdc96ae93
+  public_main_after: c9eb7e8c08bfe4120fe3c788523477d7f641ace6
+trigger: Cross-root Guanghu supervisor persistence was proved, but its bounded control of a real repository bridge was still zero.
+emergence: A live root-supervisor fixture controlled an actual Forgejo 16.0.1 process backed by a consistent isolated copy of JD repository data on loopback port 39301.
+lock: Request REQ-JD-REPO-003 may perform only repository-main-readback; success requires DORMANT -> READY -> verified pinned main -> DORMANT.
+why: Linux remains the repository-bearing subordinate and rescue system. Guanghu becomes its master only by granting a narrow capability, observing the result, and reclaiming the subordinate on both success and failure.
+rejected:
+  - Stopping, restarting, or sharing storage with the public Forgejo service.
+  - Treating Linux execution or a continuously running Linux service as Guanghu authority.
+  - Accepting arbitrary shell execution through the bridge.
+  - Treating an isolated proof as physical Guanghu boot or completed Linux on-demand subcontrol.
+corrections:
+  - The first real attempt used the public reverse-proxy prefix /code against direct Forgejo and failed readiness; direct Forgejo correctly uses /api/v1/version and /bingshuo/hololake-system-architecture.git.
+  - A manual diagnostic probe temporarily left its own shadow child resident; the lifecycle controller refused to start from non-DORMANT state, and the exact isolated child was reclaimed before the accepted run.
+  - A later local probe incorrectly tested port 39300; the public bootstrap is on 3341 and Forgejo is on 3340. This probe did not change either service and is not used as acceptance evidence.
+accepted_run:
+  request_id: REQ-JD-REPO-003
+  capability: repository-main-readback
+  result: PASS_100
+  initial_state: DORMANT
+  active_state: READY
+  observed_main: 0d1ded1196d38a002d9a31f6fd23122bdc96ae93
+  final_state: DORMANT
+  lifecycle_receipt: /var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/recovery/JD-FD-PRIMARY-repository-lifecycle-0d1ded1/receipts/REQ-JD-REPO-003.json
+  lifecycle_receipt_sha256: 6aee31f6f0ab36fa6ddd090fc7044b43e62abf457dcf69484a51eecd262b8d87
+isolation_readback:
+  isolated_forgejo_version: 16.0.1
+  isolated_loopback_port: 39301
+  isolated_listener_after: ABSENT
+  isolated_forgejo_process_after: ABSENT
+  root_supervisor_fixture_pid: 3604097
+  root_supervisor_fixture_after: STOPPED
+public_readback:
+  repository_service: active
+  repository_bootstrap_pid_before_and_after: 760
+  forgejo_loopback_port: 3340
+  bootstrap_loopback_port: 3341
+  public_code_http: 200
+  public_repository_http: 200
+  public_main: c9eb7e8c08bfe4120fe3c788523477d7f641ace6
+  physical_reboot_performed: false
+  physical_boot_files_changed: false
+predicates:
+  bounded_root_supervisor_to_repository_bridge_lifecycle: 100
+  jd_real_forgejo_repository_shadow_lifecycle: 100
+  physical_guanghu_first_boot: 0
+  linux_on_demand_subcontrol: 0
+  final_guanghu_os_master: 0
+next_gate: Integrate the same bounded repository lifecycle into the cross-root Guanghu boot candidate and prove service equivalence in QEMU before any physical boot change.
+sources:
+  - /var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/recovery/JD-FD-PRIMARY-repository-lifecycle-0d1ded1/WORKORDER.hldp
+  - /var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/recovery/JD-FD-PRIMARY-repository-lifecycle-0d1ded1/root-supervisor.log
+  - /var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/recovery/JD-FD-PRIMARY-repository-lifecycle-0d1ded1/lifecycle-pass.stdout
+  - product-source/hololake-platform/docs/adr/0178-guanghu-bounded-repository-bridge-lifecycle.md

