feat(tcs): add corpus gate and runtime ignition boundary

2026-08-23 23:50:56 +08:00 · 2026-08-23 23:50:56 +08:00 · a826e6eb78
commit a826e6eb78
parent b5072d6a8b
26 changed files with 2730 additions and 0 deletions
--- a/build/TCS-TRUSTED-SIGNER-PROVISIONING-REQUEST-0001.gir.json
+++ b/build/TCS-TRUSTED-SIGNER-PROVISIONING-REQUEST-0001.gir.json
@ -0,0 +1,112 @@
+{
+  "compiled_from": {
+    "compiler_id": "TCS-COMPILER-STAGE3-GENERIC-ACTION-LOADER-0001",
+    "compiler_state": "TCS_COMPILER_GIR_EXECUTED",
+    "source_sha256": "4deb85d6d0f5bdb61ff2d9182d9acd1e0f1e266661bc30d75befccbe3b936e4d"
+  },
+  "declaration": {
+    "acceptance": {
+      "capability_registry_state_after_pass": "SIGNED_VERIFIED_NOT_INSTALLED",
+      "current_acceptance": 0,
+      "installation_is_separate_step": true,
+      "signature_verified": "BINARY_PASS_OR_FAIL",
+      "signer_registered": "AUTHORITATIVE_REGISTRY_READBACK_REQUIRED"
+    },
+    "admission": {
+      "out_of_scope": "TCS-E4001",
+      "stale_or_revoked": "TCS-E5002",
+      "unsigned_or_unknown_signer": "TCS-E3002",
+      "verify_candidate_hash_before_signature": true,
+      "verify_public_key_against_authoritative_signer_registry": true,
+      "verify_revocation_before_each_activation": true,
+      "verify_scope_before_install": true,
+      "verify_signature_before_mount": true
+    },
+    "current": {
+      "activation": false,
+      "authoritative_registry_state": "CURRENT_EMPTY_NO_TRUSTED_SIGNER",
+      "candidate_registry": "TCS-CAPREG-LPM-DESKTOP-CANDIDATE-0001",
+      "candidate_state": "UNSIGNED_CANDIDATE_NOT_INSTALLABLE",
+      "install": false,
+      "mount": false,
+      "public_key": "ABSENT",
+      "signature": "ABSENT",
+      "signer_id": "UNKNOWN"
+    },
+    "header": {
+      "canonical_uri": "language/protocols/TCS-TRUSTED-SIGNER-PROVISIONING-REQUEST-0001.tcs",
+      "compatibility": [
+        "GIR/1"
+      ],
+      "language": "TCS/0.1",
+      "lifecycle": "CANDIDATE",
+      "name_en": "HoloLake Capability Registry Trusted Signer Provisioning Request",
+      "name_zh": "HoloLake能力注册表可信签名主体供给请求",
+      "profile": "HLDP/1",
+      "protocols": [
+        "TCS-GENERIC-ACTION-GRAPH-LOADER-0001",
+        "TCS-MODULE-ABI-0001"
+      ],
+      "schema": "tcs.protocol/v1",
+      "version": "0.1.0"
+    },
+    "rejected": {
+      "values": [
+        "INFER_SIGNER_FROM_USER_ACCOUNT",
+        "INFER_SIGNER_FROM_ROOT",
+        "INFER_SIGNER_FROM_SSH_ACCESS",
+        "INFER_SIGNER_FROM_GIT_REMOTE_RIGHTS",
+        "GENERATE_UNREQUESTED_IDENTITY_KEY",
+        "STORE_PRIVATE_KEY_IN_REPOSITORY",
+        "CALL_UNSIGNED_CANDIDATE_SIGNED"
+      ]
+    },
+    "request": {
+      "git_push_authority_reuse": false,
+      "host_root_or_ssh_key_reuse": false,
+      "key_generation_by_current_codex": false,
+      "private_key_location": "OUTSIDE_REPOSITORY_AND_OUTSIDE_RECEIPTS",
+      "required": [
+        "SEPARATELY_AUTHORIZED_SIGNER_ID",
+        "ED25519_PUBLIC_KEY",
+        "KEY_PROVENANCE_RECEIPT",
+        "PERMITTED_REGISTRY_SCOPE",
+        "EXPIRY_OR_REVOCATION_RULE",
+        "ONE_EXACT_CANDIDATE_HASH",
+        "HUMAN_LANGUAGE_AUTHORIZATION_RECEIPT_BOUND_TO_REQUEST"
+      ]
+    },
+    "signature_envelope": {
+      "algorithm": "ED25519",
+      "channel": "ICE-CH-ZC001",
+      "development_line": "HOLOLAKE-LPM-TCS-NATIVE-20260823",
+      "payload": [
+        "REGISTRY_CANONICAL_SHA256",
+        "REGISTRY_ID",
+        "REGISTRY_VERSION",
+        "ISSUER_SIGNER_ID",
+        "ISSUED_AT",
+        "EXPIRES_AT_OR_NO_EXPIRY_POLICY",
+        "REVOCATION_EPOCH",
+        "CHANNEL",
+        "DEVELOPMENT_LINE"
+      ]
+    },
+    "source": {
+      "source_id": "BINGSHUO-HOLOLAKE-TCS-ENGINEERING-ANCHOR-20260823",
+      "source_role": "DIRECT_HUMAN",
+      "source_sha256": "a3dd8dbd2203b631bdb23f2693eb314d4ef86af68fdeaee8835e3cf0861ddd23",
+      "source_uri": "language-sources/direct-human/BINGSHUO-HOLOLAKE-TCS-ENGINEERING-ANCHOR-20260823.txt"
+    }
+  },
+  "executable": false,
+  "identity": {
+    "declaration_id": "TCS-TRUSTED-SIGNER-PROVISIONING-REQUEST-0001",
+    "declaration_kind": "PROTOCOL",
+    "language_version": "0.1"
+  },
+  "native_self_hosted": true,
+  "natural_language_is_typed_data": true,
+  "schema": "guanghu.declaration-gir/v1",
+  "unresolved_natural_language": false
+}