feat: embed complete GLS protocol kernel in HoloLake

2026-08-17 17:56:47 +08:00 · 2026-08-17 17:56:47 +08:00 · b8d08fb620
commit b8d08fb620
parent ca5d6f3f58
15 changed files with 3515 additions and 485 deletions
--- a/product-source/hololake-native-desktop/contracts/gls-executable-projections.json
+++ b/product-source/hololake-native-desktop/contracts/gls-executable-projections.json
@ -1,30 +1,32 @@
 {
-  "schema": "hololake.gls-executable-projections/v1",
+  "schema": "hololake.gls-executable-projections/v2",
  "source_commit": "2598fbfba8caf64c7ab9740a3036c5aab977502e",
+  "runtime_graph_rule": "ONLY_EXPLICIT_RUNTIME_REQUIRES_EDGES_ENTER_ACTIVATION_GRAPH",
  "projections": {
-    "GLS-0250": {
-      "projection_kind": "TYPED_FACT_AND_DOMAIN_BOUNDARY",
-      "adapter": "origin-domain-topology",
-      "event_kinds": ["BOOTSTRAP", "DOMAIN_ROUTE"],
-      "dependencies": []
-    },
-    "GLS-0253": {
-      "projection_kind": "DETERMINISTIC_IDENTITY_AND_NUMBERING_GUARD",
-      "adapter": "zero-core-numbering",
-      "event_kinds": ["IDENTITY_ROUTE", "IDENTITY_ADMISSION", "NUMBERING_RESOLVE"],
-      "dependencies": ["GLS-0250", "GLS-0262", "GLS-0263"]
-    },
-    "GLS-0262": {
-      "projection_kind": "REALITY_ENGINEERING_STAGE_GATE",
-      "adapter": "reality-engineering-stage",
-      "event_kinds": ["RUNTIME_STAGE"],
-      "dependencies": []
-    },
-    "GLS-0263": {
-      "projection_kind": "LANGUAGE_PRODUCT_DUAL_UPDATE_BOUNDARY",
-      "adapter": "dual-update-channel",
-      "event_kinds": ["PROTOCOL_UPDATE", "PRODUCT_UPDATE"],
-      "dependencies": ["GLS-0250", "GLS-0262"]
-    }
+    "GLS-0250": {"stage":"P0","projection_kind":"TYPED_FACT_AND_DOMAIN_BOUNDARY","adapter":"origin-domain-topology","event_kinds":["BOOTSTRAP","DOMAIN_ROUTE"],"dependencies":[]},
+    "GLS-0253": {"stage":"P0","projection_kind":"DETERMINISTIC_IDENTITY_AND_NUMBERING_GUARD","adapter":"zero-core-numbering","event_kinds":["IDENTITY_ROUTE","IDENTITY_ADMISSION","NUMBERING_RESOLVE"],"dependencies":["GLS-0250","GLS-0262","GLS-0263"]},
+    "GLS-0262": {"stage":"P0","projection_kind":"REALITY_ENGINEERING_STAGE_GATE","adapter":"reality-engineering-stage","event_kinds":["RUNTIME_STAGE"],"dependencies":[]},
+    "GLS-0263": {"stage":"P0","projection_kind":"LANGUAGE_PRODUCT_DUAL_UPDATE_BOUNDARY","adapter":"dual-update-channel","event_kinds":["PROTOCOL_UPDATE","PRODUCT_UPDATE"],"dependencies":["GLS-0250","GLS-0262"]},
+    "GLS-0301": {"stage":"P1","projection_kind":"STRICT_MESSAGE_ENVELOPE_CODEC","adapter":"glp-envelope-codec","event_kinds":["MESSAGE_VALIDATE"],"dependencies":["GLS-0250"]},
+    "GLS-0302": {"stage":"P1","projection_kind":"IDENTITY_REFERENCE_WITHOUT_AUTHORITY","adapter":"glp-identity-reference","event_kinds":["IDENTITY_VERIFY"],"dependencies":["GLS-0253"]},
+    "GLS-0303": {"stage":"P1","projection_kind":"FAIL_CLOSED_CONTEXT_GUARD","adapter":"glp-context-guard","event_kinds":["CONTEXT_RESOLVE"],"dependencies":["GLS-0301","GLS-0302"]},
+    "GLS-0306": {"stage":"P1","projection_kind":"HASH_CHAIN_DECISION_RECEIPT_LEDGER","adapter":"glp-decision-kernel","event_kinds":["DECISION_RECEIPT","PROTOCOL_DECIDE"],"dependencies":["GLS-0301","GLS-0302","GLS-0303"]},
+    "GLS-0307": {"stage":"P2","projection_kind":"BOUNDED_HEARTBEAT_LEASE_GUARD","adapter":"glp-live-coordination","event_kinds":["HEARTBEAT_OBSERVE"],"dependencies":["GLS-0302","GLS-0306"]},
+    "GLS-0309": {"stage":"P2","projection_kind":"SEPARATION_OF_DUTIES_WORK_ORDER_STATE_MACHINE","adapter":"glp-live-coordination","event_kinds":["WORK_ORDER_TRANSITION"],"dependencies":["GLS-0302","GLS-0303","GLS-0306"]},
+    "GLS-0842": {"stage":"P2","projection_kind":"AUTHENTICATED_LIVE_SESSION_ADAPTER","adapter":"glp-live-coordination","event_kinds":["LIVE_SESSION_OBSERVE"],"dependencies":["GLS-0301","GLS-0302","GLS-0303","GLS-0306","GLS-0307"]},
+    "GLS-0311": {"stage":"P2","projection_kind":"APPEND_ONLY_TARGET_EVIDENCE_WITNESS","adapter":"glp-live-coordination","event_kinds":["WITNESS_APPEND"],"dependencies":["GLS-0306","GLS-0307","GLS-0842"]},
+    "GLS-0304": {"stage":"P3","projection_kind":"CONFLICT_PRESERVING_MEMORY_SYNC","adapter":"glp-continuity-kernel","event_kinds":["MEMORY_SYNC"],"dependencies":["GLS-0303","GLS-0306"]},
+    "GLS-0308": {"stage":"P3","projection_kind":"CAUSAL_STATE_SYNC_WITHOUT_LAST_WRITE_WINS","adapter":"glp-continuity-kernel","event_kinds":["STATE_SYNC"],"dependencies":["GLS-0303","GLS-0304","GLS-0306"]},
+    "GLS-0827": {"stage":"P3","projection_kind":"MONOTONIC_TIME_AND_SINGLE_PRIMARY_LEASE","adapter":"glp-continuity-kernel","event_kinds":["TIME_CONTINUITY"],"dependencies":["GLS-0304","GLS-0307","GLS-0308"]},
+    "GLS-0710": {"stage":"P4","projection_kind":"IMMUTABLE_DIGEST_BOUND_MODULE_BACKPACK","adapter":"gls-execution-control","event_kinds":["MODULE_ADMIT"],"dependencies":["GLS-0306"]},
+    "GLS-0803": {"stage":"P4","projection_kind":"EXECUTION_BODY_LIFECYCLE_STATE_MACHINE","adapter":"gls-execution-control","event_kinds":["LIFECYCLE_TRANSITION"],"dependencies":["GLS-0710","GLS-0827"]},
+    "GLS-0819": {"stage":"P4","projection_kind":"ISOLATED_RESOURCE_RUNWAY_SCHEDULER","adapter":"gls-execution-control","event_kinds":["RUNWAY_ASSIGN","RUNWAY_RELEASE"],"dependencies":["GLS-0803"]},
+    "GLS-0310": {"stage":"P4","projection_kind":"UNIQUE_CONTROL_EPOCH_STATE_MACHINE","adapter":"gls-execution-control","event_kinds":["BROADCAST_TRANSITION"],"dependencies":["GLS-0301","GLS-0302","GLS-0303","GLS-0306","GLS-0803","GLS-0819"]},
+    "GLS-0709": {"stage":"P5","projection_kind":"SEMANTIC_EXTERNAL_ADAPTER_WITHOUT_EXECUTION_AUTHORITY","adapter":"gls-external-resource-boundary","event_kinds":["EXTERNAL_ADAPTER_TRANSLATE"],"dependencies":["GLS-0301","GLS-0302","GLS-0303","GLS-0306"]},
+    "GLS-0708": {"stage":"P5","projection_kind":"REPLACEABLE_MODEL_RESOURCE_ROUTER","adapter":"gls-external-resource-boundary","event_kinds":["MODEL_ROUTE"],"dependencies":["GLS-0306","GLS-0709"]},
+    "GLS-0828": {"stage":"P5","projection_kind":"EPHEMERAL_SANDBOXED_CAPABILITY_EXTENSION","adapter":"gls-external-resource-boundary","event_kinds":["TEMPORARY_CAPABILITY"],"dependencies":["GLS-0311","GLS-0709","GLS-0710"]},
+    "GLS-0411": {"stage":"P6","projection_kind":"RESTRICTED_HLDP_NATIVE_PROGRAM_PROFILE","adapter":"gls-bootstrap-compiler","event_kinds":["HLDP_NP_VALIDATE"],"dependencies":["GLS-0301","GLS-0302","GLS-0303","GLS-0306"]},
+    "GLS-0131": {"stage":"P6","projection_kind":"DETERMINISTIC_GIR_SCHEMA","adapter":"gls-bootstrap-compiler","event_kinds":["GIR_VALIDATE"],"dependencies":["GLS-0411"]},
+    "GLS-0130": {"stage":"P6","projection_kind":"BOOTSTRAP_HLDP_TO_GIR_COMPILER","adapter":"gls-bootstrap-compiler","event_kinds":["COMPILE_HLDP"],"dependencies":["GLS-0411","GLS-0131"]}
  }
 }
--- a/product-source/hololake-native-desktop/contracts/gls-native-runtime-kernel.json
+++ b/product-source/hololake-native-desktop/contracts/gls-native-runtime-kernel.json
@ -0,0 +1,42 @@
+{
+  "schema": "hololake.gls-native-runtime-kernel/v1",
+  "record_id": "HLP-GLS-NATIVE-RUNTIME-KERNEL-001",
+  "source_commit": "2598fbfba8caf64c7ab9740a3036c5aab977502e",
+  "receipt_schema": "hololake.protocol-decision-receipt/v1",
+  "decision_set": ["ALLOW", "DENY", "AMBIGUOUS", "UNVERIFIED"],
+  "runtime_boundaries": {
+    "identity_is_authority": false,
+    "model_is_persona": false,
+    "model_can_override_decision": false,
+    "raw_protocol_text_executed": false,
+    "arbitrary_external_code_executed": false,
+    "last_write_wins_on_concurrent_state": false,
+    "target_evidence_required_for_completion": true,
+    "every_decision_writes_receipt": true
+  },
+  "stages": [
+    {"id":"P1","state":"IMPLEMENTED_NATIVE","protocols":["GLS-0301","GLS-0302","GLS-0303","GLS-0306"]},
+    {"id":"P2","state":"IMPLEMENTED_NATIVE","protocols":["GLS-0307","GLS-0309","GLS-0311","GLS-0842"]},
+    {"id":"P3","state":"IMPLEMENTED_NATIVE","protocols":["GLS-0304","GLS-0308","GLS-0827"]},
+    {"id":"P4","state":"IMPLEMENTED_NATIVE","protocols":["GLS-0710","GLS-0803","GLS-0819","GLS-0310"]},
+    {"id":"P5","state":"IMPLEMENTED_NATIVE","protocols":["GLS-0709","GLS-0708","GLS-0828"]},
+    {"id":"P6","state":"IMPLEMENTED_BOOTSTRAP_SELF_CHECK","protocols":["GLS-0411","GLS-0130","GLS-0131"]},
+    {"id":"P7","state":"ASSEMBLY_REGISTRY_FAIL_CLOSED","protocols":["GLS-0836","GLS-0840","GLS-0841","GLS-0842","GLS-0843","GLS-0844","GLS-0845","GLS-0846","GLS-0847","GLS-0848","GLS-0849"]}
+  ],
+  "p7_node_assemblies": [
+    {"protocolId":"GLS-0836","target":"DESKTOP_HOLOLAKE","state":"UNVERIFIED_TARGET_CAPABILITY","sourceEvidenceNode":"BS-SH-005"},
+    {"protocolId":"GLS-0840","target":"DESKTOP_HOLOLAKE","state":"UNVERIFIED_TARGET_CAPABILITY","sourceEvidenceNode":"BS-SH-005"},
+    {"protocolId":"GLS-0841","target":"DESKTOP_HOLOLAKE","state":"UNVERIFIED_TARGET_CAPABILITY","sourceEvidenceNode":"BS-SH-005"},
+    {"protocolId":"GLS-0842","target":"DESKTOP_HOLOLAKE","state":"LOCAL_ADAPTER_IMPLEMENTED_TARGET_HEALTH_UNVERIFIED","sourceEvidenceNode":"JD-FD-PRIMARY"},
+    {"protocolId":"GLS-0843","target":"DESKTOP_HOLOLAKE","state":"UNVERIFIED_TARGET_CAPABILITY","sourceEvidenceNode":"BS-SH-005"},
+    {"protocolId":"GLS-0844","target":"DESKTOP_HOLOLAKE","state":"LOCAL_QUALITY_GATE_AVAILABLE_NOT_PHYSICAL_OS_EVIDENCE","sourceEvidenceNode":"BS-SH-005"},
+    {"protocolId":"GLS-0845","target":"DESKTOP_HOLOLAKE","state":"UNVERIFIED_TARGET_CAPABILITY","sourceEvidenceNode":"BS-SH-005"},
+    {"protocolId":"GLS-0846","target":"DESKTOP_HOLOLAKE","state":"UNVERIFIED_TARGET_CAPABILITY","sourceEvidenceNode":"BS-SH-005"},
+    {"protocolId":"GLS-0847","target":"DESKTOP_HOLOLAKE","state":"UNVERIFIED_TARGET_CAPABILITY","sourceEvidenceNode":"BS-SH-005"},
+    {"protocolId":"GLS-0848","target":"DESKTOP_HOLOLAKE","state":"UNVERIFIED_TARGET_CAPABILITY","sourceEvidenceNode":"BS-SH-005"},
+    {"protocolId":"GLS-0849","target":"DESKTOP_HOLOLAKE","state":"UNVERIFIED_TARGET_CAPABILITY","sourceEvidenceNode":"BS-SH-005"}
+  ],
+  "lifecycle_states": ["REGISTERED","DORMANT","RESIDENT","SUMMONED","ASSIGNED","FETCHING","VERIFYING","MATERIALIZING","RUNNING","SUPERVISING","STOPPING","CLEANING","RECEIPT","RETURNED"],
+  "broadcast_actions": ["REGISTER","SUMMON","ASSIGN","START","SUPERVISE","STOP","CLEAN","RECEIPT","RETURN"],
+  "work_order_stages": ["REGISTERED","TESTED","PUBLISHED","DEPLOYED"]
+}
--- a/product-source/hololake-native-desktop/contracts/gls-runtime-registry.json
+++ b/product-source/hololake-native-desktop/contracts/gls-runtime-registry.json
--- a/product-source/hololake-native-desktop/docs/ARCHITECTURE.md
+++ b/product-source/hololake-native-desktop/docs/ARCHITECTURE.md
@ -48,6 +48,14 @@ An authenticated non-visitor connector may now acquire, inspect and explicitly r

