diff --git a/product-source/hololake-platform/docs/adr/0177-guanghu-cross-root-supervisor-takeover.md b/product-source/hololake-platform/docs/adr/0177-guanghu-cross-root-supervisor-takeover.md index c0b3c5607..9e47b6b46 100644 --- a/product-source/hololake-platform/docs/adr/0177-guanghu-cross-root-supervisor-takeover.md +++ b/product-source/hololake-platform/docs/adr/0177-guanghu-cross-root-supervisor-takeover.md @@ -18,7 +18,8 @@ initramfs 的 `/run` 会被移动到新根系统,因此挂根前监督器留 生产投影使用早于 `sysinit.target` 的 systemd 单元。隔离验证使用只读最小 ext4 根镜像和静态 BusyBox,只证明跨 `switch_root` 的连续接管与常驻进程,不把它等同于真实机器部署、完整 Linux -按需唤醒或最终光湖 OS 主控。 +按需唤醒或最终光湖 OS 主控。京东同核 QEMU 已完成这一隔离门:挂根前监督、进入新根、根内监督 +常驻和进程存活四项串联成立,真实启动文件与机器启动周期未改变。 ## 否决 diff --git a/product-source/hololake-platform/guanghu-os/README.md b/product-source/hololake-platform/guanghu-os/README.md index 3e5fe4890..3532c057f 100644 --- a/product-source/hololake-platform/guanghu-os/README.md +++ b/product-source/hololake-platform/guanghu-os/README.md @@ -121,8 +121,11 @@ boot-scoped pre-root handoff after `/run` moves into the mounted root. It then stays resident with `ROOT_SUPERVISOR_ACTIVE`; the systemd projection starts it before `sysinit.target`. `scripts/build-guanghu-cross-root-fixture.sh` creates a read-only minimal root image for QEMU proof without mounting or modifying a -host disk. Source availability alone does not raise the JD cross-root or final -master predicates. See ADR-0177. +host disk. The JD-hosted QEMU receipt now proves the move into the new root, +live-binding revalidation, and a resident root-supervisor process. It does not +prove physical boot or bounded wake/reclaim of the real repository bridge, so +those predicates and final master control remain `0`. See ADR-0177 and +`deployments/JD-FD-PRIMARY/CROSS-ROOT-SUPERVISOR-QEMU-RECEIPT-20260815.hldp`. ## Language-primary boot target diff --git a/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/CROSS-ROOT-SUPERVISOR-QEMU-RECEIPT-20260815.hldp b/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/CROSS-ROOT-SUPERVISOR-QEMU-RECEIPT-20260815.hldp new file mode 100644 index 000000000..6488f1336 --- /dev/null +++ b/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/CROSS-ROOT-SUPERVISOR-QEMU-RECEIPT-20260815.hldp @@ -0,0 +1,48 @@ +schema: guanghu.jd-cross-root-qemu-receipt/v1 +receipt_id: JD-FD-PRIMARY-cross-root-qemu-5b040ca +issued_at: 2026-08-15T23:55:00+08:00 +development_id: DEV-20260815-001 +node_id: JD-FD-PRIMARY +node_dmi: f3d4b730-7f02-452f-975b-7091a4800431 +source_commit: 9db3ecd2e71374e6a2721f193e3360d73de342ba +source_tree: a018fb6ab0ec2362ca0efc364269c62d73b32330 +workorder_sha256: 94a1bc9568be4dd3a6b2294ecb8988ba3aab1ebdcc722580b7f41a36b3fbccc7 +root_image_sha256: e45f7557997a3c7884fcd5d4252300462fb7a15ceebdf2d3a588606d08aa0ed3 +root_image_size: 134217728 +serial_sha256: 8c617a56af0ce5e1a2f95fb213b9cbd5a5dfd7c54e8fdb9d570bb5f1b79816d3 +trigger: The pre-root supervisor was proved, but continuing control across switch_root remained unknown. +emergence: + - The first fixture mounted successfully but lacked /dev, /proc, /sys, and /lib/modules mountpoints, so run-init stopped before root entry. + - The corrected read-only fixture entered its own root, revalidated the moved /run handoff, started a root supervisor, and proved that process remained alive. +lock: + - GUANGHU_FIRST_BOOT_SUPERVISOR_ACTIVE + - GUANGHU_SWITCH_ROOT_INIT_ACTIVE + - GUANGHU_ROOT_SUPERVISOR_ACTIVE + - GUANGHU_CROSS_ROOT_PERSISTENCE_VERIFIED +why: A boot-scoped file alone is not a continuing