routing/guanghu-os-control-architecture.json

@@ -1,7 +1,7 @@
 {
   "schema": "guanghu.os-control-architecture/v1",
   "record_id": "HLP-GUANGHU-OS-CONTROL-001",
-  "version": "2026-08-16.1",
+  "version": "2026-08-16.2",
   "state": "CURRENT_CANONICAL",
   "final_topology": "GUANGHU_MASTER_WITH_ON_DEMAND_LINUX_SUBCONTROL_AND_RESCUE",
   "control_ownership": {
@@ -33,13 +33,13 @@
     "linux_hosted_service_control_is_final_master": false
   },
   "jd_fd_primary": {
-    "observed_state": "LANGUAGE_PRIMARY_WITH_QEMU_VERIFIED_PRE_ROOT_GUANGHU_SUPERVISOR",
+    "observed_state": "LINUX_HOSTED_MAINTENANCE_WITH_GUANGHU_SUPERVISOR_BRIDGE_AND_QEMU_VERIFIED_CROSS_ROOT_SUPERVISOR",
     "guanghu_semantic_service_control": 100,
     "guanghu_final_boot_control": 0,
     "linux_on_demand_subcontrol": 0,
     "linux_rescue_preserved": 100,
     "final_guanghu_os_master": 0,
-    "next_engineering_gate": "BUILD_AND_VERIFY_REAL_FORGEJO_REPOSITORY_SHADOW_LIFECYCLE_ON_JD_WITHOUT_TOUCHING_PUBLIC_REPOSITORY"
+    "next_engineering_gate": "INTEGRATE_BOUNDED_REPOSITORY_BRIDGE_INTO_CROSS_ROOT_GUANGHU_BOOT_CANDIDATE_AND_VERIFY_SERVICE_EQUIVALENCE_IN_QEMU"
   },
   "implementation": {
     "guanghu_supervisor_lifecycle_contract_source": 100,
@@ -81,7 +81,7 @@
     "repository_bridge_lifecycle_controller_source": 100,
     "forgejo_repository_shadow_backend_source": 100,
     "repository_bridge_failure_reclaim_contract_test": 100,
-    "jd_real_forgejo_repository_shadow_lifecycle": 0,
+    "jd_real_forgejo_repository_shadow_lifecycle": 100,
     "independent_guanghu_first_boot_supervisor": 0,
     "jd_physical_deployment": 0
   },
@@ -131,6 +131,30 @@
     "final_guanghu_os_master": 0,
     "observed_at": "2026-08-15T23:55:00+08:00"
   },
+  "repository_bridge_lifecycle_evidence": {
+    "source_commit": "c9eb7e8c08bfe4120fe3c788523477d7f641ace6",
+    "source_tree": "d25f6e620a69ea9c5546698df9f167f2b038ff66",
+    "repository_receipt": "product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/REPOSITORY-BRIDGE-LIFECYCLE-RECEIPT-20260816.hldp",
+    "server_receipt": "/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/recovery/JD-FD-PRIMARY-repository-lifecycle-0d1ded1/DEPLOYMENT-RECEIPT.hldp",
+    "server_receipt_sha256": "bc9cf420125e0633532a7d1fbbe5134141e74defddcca05b5a8f2730ef00d7cc",
+    "lifecycle_receipt": "/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/recovery/JD-FD-PRIMARY-repository-lifecycle-0d1ded1/receipts/REQ-JD-REPO-003.json",
+    "lifecycle_receipt_sha256": "6aee31f6f0ab36fa6ddd090fc7044b43e62abf457dcf69484a51eecd262b8d87",
+    "request_id": "REQ-JD-REPO-003",
+    "isolated_snapshot_main": "0d1ded1196d38a002d9a31f6fd23122bdc96ae93",
+    "public_main_after": "c9eb7e8c08bfe4120fe3c788523477d7f641ace6",
+    "initial_state": "DORMANT",
+    "active_state": "READY",
+    "final_state": "DORMANT",
+    "public_repository_process_preserved": 100,
+    "public_repository_bootstrap_pid": 760,
+    "public_code_http": 200,
+    "public_repository_http": 200,
+    "physical_boot_files_changed": false,
+    "physical_reboot_performed": false,
+    "linux_on_demand_subcontrol": 0,
+    "final_guanghu_os_master": 0,
+    "observed_at": "2026-08-16T00:22:30+08:00"
+  },
   "current_target_evidence": {
     "server_receipt": "/guanghu/recovery/JD-FD-PRIMARY-linux-subcontrol-f5217fe/DEPLOYMENT-RECEIPT.hldp",
     "server_receipt_sha256": "4a7d0cb354ff0472dbd8e2e43d89021d65b21f0beea3c702dcbeacdd1c73bfbc",