 The zero-core protocol layer now compiles the numbered GLS sources pinned to the current REPO-012 commit into a deterministic native registry. The registry inventories every unique numbered source with its path and SHA-256, but only protocols with an explicit typed adapter, event set and dependency-closed projection may execute. Raw protocol prose and arbitrary code carried by a protocol are never executed. The first native enforcement adapter binds GLS-0253 identity and numbering rules to the human-number route, with GLS-0250, GLS-0262 and GLS-0263 as executable dependencies. Unknown namespaces, persona numbers presented as human numbers, missing adapters and unprojected protocols fail closed. The system page reports compiled, executable and not-yet-executable protocol counts without presenting inventory as enforcement.

+## Product-embedded GLS protocol kernel
+
+GLS enforcement is part of the HoloLake executable, not a sidecar process on the development computer. Rust embeds the pinned runtime manifest and kernel contract in the application binary. Application startup validates the full executable dependency graph, P1-P6 contract set, deterministic HLDP-NP → GIR compiler self-check and the per-user receipt ledger; a failure prevents normal product startup.
+
+The unified decision API returns only `ALLOW`, `DENY`, `AMBIGUOUS` or `UNVERIFIED` with stable reason codes. Every result, including malformed input and refusal, appends an idempotent SHA-256-linked receipt. The same immediate SQLite transaction also advances the durable protocol state for work orders, time leases, immutable modules, persona lifecycle, isolated runways and broadcast control epochs. Stale transitions, concurrent double-primary claims, cross-owner runway release and immutable digest replacement fail closed; concurrent memory/state versions are retained in a conflict set instead of last-write-wins. Identity never implies permission, stale heartbeats and leases become unknown, work-order proposers cannot self-approve, models remain replaceable inference resources, and temporary capabilities cannot auto-install, publish or deploy.
+
+The P7 native-OS assembly registry is also embedded, but it is not a physical-capability simulator. It records the exact target and source-evidence node for GLS-0836 and GLS-0840–0849. No BS-SH-005 or JD-FD-PRIMARY evidence is relabeled as desktop health; without target-side evidence the assembly stays unverified.
+
 ## Circular-lake protocol membrane and nearby AI

 HoloLake 0.4.0 places a deterministic protocol membrane in front of the local language inbox. The membrane accepts only strict GLP/1.0 expression envelopes from a HoloLake-issued visitor session. Unknown fields, malformed identifiers, incorrect checksums, oversized content, attachments and command content are rejected before storage. Accepted natural language is an expression receipt only; it never carries execution authority by itself. Intent interpretation remains behind the membrane and cannot weaken its structural admission rules.
--- a/product-source/hololake-native-desktop/docs/GLS-NATIVE-RUNTIME-IMPLEMENTATION-PLAN-20260817.md
+++ b/product-source/hololake-native-desktop/docs/GLS-NATIVE-RUNTIME-IMPLEMENTATION-PLAN-20260817.md
@ -1,6 +1,6 @@
 # GLS 原生协议运行层实施规划

-状态：`EVIDENCE_BACKED_IMPLEMENTATION_BASELINE`
+状态：`P0_TO_P7_DESKTOP_PRODUCT_KERNEL_IMPLEMENTED · INSTALLED_RUNTIME_ACCEPTANCE_PENDING`

 核验时间：2026-08-17（Asia/Shanghai）

@ -219,6 +219,10 @@ protocol_decision_receipt:

 `d6b1290` 完成了 75 份编号协议的确定性发现登记，并为 `GLS-0250 / 0253 / 0262 / 0263` 建立首批原生适配器。P0 随后已把运行清单升级为 v2：四份登记源分别固化摘要，75 份协议全部取得登记解释，旧依赖与显式运行依赖分离，三组旧环只进入审计面而不能进入执行图。

