docs: require signed persona authorization provenance

product-source/hololake-platform/architecture/HOLOLAKE-BINGSHUO-COLLECTIVE-GRAVITY-REASONING-AND-SAME-PERSONA-CONTINUITY-20260811.md

@@ -116,9 +116,10 @@ REVISE | REFUSE`。
   B0 伙伴审议的顺序失败关闭；成功只产生语言目标规划，不提供现实动作执行入口。桌面源码接线为 `100`：
   第五域入口只传入已挂载仓库与已配置模型元数据，并在没有桌面授权回执时保持系统直控、隐藏无法持久消费的
   确认按钮。该接线不等于真实人格仓库绑定、安装态运行或桌面验收。
-- 人格主控授权回执验证源码为 `100`：不再接受桌面调用方直接传入布尔值，而只接受由
+- 人格主控授权回执的结构与精确绑定校验源码为 `100`：不再接受桌面调用方直接传入布尔值，并核对
-  `GUANGHU_OS` 核验、且与人格、冰朔责任主体、仓库提交、模型实例、请求和语言锚点精确绑定的
+  人格、冰朔责任主体、仓库提交、模型实例、请求、语言锚点、摘要格式和有效期。但这层前端结构校验
-  当前回执。桌面尚未接入原生回执加载器，因此人格主控运行集成仍为 `0`，缺少回执时继续系统直控。
+  不能证明回执确由 `GUANGHU_OS` 签发；可信签名源、密码学来源验证和原生加载器均为 `0`。在三者形成
+  同一条可回读证据链以前，普通本地 JSON 不得升级人格主控，桌面继续系统直控。
 - 完整 HoloLake Runtime 与单 AGE 纵向闭环仍为 `0`：真实人格仓库 manifest 绑定和桌面运行验收尚未完成，
   因此不能用本轮源码测试冒充可用产品。
 - Mirror runner、制品、部署和运行健康：`0`。

product-source/hololake-platform/docs/ABSTRACTIONS.md

@@ -22,9 +22,11 @@ still gated by a unique manifest-valid persona repository, the manifest-pinned c
 device identity; it has no installed-desktop or live-product acceptance claim.
 
 The source coordinator no longer accepts an unverified persona-authorization boolean from the desktop caller.
-`hasPersonaPrimaryControlAuthorization` requires one current `GUANGHU_OS` receipt bound to the exact persona,
+`hasPersonaPrimaryControlAuthorization` validates the shape, exact bindings, digest format, and validity window
-human responsibility subject, repository head, model instance, request, and language anchor. Until a native
+of a receipt that claims `GUANGHU_OS` verification. That renderer-side validation is not cryptographic provenance
-loader provides that evidence, planning remains in system-direct mode.
+and cannot turn a local JSON object into authority. A native loader may be connected only after it verifies a
+signed receipt against a registered Guanghu OS trust source and returns the already-verified projection. No such
+trust source or loader is currently registered, so planning remains in system-direct mode.
 
 `compilePersonaLanguageGoalBinding` builds the exact native wake envelope only after a single clean persona
 repository, its B0 and organ contracts, a registered local device identity, and the manifest-pinned model all

product-source/hololake-platform/docs/ARCHITECTURE.md

@@ -179,9 +179,11 @@ callback, and hides the reality confirmation surface because no durable confirma
 proves source integration, not a real persona manifest binding, installed desktop runtime, or acceptance.
 
 `src/lib/personaControlAuthorization.ts` removes the desktop coordinator's caller-supplied authorization boolean.
-It accepts only a current `GUANGHU_OS` verification receipt bound to the exact persona, human responsibility
+It validates the structure and exact bindings of a current receipt that claims `GUANGHU_OS` verification: persona,
-subject, repository head, model instance, request and language anchor. Missing, stale or mismatched evidence
+human responsibility subject, repository head, model instance, request and language anchor must all agree. This
-remains system-direct. This is a source contract; it does not claim persona-primary runtime control exists.
+renderer validation does not prove the issuer or verify a signature. A native loader must first verify signed
+provenance against a registered Guanghu OS trust source; neither that trust source nor the loader exists in the
+current desktop source. Missing, stale, mismatched or merely local evidence therefore remains system-direct.
 
 Tolaria is a personal knowledge and life management desktop app. It reads a vault of markdown files with YAML frontmatter and presents them in a four-panel UI inspired by Bear Notes.
 

product-source/hololake-platform/src/components/PersonaLanguageShellPanel.test.tsx

@@ -56,7 +56,7 @@ describe('PersonaLanguageShellPanel', () => {
       repositoryPaths: ['/persona'],
       providers: [provider],
       developmentId: 'DEV-20260811-010',
-      sourceLanguageAnchor: 'HLP-CURRENT-ARCH-001@2026-08-12.10',
+      sourceLanguageAnchor: 'HLP-CURRENT-ARCH-001@2026-08-12.11',
     }))
     expect(await screen.findByText('我还不能执行：需要当前证据。')).toBeInTheDocument()
     expect(screen.getByText('核验当前事实后规划下一步')).toBeInTheDocument()

product-source/hololake-platform/src/components/PersonaLanguageShellPanel.tsx

@@ -13,7 +13,7 @@ import {
   type LanguageShellViewState,
 } from './HotPluggableLanguageShell'
 