routing/guanghu-os-control-architecture.test.mjs

@@ -34,7 +34,7 @@ test("final topology makes Guanghu the master while preserving Linux as on-deman
 test("current JD state stays transitional and cannot impersonate final master control", () => {
   assert.equal(
     contract.jd_fd_primary.observed_state,
-    "LANGUAGE_PRIMARY_WITH_QEMU_VERIFIED_PRE_ROOT_GUANGHU_SUPERVISOR",
+    "LINUX_HOSTED_MAINTENANCE_WITH_GUANGHU_SUPERVISOR_BRIDGE_AND_QEMU_VERIFIED_CROSS_ROOT_SUPERVISOR",
   );
   assert.equal(contract.jd_fd_primary.guanghu_semantic_service_control, 100);
   assert.equal(contract.jd_fd_primary.guanghu_final_boot_control, 0);
@@ -43,12 +43,12 @@ test("current JD state stays transitional and cannot impersonate final master co
   assert.equal(contract.jd_fd_primary.final_guanghu_os_master, 0);
   assert.equal(
     contract.jd_fd_primary.next_engineering_gate,
-    "BUILD_AND_VERIFY_REAL_FORGEJO_REPOSITORY_SHADOW_LIFECYCLE_ON_JD_WITHOUT_TOUCHING_PUBLIC_REPOSITORY",
+    "INTEGRATE_BOUNDED_REPOSITORY_BRIDGE_INTO_CROSS_ROOT_GUANGHU_BOOT_CANDIDATE_AND_VERIFY_SERVICE_EQUIVALENCE_IN_QEMU",
   );
 });
 
 test("the physical shadow and host QEMU cycles are registered without impersonating Guanghu-owned boot control", () => {
-  assert.equal(contract.version, "2026-08-16.1");
+  assert.equal(contract.version, "2026-08-16.2");
   assert.equal(contract.implementation.guanghu_supervisor_lifecycle_contract_source, 100);
   assert.equal(contract.implementation.target_readback_and_mandatory_reclaim_state_machine, 100);
   assert.equal(contract.implementation.declared_supervisor_core_line_and_function_coverage, 100);
@@ -87,7 +87,7 @@ test("the physical shadow and host QEMU cycles are registered without impersonat
   assert.equal(contract.implementation.repository_bridge_lifecycle_controller_source, 100);
   assert.equal(contract.implementation.forgejo_repository_shadow_backend_source, 100);
   assert.equal(contract.implementation.repository_bridge_failure_reclaim_contract_test, 100);
-  assert.equal(contract.implementation.jd_real_forgejo_repository_shadow_lifecycle, 0);
+  assert.equal(contract.implementation.jd_real_forgejo_repository_shadow_lifecycle, 100);
   assert.equal(contract.implementation.independent_guanghu_first_boot_supervisor, 0);
   assert.equal(contract.implementation.jd_physical_deployment, 0);
   assert.equal(contract.current_target_evidence.final_state, "DORMANT");
@@ -109,6 +109,19 @@ test("the physical shadow and host QEMU cycles are registered without impersonat
   assert.equal(contract.cross_root_supervisor_qemu_evidence.linux_on_demand_subcontrol, 0);
   assert.equal(contract.cross_root_supervisor_qemu_evidence.final_guanghu_os_master, 0);
   assert.match(contract.cross_root_supervisor_qemu_evidence.server_receipt_sha256, /^[0-9a-f]{64}$/);
+  assert.equal(contract.repository_bridge_lifecycle_evidence.initial_state, "DORMANT");
+  assert.equal(contract.repository_bridge_lifecycle_evidence.active_state, "READY");
+  assert.equal(contract.repository_bridge_lifecycle_evidence.final_state, "DORMANT");
+  assert.equal(contract.repository_bridge_lifecycle_evidence.public_repository_process_preserved, 100);
+  assert.equal(contract.repository_bridge_lifecycle_evidence.public_repository_bootstrap_pid, 760);
+  assert.equal(contract.repository_bridge_lifecycle_evidence.public_code_http, 200);
+  assert.equal(contract.repository_bridge_lifecycle_evidence.public_repository_http, 200);
+  assert.equal(contract.repository_bridge_lifecycle_evidence.physical_boot_files_changed, false);
+  assert.equal(contract.repository_bridge_lifecycle_evidence.physical_reboot_performed, false);
+  assert.equal(contract.repository_bridge_lifecycle_evidence.linux_on_demand_subcontrol, 0);
+  assert.equal(contract.repository_bridge_lifecycle_evidence.final_guanghu_os_master, 0);
+  assert.match(contract.repository_bridge_lifecycle_evidence.server_receipt_sha256, /^[0-9a-f]{64}$/);
+  assert.match(contract.repository_bridge_lifecycle_evidence.lifecycle_receipt_sha256, /^[0-9a-f]{64}$/);
   assert.equal(contract.native_public_projection_shadow_evidence.synthetic_ready_shadow_readback, 100);
   assert.equal(contract.native_public_projection_shadow_evidence.post_test_state, "DORMANT");
   assert.equal(contract.native_public_projection_shadow_evidence.live_native_freshness_readback, 0);