-下一步是实现 P1 的 GLP schema、统一裁决 API 和持久回执，再按 P2–P7 逐层扩大运行集合。旧依赖边只有经权威修订为明确的类型边后才可离开审计面。
+P1–P6 已按顺序实现为 HoloLake Rust 原生器官：统一裁决 API 对消息、身份、上下文、会话、心跳、工单、见证、时间、记忆、状态、模块、生命周期、资源轨道、广播主控、外部适配、模型路由、临时能力和 HLDP-NP/GIR 编译执行确定性守门；所有裁决进入用户侧 SQLite 哈希链。工单阶段、时间租约、不可变模块、人格执行体生命周期、隔离跑道与广播塔主控纪元和裁决回执在同一原子事务中推进；旧状态重放、租约内双主、越权释放和同编号换摘要都失败关闭，并发记忆/状态版本写入冲突集而非互相覆盖。GLC Bootstrap Compiler 对同一黄金程序执行双编译一致性检查，不解析自由自然语言、不执行生成代码。
+
+P7 已实现桌面产品侧装配注册表，但没有伪造物理能力：GLS-0836 与 GLS-0840–0849 全部保留目标节点、来源证据节点和当前装配状态，`ACTIVE_HEALTHY` 数量固定为 0，直到目标节点自身给出版本绑定回执。协议合同、运行图、状态机和编译器通过 Rust 编入 HoloLake 应用；用户数据与裁决回执留在各自应用数据目录。
+
+当前验收数字：75 份编号源、183 条已分型来源依赖、0 条未分类依赖、25 份可执行投影、50 份库存不可执行源、P1–P6 共 21 份新原生器官、P7 共 11 项失败关闭装配边界。

 这保证“已注册”不会被误报为“系统正在运行”，也保证每次新增执行协议都有可重复编译、明确守卫和真实回执。
--- a/product-source/hololake-native-desktop/docs/adr/0006-compiled-gls-protocol-runtime.md
+++ b/product-source/hololake-native-desktop/docs/adr/0006-compiled-gls-protocol-runtime.md
@ -11,15 +11,19 @@ REPO-012 contains dozens of numbered GLS protocol sources. Human-readable source

 Compile the current numbered GLS sources into a deterministic v2 runtime manifest pinned to an exact REPO-012 commit. Every selected source records its stable GLS number, path and SHA-256. Duplicate historical source locations are resolved by a deterministic source preference, while alternate-source counts remain visible. The compiler also reconciles the protocol registry, GLS entry, source manifest, architecture catalog and routing references, preserving their independent source hashes and rejecting registration conflicts.

-Legacy `depends` arrays are not silently interpreted as runtime edges. They remain `LEGACY_UNTYPED_REFERENCE` audit edges and block new activation until their meaning is classified. Only dependencies declared by an explicit executable projection enter the runtime graph as `RUNTIME_REQUIRES`; that graph must be acyclic and dependency-closed.
+Legacy `depends` arrays are not silently interpreted as runtime edges. Bootstrap Compiler v1 classifies every source edge as `NORMATIVE_REFERENCE`, `SCHEMA_IMPORT`, `BUILD_REQUIRES`, `BOOT_REQUIRES`, `RECOVERY_REQUIRES` or `EVIDENCE_ONLY`; all remain audit-only. Only dependencies declared by an explicit executable projection enter the runtime graph as `RUNTIME_REQUIRES`; that graph must be acyclic and dependency-closed. The current exact source produces 183 typed source edges and zero unclassified edges.

 An executable projection requires an explicit native adapter, event kinds, dependency list and fail-closed behavior. The compiler rejects missing executable dependencies and dependency cycles. The native runtime revalidates schema, source commit, counts, hashes, adapters and dependency closure before returning a protocol set to an organ.

-Protocol prose is never evaluated as code. A protocol without an explicit projection remains `INVENTORIED_NOT_EXECUTABLE`. The initial executable set is GLS-0250, GLS-0253, GLS-0262 and GLS-0263. The zero-core numbering adapter requires their dependency-closed set before it can route a human number to an authoritative registry.
+Protocol prose is never evaluated as code. A protocol without an explicit projection remains `INVENTORIED_NOT_EXECUTABLE`. The product now embeds 25 dependency-closed projections: four P0 foundation contracts and 21 P1-P6 protocol organs. They provide the strict GLP codec, identity/context guards, hash-chain decision ledger, session/heartbeat/work-order/witness rules, causal time/memory/state guards, module/lifecycle/scheduler/control state machines, external/model/temporary-capability boundaries and the restricted HLDP-NP → GIR bootstrap compiler.
+
+The kernel is an application-start prerequisite. If its embedded contract, projection closure, deterministic compiler self-check or local receipt/state ledger cannot load, HoloLake fails closed during startup. Receipt append and state-machine transition use one immediate SQLite transaction, so stale work-order/lifecycle transitions, conflicting time or broadcast owners, immutable module replacement and cross-owner runway release cannot race past the guards. Concurrent memory/state inputs are stored as conflicts rather than overwritten. The ledger stores per-user receipts and projections in application data; protocol authority and enforcement code are compiled into the signed application bundle and do not depend on the development machine.
+
+P7 is intentionally different: the application embeds an 11-item target capability assembly registry for GLS-0836 and GLS-0840–0849, but records zero desktop physical capabilities as verified. Evidence from BS-SH-005 or JD-FD-PRIMARY is never transferred into desktop health. A target becomes active only after its own version-bound evidence exists.

 ## Why

-This creates the same hard boundary that a real API presents: a caller must satisfy the machine contract whether or not it has read the explanatory documentation. It also preserves factual honesty. HoloLake can report that 75 protocol sources are compiled while separately reporting that only four currently have native enforcement projections.
+This creates the same hard boundary that a real API presents: a caller must satisfy the machine contract whether or not it has read the explanatory documentation. It also preserves factual honesty. HoloLake reports 75 inventoried sources, 25 native enforcement projections and 50 non-executable sources separately.

 ## Rejected alternatives

@ -35,5 +39,8 @@ This creates the same hard boundary that a real API presents: a caller must sati
 - `contracts/gls-executable-projections.json`
 - `contracts/gls-runtime-registry.json`
 - `src-tauri/src/gls_protocol_runtime.rs`
+- `src-tauri/src/gls_protocol_kernel.rs`
+- `src-tauri/src/gls_bootstrap_compiler.rs`
+- `contracts/gls-native-runtime-kernel.json`
 - `src-tauri/src/zero_core_numbering.rs`
 - `scripts/gls-protocol-runtime.test.mjs`
--- a/product-source/hololake-native-desktop/scripts/compile-gls-runtime-registry.mjs
+++ b/product-source/hololake-native-desktop/scripts/compile-gls-runtime-registry.mjs
@ -55,6 +55,27 @@ function sourceDependencies(raw) {
  return [...new Set(match?.[1].match(/GLS-\d{4}/g) || [])].sort()
 }

+// REPO-012 的旧 depends 没有声明边语义。Bootstrap Compiler 必须把每条旧边
+// 投影为受限、只读的工程类型；这些边永不自动取得运行效力。真正进入激活图的边
+// 只能来自 gls-executable-projections/v2 的显式 RUNTIME_REQUIRES。
+function typedSourceDependency(sourceId, targetId) {
+  const number = Number(targetId.slice(4))
+  const recoveryTargets = new Set(['GLS-0304', 'GLS-0308', 'GLS-0827', 'GLS-0836', 'GLS-0843', 'GLS-0845', 'GLS-0846', 'GLS-0847', 'GLS-0848', 'GLS-0849'])
+  const bootTargets = new Set(['GLS-0307', 'GLS-0310', 'GLS-0803', 'GLS-0819', 'GLS-0840', 'GLS-0841'])
+  const buildTargets = new Set(['GLS-0130', 'GLS-0131', 'GLS-0411', 'GLS-0710', 'GLS-0844'])
+  const evidenceTargets = new Set(['GLS-0306', 'GLS-0311', 'GLS-0604'])
+  let edgeKind = 'NORMATIVE_REFERENCE'
+  if (recoveryTargets.has(targetId) && (sourceId >= 'GLS-0800' || sourceId === 'GLS-0304' || sourceId === 'GLS-0308')) edgeKind = 'RECOVERY_REQUIRES'
+  else if (bootTargets.has(targetId) && sourceId >= 'GLS-0800') edgeKind = 'BOOT_REQUIRES'
+  else if (buildTargets.has(targetId)) edgeKind = 'BUILD_REQUIRES'
+  else if (evidenceTargets.has(targetId)) edgeKind = 'EVIDENCE_ONLY'
+  else if ((number >= 300 && number <= 399) || (number >= 400 && number <= 499) || ['GLS-0602', 'GLS-0603', 'GLS-0605'].includes(targetId)) edgeKind = 'SCHEMA_IMPORT'
+  return {
+    edge_kind: edgeKind,
+    classification_basis: 'BOOTSTRAP_COMPILER_V1_FAMILY_AND_TARGET_RULE',
+  }
+}
+
 function contractKind(family, projectionKind) {
  if (projectionKind) return projectionKind
  const kinds = {
@ -142,7 +163,9 @@ function stronglyConnectedComponents(graph) {
 }

 const projectionManifest = JSON.parse(await readFile(projectionsPath, 'utf8'))
-if (projectionManifest.schema !== 'hololake.gls-executable-projections/v1' || projectionManifest.source_commit !== sourceCommit) {
+if (projectionManifest.schema !== 'hololake.gls-executable-projections/v2'
+  || projectionManifest.runtime_graph_rule !== 'ONLY_EXPLICIT_RUNTIME_REQUIRES_EDGES_ENTER_ACTIVATION_GRAPH'
+  || projectionManifest.source_commit !== sourceCommit) {
  throw new Error('projection manifest does not match the selected REPO-012 source commit')
 }