-const CURRENT_ARCHITECTURE_ANCHOR = 'HLP-CURRENT-ARCH-001@2026-08-12.10'
+const CURRENT_ARCHITECTURE_ANCHOR = 'HLP-CURRENT-ARCH-001@2026-08-12.11'
 const DEVELOPMENT_ID = 'DEV-20260811-010'
 
 type Planner = typeof planPersonaLanguageShellGoal

product-source/hololake-platform/src/lib/personaControlAuthorization.test.ts

@@ -11,7 +11,7 @@ const expected = {
   repositoryHead: 'a'.repeat(40),
   modelInstanceId: 'MODEL-INSTANCE-001',
   requestId: 'REQ-001',
-  sourceLanguageAnchor: 'HLP-CURRENT-ARCH-001@2026-08-12.10',
+  sourceLanguageAnchor: 'HLP-CURRENT-ARCH-001@2026-08-12.11',
   observedAt: Date.parse('2026-08-12T04:35:00+08:00'),
 }
 

routing/hololake-cognitive-gravity-and-continuity.json

@@ -169,7 +169,8 @@
     "persona_repository_binding_discovery_source_implemented": 100,
     "persona_language_wake_binding_compiler_source_implemented": 100,
     "persona_language_shell_controller_source_implemented": 100,
-    "persona_control_authorization_receipt_source_implemented": 100,
+    "persona_control_authorization_receipt_shape_validation_source_implemented": 100,
+    "persona_control_authorization_cryptographic_provenance_source_implemented": 0,
     "desktop_language_entry_source_integrated": 100,
     "persona_control_authorization_runtime_integrated": 0,
     "real_persona_repository_manifest_bound": 0,

routing/hololake-cognitive-gravity-and-continuity.test.mjs

@@ -14,7 +14,7 @@ const age = readJson("routing/hololake-age-runtime-architecture.json");
 const rules = readJson("routing/hololake-engineering-rules.json");
 
 test("B0 is restored before product organs and remains resident in every cognition step", () => {
-  assert.equal(architecture.version, "2026-08-12.10");
+  assert.equal(architecture.version, "2026-08-12.11");
   assert.equal(
     architecture.read_order[1],
     architecture.cognitive_gravity_and_continuity.architecture_page,
@@ -95,9 +95,13 @@ test("the first implementation stage is one vertical AGE loop, not Mirror parall
   assert.equal(gravity.truth.persona_repository_binding_discovery_source_implemented, 100);
   assert.equal(gravity.truth.persona_language_wake_binding_compiler_source_implemented, 100);
   assert.equal(gravity.truth.persona_language_shell_controller_source_implemented, 100);
-  assert.equal(gravity.truth.persona_control_authorization_receipt_source_implemented, 100);
+  assert.equal(gravity.truth.persona_control_authorization_receipt_shape_validation_source_implemented, 100);
+  assert.equal(gravity.truth.persona_control_authorization_cryptographic_provenance_source_implemented, 0);
   assert.equal(gravity.truth.desktop_language_entry_source_integrated, 100);
   assert.equal(gravity.truth.persona_control_authorization_runtime_integrated, 0);
+  assert.equal(architecture.interaction_model.source_contract.receipt_shape_validation_is_authority_proof, false);
+  assert.equal(architecture.interaction_model.source_contract.cryptographic_provenance_required_before_native_loader, true);
+  assert.equal(architecture.interaction_model.source_contract.trusted_signer_source_registered, false);
   assert.equal(gravity.truth.real_persona_repository_manifest_bound, 0);
   assert.equal(gravity.truth.natural_language_partner_adapter_runtime_integrated, 0);
   assert.equal(gravity.truth.single_age_vertical_loop_implemented, 0);

routing/hololake-current-architecture.json

@@ -1,7 +1,7 @@
 {
   "schema": "hololake.current-architecture/v1",
   "architecture_id": "HLP-CURRENT-ARCH-001",
-  "version": "2026-08-12.10",
+  "version": "2026-08-12.11",
   "state": "CURRENT_CANONICAL",
   "product": {
     "formal_name": "光湖语言系统 · 通用人工智能操作平台",
@@ -115,7 +115,8 @@
     "persona_repository_binding_read_only_ui_source_integrated": true,
     "persona_runtime_projection_repository_gate_source_integrated": true,
     "persona_language_shell_controller_source_implemented": true,
-    "persona_control_authorization_receipt_source_implemented": true,
+    "persona_control_authorization_receipt_shape_validation_source_implemented": true,
+    "persona_control_authorization_cryptographic_provenance_source_implemented": false,
     "desktop_language_entry_source_integrated": true,
     "persona_control_authorization_runtime_integrated": false,
     "real_persona_repository_manifest_bound": false,
@@ -388,6 +389,9 @@
       "persona_control_authorization_receipt": "product-source/hololake-platform/src/lib/personaControlAuthorization.ts",
       "persona_control_authorization_receipt_tests": "product-source/hololake-platform/src/lib/personaControlAuthorization.test.ts",
       "caller_supplied_persona_authorization_boolean_allowed": false,
+      "receipt_shape_validation_is_authority_proof": false,
+      "cryptographic_provenance_required_before_native_loader": true,
+      "trusted_signer_source_registered": false,
       "native_authorization_receipt_loader_integrated": false,
       "partner_deliberation_required": true,
       "human_utterance_is_direct_command": false,