controller; the root-side process must re-read live bindings and remain active after root transition. +rejected: + - Using the live JD root disk in QEMU. + - Installing the systemd unit into the physical node before isolated proof. + - Claiming full Linux lifecycle control or final Guanghu master from a minimal fixture. +live_readback: + boot_id_before: 68d4a3c9-c866-4f4a-be2e-0aa5f41a61b1 + boot_id_after: 68d4a3c9-c866-4f4a-be2e-0aa5f41a61b1 + repository_pid_before: 760 + repository_pid_after: 760 + public_code_http: 200 + public_anchor_http: 200 + residual_qemu_processes: 0 + physical_boot_files_changed: false + physical_reboot_performed: false +claims: + jd_host_qemu_pre_root_supervisor: 100 + jd_host_qemu_cross_switch_root_supervisor: 100 + cross_switch_root_persistent_supervisor: 100 + physical_guanghu_first_boot: 0 + linux_on_demand_subcontrol: 0 + final_guanghu_os_master: 0 +next_gate: IMPLEMENT_AND_VERIFY_BOUNDED_ROOT_SUPERVISOR_TO_LINUX_REPOSITORY_BRIDGE_LIFECYCLE_IN_ISOLATION +sources: + - /guanghu/recovery/JD-FD-PRIMARY-cross-root-qemu-5b040ca/WORKORDER.hldp + - /guanghu/recovery/JD-FD-PRIMARY-cross-root-qemu-5b040ca/qemu-cross-root.serial.log + - ADR-0177 diff --git a/routing/guanghu-os-control-architecture.json b/routing/guanghu-os-control-architecture.json index f22c64316..87346f41e 100644 --- a/routing/guanghu-os-control-architecture.json +++ b/routing/guanghu-os-control-architecture.json @@ -1,7 +1,7 @@ { "schema": "guanghu.os-control-architecture/v1", "record_id": "HLP-GUANGHU-OS-CONTROL-001", - "version": "2026-08-15.12", + "version": "2026-08-15.13", "state": "CURRENT_CANONICAL", "final_topology": "GUANGHU_MASTER_WITH_ON_DEMAND_LINUX_SUBCONTROL_AND_RESCUE", "control_ownership": { @@ -39,7 +39,7 @@ "linux_on_demand_subcontrol": 0, "linux_rescue_preserved": 100, "final_guanghu_os_master": 0, - "next_engineering_gate": "BUILD_AND_VERIFY_CROSS_SWITCH_ROOT_PERSISTENT_GUANGHU_SUPERVISOR_IN_JD_HOST_QEMU" + "next_engineering_gate": "IMPLEMENT_AND_VERIFY_BOUNDED_ROOT_SUPERVISOR_TO_LINUX_REPOSITORY_BRIDGE_LIFECYCLE_IN_ISOLATION" }, "implementation": { "guanghu_supervisor_lifecycle_contract_source": 100, @@ -76,7 +76,8 @@ "guanghu_root_supervisor_contract_source": 100, "guanghu_root_supervisor_systemd_unit_source": 100, "guanghu_cross_root_fixture_builder_source": 100, - "jd_host_qemu_cross_switch_root_supervisor": 0, + "jd_host_qemu_cross_switch_root_supervisor": 100, + "cross_switch_root_persistent_supervisor": 100, "independent_guanghu_first_boot_supervisor": 0, "jd_physical_deployment": 0 }, @@ -111,6 +112,21 @@ "final_guanghu_os_master": 0, "observed_at": "2026-08-15T23:45:00+08:00" }, + "cross_root_supervisor_qemu_evidence": { + "source_commit": "9db3ecd2e71374e6a2721f193e3360d73de342ba", + "source_tree": "a018fb6ab0ec2362ca0efc364269c62d73b32330", + "repository_receipt": "product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/CROSS-ROOT-SUPERVISOR-QEMU-RECEIPT-20260815.hldp", + "server_receipt": "/guanghu/recovery/JD-FD-PRIMARY-cross-root-qemu-5b040ca/DEPLOYMENT-RECEIPT.hldp", + "server_receipt_sha256": "47da5144d0f9b91140033080626205224961ed8dbf4624c9cd60fdd00bb6a57c", + "root_image_sha256": "e45f7557997a3c7884fcd5d4252300462fb7a15ceebdf2d3a588606d08aa0ed3", + "switch_root_entered": 100, + "root_supervisor_resident": 100, + "physical_boot_files_changed": false, + "physical_reboot_performed": false, + "linux_on_demand_subcontrol": 0, + "final_guanghu_os_master": 