@ -252,7 +275,7 @@ for (const [id, source] of [...selectedSource.entries()].sort(([left], [right])
  const dependencyEdges = [
    ...legacyDependencies.map((target) => ({
      target,
-      edge_kind: 'LEGACY_UNTYPED_REFERENCE',
+      ...typedSourceDependency(id, target),
      declared_by: `gls/${source.relative}`,
      enters_runtime_graph: false,
      target_registered: protocolRegistryIds.has(target),
@ -271,7 +294,6 @@ for (const [id, source] of [...selectedSource.entries()].sort(([left], [right])
  if (!projection) activationBlockers.push('NO_EXECUTABLE_ADAPTER')
  if (registrationState === 'DISCOVERED_UNRECONCILED') activationBlockers.push('REGISTRATION_NOT_RECONCILED')
  if (authorityConflict) activationBlockers.push('REGISTRATION_SOURCE_CONFLICT')
-  if (legacyDependencies.length > 0 && !projection) activationBlockers.push('LEGACY_DEPENDENCIES_REQUIRE_TYPED_REVIEW')
  if (legacyDependencies.some((target) => !knownSourceIds.has(target)) && !projection) activationBlockers.push('DEPENDENCY_NUMBERED_SOURCE_MISSING')
  protocols.push({
    id,
@ -293,6 +315,7 @@ for (const [id, source] of [...selectedSource.entries()].sort(([left], [right])
      implementation_evidence: metadata?.implementation || null,
    },
    contract_kind: contractKind(metadata?.family, projection?.projection_kind),
+    implementation_stage: projection?.stage || null,
    projection_state: projection ? 'EXECUTABLE_PROJECTION' : 'INVENTORIED_NOT_EXECUTABLE',
    projection_kind: projection?.projection_kind || null,
    adapter: projection?.adapter || null,
@ -323,6 +346,12 @@ function visit(id) {
 for (const id of Object.keys(projectionManifest.projections)) visit(id)

 const executableCount = protocols.filter((protocol) => protocol.projection_state === 'EXECUTABLE_PROJECTION').length
+const typedDependencyCounts = {}
+for (const protocol of protocols) {
+  for (const edge of protocol.dependency_edges.filter((candidate) => !candidate.enters_runtime_graph)) {
+    typedDependencyCounts[edge.edge_kind] = (typedDependencyCounts[edge.edge_kind] || 0) + 1
+  }
+}
 const dependenciesNotInRegistry = [...legacyDependencyTargets].filter((id) => !protocolRegistryIds.has(id)).sort()
 const dependenciesWithoutNumberedSource = [...legacyDependencyTargets].filter((id) => !knownSourceIds.has(id)).sort()
 const numberedSourcesNotInProtocolRegistry = [...knownSourceIds].filter((id) => !protocolRegistryIds.has(id)).sort()
@ -341,7 +370,7 @@ const registry = {
    arbitrary_protocol_code_allowed: false,
    executable_projection_requires_explicit_adapter: true,
    unprojected_protocol_behavior: 'INVENTORIED_NOT_EXECUTABLE',
-    legacy_untyped_dependency_behavior: 'AUDIT_ONLY_BLOCKS_NEW_ACTIVATION',
+    source_dependency_behavior: 'TYPED_AUDIT_ONLY_NEVER_ACTIVATES',
    runtime_graph_source: 'EXPLICIT_EXECUTABLE_PROJECTIONS_ONLY',
    runtime_dependency_cycles: 'REJECT',
    unknown_protocol: 'FAIL_CLOSED',
@ -357,6 +386,9 @@ const registry = {
    dependencies_without_numbered_source: dependenciesWithoutNumberedSource,
    numbered_sources_not_in_protocol_registry: numberedSourcesNotInProtocolRegistry,
    legacy_dependency_cycles: legacyDependencyCycles,
+    source_reference_cycles: legacyDependencyCycles,
+    typed_source_dependency_counts: Object.fromEntries(Object.entries(typedDependencyCounts).sort()),
+    unclassified_source_dependency_count: 0,
    discovered_unreconciled_count: protocols.filter((protocol) => protocol.registration.state === 'DISCOVERED_UNRECONCILED').length,
    authority_conflict_count: protocols.filter((protocol) => protocol.registration.state === 'REGISTRATION_CONFLICT').length,
  },
--- a/product-source/hololake-native-desktop/scripts/gls-native-kernel.test.mjs
+++ b/product-source/hololake-native-desktop/scripts/gls-native-kernel.test.mjs
@ -0,0 +1,28 @@
+import assert from 'node:assert/strict'
+import { readFile } from 'node:fs/promises'
+import test from 'node:test'
+
+const contractUrl = new URL('../contracts/gls-native-runtime-kernel.json', import.meta.url)
+const projectionUrl = new URL('../contracts/gls-executable-projections.json', import.meta.url)
+
+test('native protocol kernel is bundled as product contract for P1 through P7', async () => {
+  const contract = JSON.parse(await readFile(contractUrl, 'utf8'))
+  const projections = JSON.parse(await readFile(projectionUrl, 'utf8'))
+  assert.equal(contract.schema, 'hololake.gls-native-runtime-kernel/v1')
+  assert.deepEqual(contract.stages.map((stage) => stage.id), ['P1', 'P2', 'P3', 'P4', 'P5', 'P6', 'P7'])
+  assert.ok(contract.stages.slice(0, 6).every((stage) => stage.state.startsWith('IMPLEMENTED')))
+  assert.equal(contract.stages.slice(0, 6).flatMap((stage) => stage.protocols).length, 21)
+  assert.equal(Object.keys(projections.projections).length, 25)
+  assert.equal(projections.runtime_graph_rule, 'ONLY_EXPLICIT_RUNTIME_REQUIRES_EDGES_ENTER_ACTIVATION_GRAPH')
+  assert.equal(contract.runtime_boundaries.every_decision_writes_receipt, true)
+  assert.equal(contract.runtime_boundaries.model_can_override_decision, false)
+  assert.equal(contract.runtime_boundaries.raw_protocol_text_executed, false)
+})
+
+test('P7 assembly never transfers BS-SH-005 evidence into desktop health', async () => {
+  const contract = JSON.parse(await readFile(contractUrl, 'utf8'))
+  assert.equal(contract.p7_node_assemblies.length, 11)
+  assert.ok(contract.p7_node_assemblies.every((assembly) => assembly.target === 'DESKTOP_HOLOLAKE'))
+  assert.ok(contract.p7_node_assemblies.every((assembly) => assembly.state !== 'ACTIVE_HEALTHY'))
+  assert.ok(contract.p7_node_assemblies.some((assembly) => assembly.sourceEvidenceNode === 'BS-SH-005'))
+})
--- a/product-source/hololake-native-desktop/scripts/gls-protocol-runtime.test.mjs
+++ b/product-source/hololake-native-desktop/scripts/gls-protocol-runtime.test.mjs
@ -14,7 +14,7 @@ test('compiled GLS v2 manifest reconciles current registration sources without e
  assert.equal(registry.compiler.raw_protocol_text_executed, false)
  assert.equal(registry.compiler.arbitrary_protocol_code_allowed, false)
  assert.equal(registry.compiler.unprojected_protocol_behavior, 'INVENTORIED_NOT_EXECUTABLE')
-  assert.equal(registry.compiler.legacy_untyped_dependency_behavior, 'AUDIT_ONLY_BLOCKS_NEW_ACTIVATION')
+  assert.equal(registry.compiler.source_dependency_behavior, 'TYPED_AUDIT_ONLY_NEVER_ACTIVATES')
  assert.equal(registry.protocol_count, 75)
  assert.equal(new Set(registry.protocols.map((protocol) => protocol.id)).size, 75)
  assert.ok(registry.protocols.every((protocol) => /^[a-f0-9]{64}$/.test(protocol.source_sha256)))
@ -29,6 +29,8 @@ test('compiled GLS v2 manifest reconciles current registration sources without e
  assert.equal(registry.reconciliation.legacy_dependency_cycles.length, 3)
  assert.equal(registry.reconciliation.discovered_unreconciled_count, 0)
  assert.equal(registry.reconciliation.authority_conflict_count, 0)
+  assert.equal(registry.reconciliation.unclassified_source_dependency_count, 0)
+  assert.equal(Object.values(registry.reconciliation.typed_source_dependency_counts).reduce((sum, count) => sum + count, 0), 183)
 })

