feat: publish HoloLake model-native living system source

product-source/hololake-platform/guanghu-os/README.md

@@ -0,0 +1,135 @@
+# Guanghu OS bootstrap
+
+This directory is the first executable handoff from the registered HLDP
+language world to a native Guanghu OS. It is not a claim that Guanghu OS has
+already replaced Linux.
+
+## Authority boundary
+
+- `world-seed/` is the authoritative HLDP world package.
+- `guanghu-hldp-runtime` validates the package without guessing missing state.
+- `ghctl wake` is the fixed continuity entrypoint for a human or a later agent.
+- `ghctl authorize` checks every consequential action against the exact
+  node-scoped standing authorization before it runs.
+- `GLS-0844 / GHNQG` is the code channel's own quality authority. Every
+  required gate is either 0 or 100; only an all-100 run may publish a passing
+  receipt. External analysis products are non-authoritative observers.
+- `GLS-0845 / GHCIP` is the only gestational-history ingestion authority. It
+  keeps source registration, server-resident review, historical time catch-up,
+  and persona birth as four distinct states.
+- Rust is a bootstrap implementation language for the validator and control
+  executable. It does not replace HLDP as the world-programming language.
+- Ubuntu and the Forgejo Linux binary are construction scaffolding. Native
+  acceptance requires a Guanghu kernel, Guanghu hardware abstraction, a
+  Guanghu-owned code-channel data plane, and a boot with no Linux kernel or
+  Linux userspace.
+
+The registered translation chain is:
+
+```text
+TCS -> HLDP -> GLC -> GIR -> BTCP -> GOSK -> GHAL -> hardware
+```
+
+## World contents
+
+`WORLD-MANIFEST.hldp` registers exactly five domains, one logical broadcast
+tower, the continuity chain, the native handoff protocols, and the Guanghu Code
+Channel.
+
+The code channel starts from the verified Forgejo 16.0.1 offline baseline at
+commit `b3d7e4ac3cbccc220703097a51fa4c16bf302579`. Forgejo is the temporary data
+plane and compatibility reference. `CHANNEL.hldp` is the authority for channel
+identity, intents, receipts, and the migration ladder:
+
+1. verified source baseline;
+2. hosted Forgejo data plane;
+3. HLDP-native control plane;
+4. GOSK-native object store and network data plane;
+5. Linux-free boot.
+
+Only step 1 is complete in this source package.
+
+## Local verification
+
+```bash
+cargo fmt --all --manifest-path guanghu-os/Cargo.toml -- --check
+cargo test --manifest-path guanghu-os/Cargo.toml
+cargo clippy --manifest-path guanghu-os/Cargo.toml --all-targets -- -D warnings
+cargo run --manifest-path guanghu-os/Cargo.toml -p ghctl -- \
+  wake guanghu-os/world-seed
+guanghu-os/world-seed/scripts/run-guanghu-native-quality-gate.sh \
+  /tmp/guanghu-native-quality-receipt.hldp
+```
+
+`ghctl wake` validates the manifest, all five domain entries, the code-channel
+contract, standing authorization, dedicated-access receipt, continuity files,
+and exact repository digests before printing the recovery evidence.
+
+## Server recovery contract
+
+The hosted construction path will install immutable versions under
+`/guanghu/versions/<version>` and point `/guanghu/current` at the active
+version. A future session must execute this chain before any change:
+
+```text
+login
+-> /guanghu/bin/ghctl wake /guanghu/current
+-> WORLD-MANIFEST.hldp
+-> CURRENT.hldp
+-> last phase receipt
+-> dedicated-access receipt
+-> standing authorization
+-> active workorder
+-> code-channel entry and receipt
+-> live broadcast epoch
+-> act or fail closed
+```
+
+The current source is `HOSTED_BOOTSTRAP_PROTOTYPE`. Running it on Ubuntu proves
+the world package and recovery chain only; it does not prove native boot.
+
+The dedicated local login route is `guanghu-os-bs-sh-005`. It uses a separate
+SSH config and known-hosts file, strict host-key verification, and a key scoped
+to this disposable node. The world records only public fingerprints; it never
+contains the private key or a password.
+
+## Hosted Stage 1 installation
+
+`scripts/install-hosted-stage1.sh` is the repeatable Ubuntu construction
+handoff. It requires a full implementation Git SHA and the SHA-256 of the
+transferred source archive. It uses the official stable Rust toolchain rooted
+at `/opt/guanghu/{rustup,cargo}`; Ubuntu's Cargo 1.75 is intentionally rejected
+because it cannot read this repository's v4 lock file. On the exact x86_64
+`/dev/vda` lab shape, it:
+
+1. runs the workspace tests and builds a release `ghctl`;
+2. assembles and validates a temporary five-domain world;
+3. writes a server-observed HLDP phase receipt;
+4. makes the version immutable; and
+5. atomically moves `/guanghu/current`.
+
+An existing version is never overwritten. A failed assembly is retained with a
+`.failed.<UTC time>` suffix for diagnosis, while the previous current version
+remains active.
+
+## Hosted services Stage 1B
+
+`guanghu-broadcast-tower` is the first continuously running executor for the
+logical singleton registered by HLDP. Its hosted surface is deliberately
+loopback-only (`127.0.0.1:8077`), exposes the validated five-domain world, and
+writes a live HLDP epoch. It always reports `linux_exited: false`.
+
+`scripts/install-hosted-stage1b-services.sh` creates a new immutable world
+version, starts the tower, and installs the hash-verified Forgejo 16.0.1 package
+as the temporary code-channel data plane on `127.0.0.1:3080`. Registration and
+Forgejo's SSH server stay disabled. The exact `guanghu/main` bundle is restored
+as a bootstrap bare repository, while HLDP remains the channel authority.
+
+Both services are reachable from the local Mac through the dedicated SSH route;
+neither is published directly to the Internet. A failed service activation
+restores the Stage 1 world symlink and stops both hosted services.
+
+The first successful hosted activation exposed a recovery inconsistency:
+`CURRENT.hldp` advanced while `WORLD-MANIFEST.hldp` retained the Stage 1
+version. The immutable correction is `0.1.2-stage1b-r1`; it rebuilds the world
+from the repository seed and advances both records together.