0, + "observed_at": "2026-08-15T23:55:00+08:00" + }, "current_target_evidence": { "server_receipt": "/guanghu/recovery/JD-FD-PRIMARY-linux-subcontrol-f5217fe/DEPLOYMENT-RECEIPT.hldp", "server_receipt_sha256": "4a7d0cb354ff0472dbd8e2e43d89021d65b21f0beea3c702dcbeacdd1c73bfbc", diff --git a/routing/guanghu-os-control-architecture.test.mjs b/routing/guanghu-os-control-architecture.test.mjs index f1142fa49..24f611516 100644 --- a/routing/guanghu-os-control-architecture.test.mjs +++ b/routing/guanghu-os-control-architecture.test.mjs @@ -43,12 +43,12 @@ test("current JD state stays transitional and cannot impersonate final master co assert.equal(contract.jd_fd_primary.final_guanghu_os_master, 0); assert.equal( contract.jd_fd_primary.next_engineering_gate, - "BUILD_AND_VERIFY_CROSS_SWITCH_ROOT_PERSISTENT_GUANGHU_SUPERVISOR_IN_JD_HOST_QEMU", + "IMPLEMENT_AND_VERIFY_BOUNDED_ROOT_SUPERVISOR_TO_LINUX_REPOSITORY_BRIDGE_LIFECYCLE_IN_ISOLATION", ); }); test("the physical shadow and host QEMU cycles are registered without impersonating Guanghu-owned boot control", () => { - assert.equal(contract.version, "2026-08-15.12"); + assert.equal(contract.version, "2026-08-15.13"); assert.equal(contract.implementation.guanghu_supervisor_lifecycle_contract_source, 100); assert.equal(contract.implementation.target_readback_and_mandatory_reclaim_state_machine, 100); assert.equal(contract.implementation.declared_supervisor_core_line_and_function_coverage, 100); @@ -82,7 +82,8 @@ test("the physical shadow and host QEMU cycles are registered without impersonat assert.equal(contract.implementation.guanghu_root_supervisor_contract_source, 100); assert.equal(contract.implementation.guanghu_root_supervisor_systemd_unit_source, 100); assert.equal(contract.implementation.guanghu_cross_root_fixture_builder_source, 100); - assert.equal(contract.implementation.jd_host_qemu_cross_switch_root_supervisor, 0); + assert.equal(contract.implementation.jd_host_qemu_cross_switch_root_supervisor, 100); + assert.equal(contract.implementation.cross_switch_root_persistent_supervisor, 100); assert.equal(contract.implementation.independent_guanghu_first_boot_supervisor, 0); assert.equal(contract.implementation.jd_physical_deployment, 0); assert.equal(contract.current_target_evidence.final_state, "DORMANT"); @@ -97,6 +98,13 @@ test("the physical shadow and host QEMU cycles are registered without impersonat assert.equal(contract.pre_root_supervisor_qemu_evidence.cross_switch_root_persistent_supervisor, 0); assert.equal(contract.pre_root_supervisor_qemu_evidence.final_guanghu_os_master, 0); assert.match(contract.pre_root_supervisor_qemu_evidence.server_receipt_sha256, /^[0-9a-f]{64}$/); + assert.equal(contract.cross_root_supervisor_qemu_evidence.switch_root_entered, 100); + assert.equal(contract.cross_root_supervisor_qemu_evidence.root_supervisor_resident, 100); + assert.equal(contract.cross_root_supervisor_qemu_evidence.physical_boot_files_changed, false); + assert.equal(contract.cross_root_supervisor_qemu_evidence.physical_reboot_performed, false); + assert.equal(contract.cross_root_supervisor_qemu_evidence.linux_on_demand_subcontrol, 0); + assert.equal(contract.cross_root_supervisor_qemu_evidence.final_guanghu_os_master, 0); + assert.match(contract.cross_root_supervisor_qemu_evidence.server_receipt_sha256, /^[0-9a-f]{64}$/); assert.equal(contract.native_public_projection_shadow_evidence.synthetic_ready_shadow_readback, 100); assert.equal(contract.native_public_projection_shadow_evidence.post_test_state, "DORMANT"); assert.equal(contract.native_public_projection_shadow_evidence.live_native_freshness_readback, 0);