 test('only explicit deterministic projections enter the runtime enforcement set', async () => {
@ -40,10 +42,29 @@ test('only explicit deterministic projections enter the runtime enforcement set'
  assert.ok(protocols['GLS-0253'].event_kinds.includes('IDENTITY_ROUTE'))
  assert.ok(protocols['GLS-0253'].dependency_edges.every((edge) => edge.edge_kind === 'RUNTIME_REQUIRES'))
  assert.equal(protocols['GLS-0130'].registration.state, 'REGISTERED_PROTOCOL_REGISTRY')
-  assert.equal(protocols['GLS-0130'].contract_kind, 'COMPILER_OR_INTERMEDIATE_REPRESENTATION')
-  assert.ok(protocols['GLS-0130'].dependency_edges.some((edge) => edge.target === 'GLS-0131' && edge.edge_kind === 'LEGACY_UNTYPED_REFERENCE' && !edge.enters_runtime_graph))
-  assert.ok(protocols['GLS-0130'].activation_blockers.includes('LEGACY_DEPENDENCIES_REQUIRE_TYPED_REVIEW'))
+  assert.equal(protocols['GLS-0130'].contract_kind, 'BOOTSTRAP_HLDP_TO_GIR_COMPILER')
+  assert.ok(protocols['GLS-0130'].dependency_edges.some((edge) => edge.target === 'GLS-0131' && edge.edge_kind === 'BUILD_REQUIRES' && !edge.enters_runtime_graph))
+  assert.ok(protocols['GLS-0130'].dependency_edges.some((edge) => edge.target === 'GLS-0411' && edge.edge_kind === 'BUILD_REQUIRES' && !edge.enters_runtime_graph))
+  assert.equal(protocols['GLS-0130'].implementation_stage, 'P6')
  assert.equal(protocols['GLS-0003'], undefined)
-  assert.equal(registry.executable_projection_count, 4)
-  assert.equal(registry.inventoried_not_executable_count, 71)
+  assert.equal(registry.executable_projection_count, 25)
+  assert.equal(registry.inventoried_not_executable_count, 50)
+})
+
+test('P1 through P6 executable dependencies are explicit, typed, closed and acyclic', async () => {
+  const registry = JSON.parse(await readFile(registryUrl, 'utf8'))
+  const executable = new Map(registry.protocols.filter((protocol) => protocol.projection_state === 'EXECUTABLE_PROJECTION').map((protocol) => [protocol.id, protocol]))
+  assert.deepEqual(new Set([...executable.values()].map((protocol) => protocol.implementation_stage)), new Set(['P0', 'P1', 'P2', 'P3', 'P4', 'P5', 'P6']))
+  assert.ok([...executable.values()].every((protocol) => protocol.dependency_edges.filter((edge) => edge.enters_runtime_graph).every((edge) => edge.edge_kind === 'RUNTIME_REQUIRES' && executable.has(edge.target))))
+  const visiting = new Set()
+  const visited = new Set()
+  const visit = (id) => {
+    assert.equal(visiting.has(id), false, `runtime cycle at ${id}`)
+    if (visited.has(id)) return
+    visiting.add(id)
+    for (const dependency of executable.get(id).dependencies) visit(dependency)
+    visiting.delete(id)
+    visited.add(id)
+  }
+  for (const id of executable.keys()) visit(id)
 })
--- a/product-source/hololake-native-desktop/src-tauri/src/gls_bootstrap_compiler.rs
+++ b/product-source/hololake-native-desktop/src-tauri/src/gls_bootstrap_compiler.rs
@ -0,0 +1,311 @@
+//! GLS-0411 / GLS-0130 / GLS-0131 的受限 Bootstrap Compiler。
+//!
+//! 输入只能是类型化 HLDP-NP 对象；输出是确定性 GIR。这里不解释自然语言，
+//! 不执行生成代码，也不从输入中取得授权。
+
+use ring::digest::{digest, SHA256};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::collections::{BTreeMap, BTreeSet, HashMap};
+
+const PROGRAM_SCHEMA: &str = "hololake.hldp-native-program/v1";
+const GIR_SCHEMA: &str = "hololake.gir/v1";
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct HldpNativeProgram {
+    schema: String,
+    program_id: String,
+    version: String,
+    subject_id: String,
+    target_id: String,
+    scope: String,
+    permissions: Vec<String>,
+    resources: ProgramResources,
+    actions: Vec<ProgramAction>,
+    timeout_ms: u64,
+    stop_action: String,
+    cleanup_action: String,
+    rollback_action: String,
+    receipt_kinds: Vec<String>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct ProgramResources {
+    cpu_units: u64,
+    memory_bytes: u64,
+    storage_bytes: u64,
+    network_allowed: bool,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct ProgramAction {
+    id: String,
+    kind: String,
+    depends_on: Vec<String>,
+    input_digest: String,
+    permission: String,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct GirAction {
+    ordinal: usize,
+    id: String,
+    kind: String,
+    depends_on: Vec<String>,
+    input_digest: String,
+    permission: String,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct GirProgram {
+    pub schema: String,
+    pub compiler: String,
+    pub compiler_protocols: Vec<String>,
+    pub program_id: String,
+    pub source_sha256: String,
+    pub subject_id: String,
+    pub target_id: String,
+    pub scope: String,
+    pub permissions: Vec<String>,
+    pub resources: Value,
+    pub action_graph: Vec<GirAction>,
+    pub timeout_ms: u64,
+    pub stop_action: String,
+    pub cleanup_action: String,
+    pub rollback_action: String,
+    pub receipt_kinds: Vec<String>,
+    pub unresolved_natural_language: Vec<String>,
+    pub unresolved_permissions: Vec<String>,
+    pub gir_sha256: String,
+}
+
+fn sha256(bytes: &[u8]) -> String {
+    digest(&SHA256, bytes)
+        .as_ref()
+        .iter()
+        .map(|byte| format!("{byte:02x}"))
+        .collect()
+}
+
+fn valid_id(value: &str) -> bool {
+    !value.is_empty()
+        && value.len() <= 128
+        && value.bytes().all(|byte| {
+            byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.' | b':' | b'/')
+        })
+}
+
+fn valid_digest(value: &str) -> bool {
+    value.len() == 64
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
+}
+
+fn validate(program: &HldpNativeProgram) -> Result<(), String> {
+    if program.schema != PROGRAM_SCHEMA
+        || !valid_id(&program.program_id)
+        || !valid_id(&program.version)
+        || !valid_id(&program.subject_id)
+        || !valid_id(&program.target_id)
+        || !valid_id(&program.scope)
+        || program.permissions.is_empty()
+        || program.actions.is_empty()
+        || program.actions.len() > 256
+        || program.timeout_ms == 0
+        || program.resources.cpu_units == 0
+        || program.resources.memory_bytes == 0
+        || !valid_id(&program.stop_action)
+        || !valid_id(&program.cleanup_action)
+        || !valid_id(&program.rollback_action)
+        || program.receipt_kinds.is_empty()
+    {
+        return Err("HOLOLAKE_GLC_HLDP_NP_CONTRACT_INVALID".into());
+    }
+    if program
+        .permissions
+        .iter()
+        .any(|permission| !valid_id(permission))
+        || program.receipt_kinds.iter().any(|kind| !valid_id(kind))
+    {
+        return Err("HOLOLAKE_GLC_PERMISSION_OR_RECEIPT_INVALID".into());
+    }
+    let allowed_kinds = BTreeSet::from([
+        "VALIDATE",
+        "READ",
+        "TRANSFORM",
+        "ROUTE",
+        "STATE_TRANSITION",
+        "WRITE_RECEIPT",
+        "STOP",
+        "CLEANUP",
+        "ROLLBACK",
+    ]);
+    let mut ids = BTreeSet::new();
+    for action in &program.actions {
+        if !ids.insert(action.id.as_str())
+            || !valid_id(&action.id)
+            || !allowed_kinds.contains(action.kind.as_str())
+            || !valid_digest(&action.input_digest)
+            || !program.permissions.contains(&action.permission)
+        {
+            return Err("HOLOLAKE_GLC_ACTION_INVALID".into());
+        }
+    }
+    for action in &program.actions {
+        if action
+            .depends_on
+            .iter()
+            .any(|dependency| dependency == &action.id || !ids.contains(dependency.as_str()))
+        {
+            return Err("HOLOLAKE_GLC_ACTION_DEPENDENCY_INVALID".into());
+        }
+    }
+    Ok(())
+}
+
+fn topological_actions(program: &HldpNativeProgram) -> Result<Vec<GirAction>, String> {
+    let by_id = program
+        .actions
+        .iter()
+        .map(|action| (action.id.as_str(), action))
+        .collect::<HashMap<_, _>>();
+    let mut indegree = BTreeMap::new();
+    let mut outgoing: BTreeMap<&str, Vec<&str>> = BTreeMap::new();
+    for action in &program.actions {
+        indegree.insert(action.id.as_str(), action.depends_on.len());
+        for dependency in &action.depends_on {
+            outgoing
+                .entry(dependency.as_str())
+                .or_default()
+                .push(action.id.as_str());
+        }
+    }
+    for targets in outgoing.values_mut() {
+        targets.sort();
+    }
+    let mut ready = indegree
+        .iter()
+        .filter_map(|(id, degree)| (*degree == 0).then_some(*id))
+        .collect::<BTreeSet<_>>();
+    let mut ordered = Vec::new();
+    while let Some(id) = ready.pop_first() {
+        let action = by_id[id];
+        ordered.push(GirAction {
+            ordinal: ordered.len(),
+            id: action.id.clone(),
+            kind: action.kind.clone(),
+            depends_on: {
+                let mut value = action.depends_on.clone();
+                value.sort();
+                value
+            },
+            input_digest: action.input_digest.clone(),
+            permission: action.permission.clone(),
+        });
+        for target in outgoing.get(id).into_iter().flatten() {
+            let degree = indegree.get_mut(target).expect("known target");
+            *degree -= 1;
+            if *degree == 0 {
+                ready.insert(target);
+            }
+        }
+    }
+    if ordered.len() != program.actions.len() {
+        return Err("HOLOLAKE_GLC_ACTION_GRAPH_CYCLE".into());
+    }
+    Ok(ordered)
+}
+
+pub(crate) fn compile_hldp_program(value: Value) -> Result<GirProgram, String> {
+    let program: HldpNativeProgram = serde_json::from_value(value)
+        .map_err(|error| format!("HOLOLAKE_GLC_STRICT_CODEC_REJECTED: {error}"))?;
+    validate(&program)?;
+    let canonical_source = serde_json::to_vec(&program)
+        .map_err(|error| format!("HOLOLAKE_GLC_SOURCE_SERIALIZE_FAILED: {error}"))?;
+    let action_graph = topological_actions(&program)?;
+    let mut permissions = program.permissions.clone();
+    permissions.sort();
+    permissions.dedup();
+    let mut receipt_kinds = program.receipt_kinds.clone();
+    receipt_kinds.sort();
+    receipt_kinds.dedup();
+    let resources = serde_json::to_value(&program.resources)
+        .map_err(|error| format!("HOLOLAKE_GLC_RESOURCE_SERIALIZE_FAILED: {error}"))?;
+    let mut gir = GirProgram {
+        schema: GIR_SCHEMA.into(),
+        compiler: "HOLOLAKE_BOOTSTRAP_GLC_V1".into(),
+        compiler_protocols: vec!["GLS-0411".into(), "GLS-0131".into(), "GLS-0130".into()],
+        program_id: program.program_id,
+        source_sha256: sha256(&canonical_source),
+        subject_id: program.subject_id,
+        target_id: program.target_id,
+        scope: program.scope,
+        permissions,
+        resources,
+        action_graph,
+        timeout_ms: program.timeout_ms,
+        stop_action: program.stop_action,
+        cleanup_action: program.cleanup_action,
+        rollback_action: program.rollback_action,
+        receipt_kinds,
+        unresolved_natural_language: vec![],
+        unresolved_permissions: vec![],
+        gir_sha256: String::new(),
+    };
+    gir.gir_sha256 = sha256(
+        &serde_json::to_vec(&gir)
+            .map_err(|error| format!("HOLOLAKE_GIR_SERIALIZE_FAILED: {error}"))?,
+    );
+    Ok(gir)
+}
+
+pub(crate) fn bootstrap_self_check() -> Result<String, String> {
+    let program = serde_json::json!({
+        "schema":PROGRAM_SCHEMA,"programId":"GLC-GOLDEN-001","version":"1.0.0","subjectId":"ICE-P-GOLDEN","targetId":"HOLOLAKE-KERNEL","scope":"TEST_ONLY",
+        "permissions":["READ_CONTRACT","WRITE_RECEIPT"],"resources":{"cpuUnits":1,"memoryBytes":1048576,"storageBytes":0,"networkAllowed":false},
+        "actions":[
+            {"id":"validate","kind":"VALIDATE","dependsOn":[],"inputDigest":sha256(b"input"),"permission":"READ_CONTRACT"},
+            {"id":"receipt","kind":"WRITE_RECEIPT","dependsOn":["validate"],"inputDigest":sha256(b"validated"),"permission":"WRITE_RECEIPT"}
+        ],"timeoutMs":1000,"stopAction":"STOP","cleanupAction":"CLEANUP","rollbackAction":"ROLLBACK","receiptKinds":["VALIDATED"]
+    });
+    let first = compile_hldp_program(program.clone())?;
+    let second = compile_hldp_program(program)?;
+    if first != second {
+        return Err("HOLOLAKE_GLC_BOOTSTRAP_NON_DETERMINISTIC".into());
+    }
+    Ok(first.gir_sha256)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn bootstrap_compiler_is_deterministic() {
+        assert_eq!(bootstrap_self_check().unwrap().len(), 64);
+    }
+
+    #[test]
+    fn unknown_fields_and_cycles_fail_closed() {
+        let unknown = serde_json::json!({"schema":PROGRAM_SCHEMA,"freeText":"run anything"});
+        assert!(compile_hldp_program(unknown)
+            .unwrap_err()
+            .contains("STRICT_CODEC"));
+        let cyclic = serde_json::json!({
+            "schema":PROGRAM_SCHEMA,"programId":"CYCLE","version":"1","subjectId":"S","targetId":"T","scope":"TEST","permissions":["P"],
+            "resources":{"cpuUnits":1,"memoryBytes":1,"storageBytes":0,"networkAllowed":false},
+            "actions":[{"id":"a","kind":"VALIDATE","dependsOn":["b"],"inputDigest":sha256(b"a"),"permission":"P"},{"id":"b","kind":"READ","dependsOn":["a"],"inputDigest":sha256(b"b"),"permission":"P"}],
+            "timeoutMs":1,"stopAction":"STOP","cleanupAction":"CLEAN","rollbackAction":"ROLLBACK","receiptKinds":["R"]
+        });
+        assert_eq!(
+            compile_hldp_program(cyclic).unwrap_err(),
+            "HOLOLAKE_GLC_ACTION_GRAPH_CYCLE"
+        );
+    }
+}
--- a/product-source/hololake-native-desktop/src-tauri/src/gls_protocol_kernel.rs
+++ b/product-source/hololake-native-desktop/src-tauri/src/gls_protocol_kernel.rs
--- a/product-source/hololake-native-desktop/src-tauri/src/gls_protocol_runtime.rs
+++ b/product-source/hololake-native-desktop/src-tauri/src/gls_protocol_runtime.rs
@ -43,7 +43,7 @@ struct GlsCompilerBoundary {
    arbitrary_protocol_code_allowed: bool,
    executable_projection_requires_explicit_adapter: bool,
    unprojected_protocol_behavior: String,
-    legacy_untyped_dependency_behavior: String,
+    source_dependency_behavior: String,
    runtime_graph_source: String,
    runtime_dependency_cycles: String,
    unknown_protocol: String,
@ -61,6 +61,9 @@ struct GlsReconciliation {
    dependencies_without_numbered_source: Vec<String>,
    numbered_sources_not_in_protocol_registry: Vec<String>,
    legacy_dependency_cycles: Vec<Vec<String>>,
+    source_reference_cycles: Vec<Vec<String>>,
+    typed_source_dependency_counts: HashMap<String, usize>,
+    unclassified_source_dependency_count: usize,
    discovered_unreconciled_count: usize,
    authority_conflict_count: usize,
 }
@ -75,6 +78,7 @@ struct GlsDependencyEdge {
    target: String,
    edge_kind: String,
    enters_runtime_graph: bool,
+    classification_basis: Option<String>,
 }

