feat: type PNCC organ contracts

GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex thread 019febf6-3902-70f3-9d82-74c9680b0c7e
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: LOCAL_PNCC_RUNTIME_DEVELOPMENT_AND_PUBLICATION

engineering/INDEX.md

@@ -32,6 +32,7 @@ Windows / macOS / Linux 构建机与安装包
 
 | 时间 | 版本 | 记录 | 状态 |
 | --- | --- | --- | --- |
+| 2026-08-11 | GH-PNCC 器官合同 | [人格器官机器合同与清单检查](operations/2026-08-11-hololake-pncc-typed-organ-contract.md) | 本地源码、完整 Rust/路由测试与 clippy 已通过；GHNQG 和发布待验收 |
 | 2026-08-11 | GH-PNCC 中断恢复 | [人格代码频道中断会话检查与安全恢复](operations/2026-08-11-hololake-pncc-interrupted-session-recovery.md) | 实现提交已通过 GHNQG；仓库发布、桌面集成与部署待验收 |
 | 2026-08-11 | GH-PNCC 首个运行闭环 | [人格原生代码频道首个只读运行层回执](operations/2026-08-11-hololake-pncc-first-runtime-cycle.md) | 源码与测试闭环已完成；人类投影、桌面制品、发布、部署与在线健康仍未完成 |
 | 2026-08-08 | 0.2.0 | [光湖分域教育行业操作系统第一阶段](operations/2026-08-08-guanghu-education-subdomain-stage1.md) | 小新服务器身份、文档/表格回写、仪表盘投影、模块登记与回执链路已验证 |

engineering/operations/2026-08-11-hololake-pncc-typed-organ-contract.md

@@ -0,0 +1,42 @@
+# GH-PNCC typed organ contract and manifest inspection receipt
+
+- Development ID: `DEV-20260810-014`
+- Persona cognitive author: `ICE-P-ZY001 / 铸渊`
+- Human responsibility subject: `ICE-GL∞ / 冰朔`
+- State: `LOCAL_SOURCE_IMPLEMENTED_AND_FULL_RUST_ROUTING_TESTED`
+
+## Implemented facts
+
+The persona manifest can now declare one of three typed organ kinds with a fixed mode and explicit input and
+output schemas:
+
+- `FACT_SENSE / read-only`: implemented and activatable; may read declared paths, call only the
+  manifest-pinned model, and emit structured facts. It cannot perform reality actions.
+- `MEMORY_METABOLISM / checkpoint-write`: contract declared but not independently activatable. The existing
+  fact-cycle checkpoint promotion remains kernel-owned.
+- `EXECUTION_LIMB / bounded-execution`: contract declared but executor not implemented. A declaration never
+  grants shell access or a reality action.
+
+`inspect_persona_code_channel_manifest` validates the exact Git repository and head, persona identity, brain,
+checkpoint, Git identity, model binding, every organ path, kind/mode pair, and schema identifier. It returns a
+normalized machine receipt without acquiring a primary lease or starting inference. Wake still accepts only
+the implemented fact sense; declared but unimplemented organs fail closed.
+
+## Current verification
+
+- PNCC focused Rust tests: `12 passed, 0 failed`.
+- Rust full suite: `1152 passed, 0 failed, 2 ignored`; integration test `1 passed`.
+- Rust clippy for all targets: `PASS` with `-D warnings`.
+- HoloLake architecture routing: `29 passed, 0 failed`.
+- Tests prove normalized inspection, explicit fact-sense activation boundaries, execution-limb refusal, path
+  containment, safe recovery and persona Git attribution.
+
+## Remaining acceptance
+
+- GHNQG pre-push quality gate;
+- repository commit, publication and fresh-clone readback;
+- durable event/receipt query API for a later same-source human projection;
+- independent memory-metabolism and bounded-execution executors;
+- UI, packaged desktop, installation, deployment and online health.
+
+This receipt proves local source behavior only.