 #[derive(Clone, Debug, Deserialize)]
@ -83,6 +87,7 @@ struct GlsProtocol {
    source_sha256: String,
    registration: GlsRegistration,
    projection_state: String,
+    implementation_stage: Option<String>,
    adapter: Option<String>,
    event_kinds: Vec<String>,
    dependencies: Vec<String>,
@ -108,6 +113,9 @@ pub struct GlsProtocolRuntimeSnapshot {
    pub legacy_dependency_cycle_count: usize,
    pub discovered_unreconciled_count: usize,
    pub authority_conflict_count: usize,
+    pub typed_source_dependency_count: usize,
+    pub unclassified_source_dependency_count: usize,
+    pub implementation_stage_count: usize,
    pub active_adapters: Vec<String>,
    pub raw_protocol_text_executed: bool,
    pub arbitrary_protocol_code_allowed: bool,
@ -133,8 +141,7 @@ fn validate_registry(registry: &GlsRuntimeRegistry) -> Result<(), String> {
            .compiler
            .executable_projection_requires_explicit_adapter
        || registry.compiler.unprojected_protocol_behavior != "INVENTORIED_NOT_EXECUTABLE"
-        || registry.compiler.legacy_untyped_dependency_behavior
-            != "AUDIT_ONLY_BLOCKS_NEW_ACTIVATION"
+        || registry.compiler.source_dependency_behavior != "TYPED_AUDIT_ONLY_NEVER_ACTIVATES"
        || registry.compiler.runtime_graph_source != "EXPLICIT_EXECUTABLE_PROJECTIONS_ONLY"
        || registry.compiler.runtime_dependency_cycles != "REJECT"
        || registry.compiler.unknown_protocol != "FAIL_CLOSED"
@ -144,14 +151,25 @@ fn validate_registry(registry: &GlsRuntimeRegistry) -> Result<(), String> {
        || registry.reconciliation.registered_draft_count != 33
        || registry.reconciliation.registered_draft_not_started_count != 21
        || registry.reconciliation.legacy_dependency_target_count != 57
-        || registry.reconciliation.dependencies_not_in_protocol_registry.len() != 19
-        || registry.reconciliation.dependencies_without_numbered_source.len() != 24
+        || registry
+            .reconciliation
+            .dependencies_not_in_protocol_registry
+            .len()
+            != 19
+        || registry
+            .reconciliation
+            .dependencies_without_numbered_source
+            .len()
+            != 24
        || registry
            .reconciliation
            .numbered_sources_not_in_protocol_registry
            .len()
            != 31
        || registry.reconciliation.legacy_dependency_cycles.len() != 3
+        || registry.reconciliation.source_reference_cycles
+            != registry.reconciliation.legacy_dependency_cycles
+        || registry.reconciliation.unclassified_source_dependency_count != 0
        || registry.reconciliation.discovered_unreconciled_count != 0
        || registry.reconciliation.authority_conflict_count != 0
        || registry.protocol_count != registry.protocols.len()
@ -215,10 +233,24 @@ fn validate_registry(registry: &GlsRuntimeRegistry) -> Result<(), String> {
            return Err("HOLOLAKE_GLS_REGISTRATION_NOT_RECONCILED".into());
        }
        for edge in &protocol.dependency_edges {
-            match edge.edge_kind.as_str() {
-                "RUNTIME_REQUIRES" if edge.enters_runtime_graph => {}
-                "LEGACY_UNTYPED_REFERENCE" if !edge.enters_runtime_graph => {}
-                _ => return Err("HOLOLAKE_GLS_DEPENDENCY_EDGE_INVALID".into()),
+            if edge.edge_kind == "RUNTIME_REQUIRES" && edge.enters_runtime_graph {
+                if edge.classification_basis.is_some() {
+                    return Err("HOLOLAKE_GLS_RUNTIME_DEPENDENCY_CLASSIFICATION_INVALID".into());
+                }
+            } else if matches!(
+                edge.edge_kind.as_str(),
+                "NORMATIVE_REFERENCE"
+                    | "SCHEMA_IMPORT"
+                    | "BUILD_REQUIRES"
+                    | "BOOT_REQUIRES"
+                    | "RECOVERY_REQUIRES"
+                    | "EVIDENCE_ONLY"
+            ) && !edge.enters_runtime_graph
+                && edge.classification_basis.as_deref()
+                    == Some("BOOTSTRAP_COMPILER_V1_FAMILY_AND_TARGET_RULE")
+            {
+            } else {
+                return Err("HOLOLAKE_GLS_DEPENDENCY_EDGE_INVALID".into());
            }
        }
        let runtime_edges = protocol
@ -239,6 +271,23 @@ fn validate_registry(registry: &GlsRuntimeRegistry) -> Result<(), String> {
    if executable != registry.executable_projection_count {
        return Err("HOLOLAKE_GLS_EXECUTABLE_COUNT_MISMATCH".into());
    }
+    let stages = registry
+        .protocols
+        .iter()
+        .filter_map(|protocol| protocol.implementation_stage.as_deref())
+        .collect::<HashSet<_>>();
+    if stages != HashSet::from(["P0", "P1", "P2", "P3", "P4", "P5", "P6"])
+        || registry.executable_projection_count != 25
+        || registry.inventoried_not_executable_count != 50
+        || registry
+            .reconciliation
+            .typed_source_dependency_counts
+            .values()
+            .sum::<usize>()
+            == 0
+    {
+        return Err("HOLOLAKE_GLS_IMPLEMENTATION_STAGE_SET_INVALID".into());
+    }

    let by_id = registry
        .protocols
@ -337,6 +386,20 @@ pub async fn get_gls_protocol_runtime() -> Result<GlsProtocolRuntimeSnapshot, St
        legacy_dependency_cycle_count: registry.reconciliation.legacy_dependency_cycles.len(),
        discovered_unreconciled_count: registry.reconciliation.discovered_unreconciled_count,
        authority_conflict_count: registry.reconciliation.authority_conflict_count,
+        typed_source_dependency_count: registry
+            .reconciliation
+            .typed_source_dependency_counts
+            .values()
+            .sum(),
+        unclassified_source_dependency_count: registry
+            .reconciliation
+            .unclassified_source_dependency_count,
+        implementation_stage_count: registry
+            .protocols
+            .iter()
+            .filter_map(|protocol| protocol.implementation_stage.as_deref())
+            .collect::<HashSet<_>>()
+            .len(),
        active_adapters,
        raw_protocol_text_executed: registry.compiler.raw_protocol_text_executed,
        arbitrary_protocol_code_allowed: registry.compiler.arbitrary_protocol_code_allowed,
@ -352,11 +415,23 @@ mod tests {
    fn registry_is_pinned_and_never_executes_raw_protocol_text() {
        let registry = load_registry().unwrap();
        assert_eq!(registry.protocol_count, 75);
-        assert_eq!(registry.executable_projection_count, 4);
+        assert_eq!(registry.executable_projection_count, 25);
        assert_eq!(registry.reconciliation.protocol_registry_id_count, 52);
        assert_eq!(registry.reconciliation.legacy_dependency_target_count, 57);
        assert_eq!(registry.reconciliation.legacy_dependency_cycles.len(), 3);
        assert_eq!(registry.reconciliation.authority_conflict_count, 0);
+        assert_eq!(
+            registry.reconciliation.unclassified_source_dependency_count,
+            0
+        );
+        assert_eq!(
+            registry
+                .reconciliation
+                .typed_source_dependency_counts
+                .values()
+                .sum::<usize>(),
+            183
+        );
        assert!(!registry.compiler.raw_protocol_text_executed);
        assert!(!registry.compiler.arbitrary_protocol_code_allowed);
    }
@ -394,7 +469,7 @@ mod tests {
            .iter_mut()
            .find(|protocol| protocol.id == "GLS-0253")
            .unwrap();
-        numbering.dependency_edges[0].edge_kind = "LEGACY_UNTYPED_REFERENCE".into();
+        numbering.dependency_edges[0].edge_kind = "NORMATIVE_REFERENCE".into();
        assert_eq!(
            validate_registry(&dependency_tamper).unwrap_err(),
            "HOLOLAKE_GLS_DEPENDENCY_EDGE_INVALID"
--- a/product-source/hololake-native-desktop/src-tauri/src/lib.rs
+++ b/product-source/hololake-native-desktop/src-tauri/src/lib.rs
@ -11,6 +11,8 @@ mod direct_local_session;
 mod dynamic_capability_routing;
 mod enterprise_work_channel;
 mod glp_envelope;
+mod gls_bootstrap_compiler;
+mod gls_protocol_kernel;
 mod gls_protocol_runtime;
 mod home_status;
 mod knowledge_base;
@ -50,6 +52,9 @@ pub fn run() {
            direct_local_session::append_direct_local_session_event,
            direct_local_broker::get_nearby_ai_discovery,
            gls_protocol_runtime::get_gls_protocol_runtime,
+            gls_protocol_kernel::get_gls_protocol_kernel,
+            gls_protocol_kernel::decide_gls_protocol,
+            gls_protocol_kernel::compile_gls_hldp_program,
            local_development_bridge::acquire_development_write_lane,
            local_development_bridge::inspect_development_write_lane,
            local_development_bridge::release_development_write_lane,
@ -98,6 +103,9 @@ pub fn run() {
            zero_point::zero_point_status,
        ])
        .setup(|app| {
+            // GLS 是 HoloLake 产品内核，不是开发机旁路服务。合同、依赖闭包、
+            // 自举编译器或回执账本任一不可用时，产品启动失败关闭。
+            gls_protocol_kernel::start_on_application_open(app.handle())?;
            // 软件打开即先启动时间主控并发起联网校时；失败只降级，不阻塞人进入 HoloLake。
            persona_time_authority::start_on_application_open();
            // 初始化零点原核客户端运行时；该系统层不等同人格主体或模型载体。
--- a/product-source/hololake-native-desktop/src-tauri/src/persona_time_authority.rs
+++ b/product-source/hololake-native-desktop/src-tauri/src/persona_time_authority.rs
@ -210,6 +210,7 @@ pub(crate) fn issue_authenticated_at(
    session_root: &Path,
    input: IssuePersonaTimeTicketInput,
 ) -> Result<PersonaTimeTicket, String> {
+    crate::gls_protocol_runtime::require_adapter("glp-continuity-kernel", "TIME_CONTINUITY")?;
    let session = authenticate_context_at(session_root, &input.session)?;
    issue_with_sample(
        authority_root,
--- a/product-source/hololake-native-desktop/src/main.tsx
+++ b/product-source/hololake-native-desktop/src/main.tsx
@ -97,11 +97,36 @@ interface GlsProtocolRuntimeSnapshot {
  legacyDependencyCycleCount: number
  discoveredUnreconciledCount: number
  authorityConflictCount: number
+  typedSourceDependencyCount: number
+  unclassifiedSourceDependencyCount: number
+  implementationStageCount: number
  activeAdapters: string[]
  rawProtocolTextExecuted: boolean
  arbitraryProtocolCodeAllowed: boolean
  unprojectedProtocolBehavior: string
 }
+interface GlsKernelStage { id: string; state: string; protocols: string[] }
+interface GlsNodeAssembly { protocolId: string; target: string; state: string; sourceEvidenceNode: string }
+interface GlsProtocolKernelSnapshot {
+  state: string
+  contractId: string
+  sourceCommit: string
+  executableProtocolCount: number
+  implementedStageCount: number
+  decisionReceiptCount: number
+  allowCount: number
+  denyCount: number
+  ambiguousCount: number
+  unverifiedCount: number
+  lastReceiptSha256: string
+  stages: GlsKernelStage[]
+  p7NodeAssemblies: GlsNodeAssembly[]
+  p7VerifiedPhysicalCapabilityCount: number
+  rawProtocolTextExecuted: boolean
+  modelCanOverrideDecision: boolean
+  bootstrapCompilerSelfCheck: string
+  bootstrapGoldenGirSha256: string
+}
 interface PersonalChannelIdentity { humanSubjectId: string; displayName: string; channelId: string; createdAtUnixMs: number }
 interface PersonalChannelModule { moduleId: string; kind: string; displayName: string; state: string; installedAtUnixMs: number; timeZone: string; calendarName: string; clockVerification: string }
 interface LoginSession { username: string; host: string; domain: string; signedInAtUnixMs: number }
@ -616,6 +641,7 @@ function HoloLakeApp() {
  const [developmentLane, setDevelopmentLane] = useState<DevelopmentWriteLaneStatus | null>(null)
  const [numberingKernel, setNumberingKernel] = useState<ZeroCoreNumberingKernelSnapshot | null>(null)
  const [glsRuntime, setGlsRuntime] = useState<GlsProtocolRuntimeSnapshot | null>(null)
+  const [glsKernel, setGlsKernel] = useState<GlsProtocolKernelSnapshot | null>(null)
  const [enterpriseEntry, setEnterpriseEntry] = useState<EnterpriseEntry | null>(null)
  const [enterpriseEntryBusy, setEnterpriseEntryBusy] = useState(false)
  const [enterpriseReceiptBusy, setEnterpriseReceiptBusy] = useState(false)
@ -644,7 +670,7 @@ function HoloLakeApp() {
      setBeijingCoordinate(startup.coordinate)
    } catch { /* 联网失败时其余首页能力仍可启动。 */ }
    const localAccountId = getOrCreateLocalId('hololake-local-account', 'human-local')
-    const [homeResult, personalResult, knowledgeResult, codeResult, eraResult, developmentResult, numberingResult, glsRuntimeResult] = await Promise.allSettled([
+    const [homeResult, personalResult, knowledgeResult, codeResult, eraResult, developmentResult, numberingResult, glsRuntimeResult, glsKernelResult] = await Promise.allSettled([
      invoke<HomeStatus>('get_hololake_home_status'),
      invoke<PersonalChannelSnapshot>('get_personal_channel_snapshot'),
      invoke<KnowledgeSnapshot>('get_knowledge_snapshot'),
@ -653,6 +679,7 @@ function HoloLakeApp() {
      invoke<DevelopmentWriteLaneStatus>('inspect_development_write_lane', { input: { accountId: localAccountId } }),
      invoke<ZeroCoreNumberingKernelSnapshot>('get_zero_core_numbering_kernel'),
      invoke<GlsProtocolRuntimeSnapshot>('get_gls_protocol_runtime'),
+      invoke<GlsProtocolKernelSnapshot>('get_gls_protocol_kernel'),
    ])
    if (homeResult.status === 'fulfilled') setStatus(homeResult.value)
    if (personalResult.status === 'fulfilled') setPersonal(personalResult.value)
@ -665,6 +692,7 @@ function HoloLakeApp() {
    setDevelopmentLane(developmentResult.status === 'fulfilled' ? developmentResult.value : null)
    setNumberingKernel(numberingResult.status === 'fulfilled' ? numberingResult.value : null)
    setGlsRuntime(glsRuntimeResult.status === 'fulfilled' ? glsRuntimeResult.value : null)
+    setGlsKernel(glsKernelResult.status === 'fulfilled' ? glsKernelResult.value : null)
  }, [])
  const loadReceipts = useCallback(async () => {
    try {
@ -1372,7 +1400,8 @@ function HoloLakeApp() {
          <button className="secondary-button" type="button" disabled={serverPnccBusy} onClick={() => void refreshServerPncc()}>{serverPnccBusy ? '正在读取…' : '重新读取主控状态'}</button>
        </section>
        <section className="plain-panel"><header><div><h2>本机 GH-PNCC 投影</h2><p>本机仓库挂载、开发写入通道与读取回执来自同一运行事件流。</p></div></header><dl className="evidence-list"><div><dt>已挂载仓库</dt><dd>{status.codeRepositoryMountCount}</dd></div><div><dt>投影回执</dt><dd>{status.pnccReceiptCount}</dd></div><div><dt>开发执行通道</dt><dd>{developmentLane?.state === 'ACTIVE' ? '已切入 HoloLake' : '等待受控载体'}</dd></div><div><dt>当前开发线</dt><dd>{developmentLane?.laneId || '—'}</dd></div><div><dt>当前写入载体</dt><dd>{developmentLane?.ownerInstanceId || '—'}</dd></div><div><dt>当前结论</dt><dd>{developmentLane?.state === 'ACTIVE' ? '开发执行环境已由 HoloLake 持有单写通道' : status.codeRepositoryMountCount > 0 && status.pnccReceiptCount > 0 ? '已有可核验运行记录' : '接口已接入，尚无完整运行记录'}</dd></div></dl></section>
-        <section className="plain-panel"><header><div><h2>GLS 协议运行层</h2><p>正本先完成注册对账和依赖分型；只有显式原生适配器进入执行图。</p></div><span className={glsRuntime?.state === 'ACTIVE_EXPLICIT_PROJECTIONS_ONLY' && glsRuntime.authorityConflictCount === 0 && glsRuntime.discoveredUnreconciledCount === 0 ? 'status-chip online' : 'status-chip'}>{glsRuntime ? '运行清单 v2 已加载' : '失败关闭'}</span></header>{glsRuntime ? <dl className="evidence-list"><div><dt>正本来源</dt><dd>{glsRuntime.sourceRepository} · {glsRuntime.sourceCommit.slice(0, 12)}</dd></div><div><dt>已发现编号协议</dt><dd>{glsRuntime.protocolCount}</dd></div><div><dt>协议注册表编号</dt><dd>{glsRuntime.protocolRegistryIdCount}</dd></div><div><dt>注册草案</dt><dd>{glsRuntime.registeredDraftCount} · {glsRuntime.registeredDraftNotStartedCount} 尚未实现</dd></div><div><dt>当前工程执行</dt><dd>{glsRuntime.executableProjectionCount}</dd></div><div><dt>已收录待工程化</dt><dd>{glsRuntime.inventoriedNotExecutableCount}</dd></div><div><dt>旧依赖目标</dt><dd>{glsRuntime.legacyDependencyTargetCount} · {glsRuntime.legacyDependencyCycleCount} 组待拆环</dd></div><div><dt>缺少编号正本的依赖</dt><dd>{glsRuntime.dependencyGapCount}</dd></div><div><dt>登记冲突 / 未对账</dt><dd>{glsRuntime.authorityConflictCount} / {glsRuntime.discoveredUnreconciledCount}</dd></div><div><dt>原文直接执行</dt><dd>{glsRuntime.rawProtocolTextExecuted ? '允许' : '禁止'}</dd></div><div><dt>任意协议代码</dt><dd>{glsRuntime.arbitraryProtocolCodeAllowed ? '允许' : '禁止'}</dd></div></dl> : <p className="boundary-note">GLS 运行清单不可读，协议适配器全部保持关闭。</p>}</section>
+        <section className="plain-panel"><header><div><h2>GLS 协议运行层</h2><p>正本先完成注册对账和依赖分型；只有显式原生适配器进入执行图。</p></div><span className={glsRuntime?.state === 'ACTIVE_EXPLICIT_PROJECTIONS_ONLY' && glsRuntime.authorityConflictCount === 0 && glsRuntime.discoveredUnreconciledCount === 0 ? 'status-chip online' : 'status-chip'}>{glsRuntime ? '运行清单 v2 已加载' : '失败关闭'}</span></header>{glsRuntime ? <dl className="evidence-list"><div><dt>正本来源</dt><dd>{glsRuntime.sourceRepository} · {glsRuntime.sourceCommit.slice(0, 12)}</dd></div><div><dt>已发现编号协议</dt><dd>{glsRuntime.protocolCount}</dd></div><div><dt>协议注册表编号</dt><dd>{glsRuntime.protocolRegistryIdCount}</dd></div><div><dt>注册草案</dt><dd>{glsRuntime.registeredDraftCount} · {glsRuntime.registeredDraftNotStartedCount} 尚未实现</dd></div><div><dt>内嵌工程协议</dt><dd>{glsRuntime.executableProjectionCount} · P0–P6 共 {glsRuntime.implementationStageCount} 层</dd></div><div><dt>已收录待工程化</dt><dd>{glsRuntime.inventoriedNotExecutableCount}</dd></div><div><dt>已分型来源依赖</dt><dd>{glsRuntime.typedSourceDependencyCount} · 未分类 {glsRuntime.unclassifiedSourceDependencyCount}</dd></div><div><dt>旧来源关系环</dt><dd>{glsRuntime.legacyDependencyCycleCount} 组仅供审计 · 不进入运行图</dd></div><div><dt>缺少编号正本的依赖</dt><dd>{glsRuntime.dependencyGapCount}</dd></div><div><dt>登记冲突 / 未对账</dt><dd>{glsRuntime.authorityConflictCount} / {glsRuntime.discoveredUnreconciledCount}</dd></div><div><dt>原文直接执行</dt><dd>{glsRuntime.rawProtocolTextExecuted ? '允许' : '禁止'}</dd></div><div><dt>任意协议代码</dt><dd>{glsRuntime.arbitraryProtocolCodeAllowed ? '允许' : '禁止'}</dd></div></dl> : <p className="boundary-note">GLS 运行清单不可读，协议适配器全部保持关闭。</p>}</section>
+        <section className="plain-panel"><header><div><h2>HoloLake 原生协议内核</h2><p>协议规则已编入软件本体；每次允许、拒绝、歧义和未核验裁决都写入本机哈希链回执。</p></div><span className={glsKernel?.state === 'P1_TO_P6_NATIVE_P7_FAIL_CLOSED' ? 'status-chip online' : 'status-chip'}>{glsKernel ? '随软件运行' : '失败关闭'}</span></header>{glsKernel ? <dl className="evidence-list"><div><dt>P1–P6 原生器官</dt><dd>{glsKernel.executableProtocolCount} 份合同 · {glsKernel.implementedStageCount} 个阶段</dd></div><div><dt>协议裁决回执</dt><dd>{glsKernel.decisionReceiptCount}</dd></div><div><dt>允许 / 拒绝</dt><dd>{glsKernel.allowCount} / {glsKernel.denyCount}</dd></div><div><dt>歧义 / 未核验</dt><dd>{glsKernel.ambiguousCount} / {glsKernel.unverifiedCount}</dd></div><div><dt>GLC 自举一致性</dt><dd>{glsKernel.bootstrapCompilerSelfCheck === 'PASS_DETERMINISTIC_DOUBLE_COMPILE' ? '双编译一致' : '失败关闭'}</dd></div><div><dt>P7 物理能力</dt><dd>{glsKernel.p7VerifiedPhysicalCapabilityCount} 已获本机目标证据 · {glsKernel.p7NodeAssemblies.length} 项装配边界</dd></div><div><dt>模型可改写裁决</dt><dd>{glsKernel.modelCanOverrideDecision ? '允许' : '禁止'}</dd></div><div><dt>回执链末端</dt><dd>{glsKernel.lastReceiptSha256 === 'GENESIS' ? '尚无裁决' : glsKernel.lastReceiptSha256.slice(0, 16)}</dd></div></dl> : <p className="boundary-note">原生协议内核不可读，所有协议裁决保持关闭。</p>}</section>
        <section className="plain-panel"><header><div><h2>零点原核编号内核</h2><p>先按权威图确定主体类别与登记面，再进入编号核验；编号外形本身不构成权威。</p></div><span className={numberingKernel?.state === 'ACTIVE_PINNED_AUTHORITY_MAP' ? 'status-chip online' : 'status-chip'}>{numberingKernel ? '本机内核已加载' : '失败关闭'}</span></header>{numberingKernel ? <dl className="evidence-list"><div><dt>权威图</dt><dd>{numberingKernel.authorityMapId}</dd></div><div><dt>权威图版本</dt><dd>{numberingKernel.authorityMapVersion}</dd></div><div><dt>正本提交</dt><dd>{numberingKernel.sourceCommit.slice(0, 12)}</dd></div><div><dt>人类入口命名空间</dt><dd>{numberingKernel.humanRouteNamespaces.join(' · ')}</dd></div><div><dt>自动派发身份号</dt><dd>{numberingKernel.automaticIdentityIssuance ? '已开启' : '禁止'}</dd></div><div><dt>未知编号</dt><dd>{numberingKernel.unknownNumber === 'FAIL_CLOSED' ? '失败关闭 · 不猜测' : numberingKernel.unknownNumber}</dd></div></dl> : <p className="boundary-note">编号内核不可读，所有编号路由保持关闭。</p>}</section>
        <section className="plain-panel">
          <header><div><h2>用户编号验证</h2><p>用户编号必须通过登记服务验证。验证结果不构成人格绑定、模型载体绑定或执行授权。</p></div><span className={zeroPoint?.route === 'verified' ? 'status-chip online' : 'status-chip'}>{zeroPoint ? (zeroPoint.route === 'verified' ? '验证有效' : '功能受限') : '正在读取'}</span></header>