deploy(hololake): open bounded public update route

product-source/hololake-native-desktop/contracts/enterprise-four-domain-entry.json

@@ -7,7 +7,7 @@
   "persona_relationship_gate": {"shows_species":"AGE","shows_current_persona_identity":true,"shows_invalid_age_individual_numbers":false,"human_confirms_relationship_mapping":true,"human_confirmation_is_persona_acceptance":false,"responsibility_acceptance_is_separate":true},
   "work_entry": {"domain":"DOMAIN-ZS","channel":"GUANGHU_CHANNEL","preserves_responsibility_domain":true},
   "personal_route": {"separate_node_ownership_check":true,"enterprise_credentials_are_sufficient":false,"self_connection_guide_visible_in_zero_sense_domain":true,"connection_executor":"HUMAN_OR_OWN_PERSONA"},
-  "desktop_install_acceptance": {"mac_arm64":"BOOTSTRAP_REBUILD_REQUIRED","mac_x86_64":"NOT_BUILT","windows":"NOT_BUILT","automatic_update_channel":"TRUST_PROVISIONED_PUBLIC_ROUTE_PENDING"},
+  "desktop_install_acceptance": {"mac_arm64":"BOOTSTRAP_REBUILD_REQUIRED","mac_x86_64":"NOT_BUILT","windows":"NOT_BUILT","automatic_update_channel":"BOOTSTRAP_TRUST_AND_PUBLIC_ENDPOINT_READY_NO_ACTIVE_RELEASE"},
   "ui_template": "REPO-012@27d34dfdbf5df4c67b805402d442e5912c8f4c31:official-login-template-v0.4-locked+inner-screens-v0.1",
   "source": "routing/hololake-enterprise-four-domain-work-channel.json"
 }

product-source/hololake-native-desktop/deployment/receipts/GH-HOLOLAKE-UPDATE-PUBLIC-BOOTSTRAP-20260817-001.json

@@ -0,0 +1,45 @@
+{
+  "schema": "hololake.update-public-bootstrap-acceptance-receipt/v1",
+  "receiptId": "GH-HOLOLAKE-UPDATE-PUBLIC-BOOTSTRAP-20260817-001",
+  "observedAt": "2026-08-17T00:55:04+08:00",
+  "state": "PUBLIC_HTTPS_EMPTY_FAIL_CLOSED_AND_CLIENT_TRUST_READY",
+  "sourceCommit": "cfa8fdefc2c7e475ba7163fddca42226abcc929d",
+  "clientTrust": {
+    "state": "PROVISIONED",
+    "endpoint": "https://guanghulab.com/hololake/releases/latest.json",
+    "host": "guanghulab.com",
+    "automaticCheckOnStartup": false,
+    "automaticDownload": false,
+    "humanOptInInstallRequired": true,
+    "automaticRestart": false,
+    "privateSigningMaterialInRepository": false
+  },
+  "origin": {
+    "nodeId": "JD-FD-PRIMARY",
+    "bootId": "1170988c-5390-4f47-b89a-e9f88b2c5bbb",
+    "control": "GUANGHU_OS_MASTER",
+    "listener": "127.0.0.1:3940",
+    "healthState": "EMPTY_FAIL_CLOSED",
+    "latestHttpStatus": 204,
+    "masterInitSha256": "a58f80535e0fb305b5b956cbeca66e4026fe63309424673b66bb0871c9feeca9",
+    "releaseBridgeSha256": "b89e23d8732c28aa1a77fc3166c175a0bc5973cb59958f7e821aecea825e7117",
+    "nextBootPersistenceInstalled": true,
+    "currentBootBridgeActive": true
+  },
+  "frontDoor": {
+    "nodeId": "BS-GZ-006",
+    "dedicatedUser": "hololake-tunnel",
+    "loopbackListener": "127.0.0.1:19440",
+    "publicEndpointHttpStatus": 204,
+    "nonGetMethodHttpStatus": 403,
+    "nginxSiteSha256": "e266fbd9380d56a52a634d2fa00e8180ac108aab3f62e3740701af44fe8f1542",
+    "nginxSnippetSha256": "ba699339d2d71f6139e74c0fd1878bae33a3aa8b4953ded0f4e7bd220a618d45",
+    "tunnelAuthority": "REMOTE_FORWARD_ONLY_EXACT_LOOPBACK_PORT_NO_SHELL"
+  },
+  "remaining": {
+    "activeRelease": false,
+    "bootstrapMacArm64Built": false,
+    "appleNotarizationCompleted": false,
+    "publicUpdateInstallEndToEndPassed": false
+  }
+}

product-source/hololake-native-desktop/foundation.json

@@ -83,14 +83,14 @@
   "release_broadcast_candidate_service_source": "server/release-broadcast/server.mjs",
   "release_public_route_contract": "server/release-broadcast/public-route.json",
   "release_public_path_prefix": "/hololake/releases",
-  "release_public_route_deployed": false,
+  "release_public_route_deployed": true,
   "release_front_door_bounded_config_renderer_implemented": true,
   "release_broadcast_explicit_operator_activation_implemented": true,
   "release_broadcast_activation_requires_exact_human_approval": true,
   "release_broadcast_activation_requires_repeated_expected_facts": true,
   "release_broadcast_operator_automatic_restart_allowed": false,
   "release_pipeline_automatic_upload_allowed": false,
-  "release_production_activation_state": "BOOTSTRAP_CLIENT_TRUST_PROVISIONED_PENDING_PUBLIC_ROUTE_AND_FIRST_NOTARIZED_RELEASE",
+  "release_production_activation_state": "PUBLIC_ROUTE_AND_BOOTSTRAP_TRUST_READY_PENDING_FIRST_SIGNED_NOTARIZED_RELEASE",
   "tauri_update_artifacts_enabled": true,
   "tauri_update_artifacts_enablement_gate": "JD_CONTROLLER_PUBLIC_KEY_AND_SIGNED_RELEASE_PIPELINE_REQUIRED",
   "automatic_update_check_on_startup": false,

product-source/hololake-native-desktop/scripts/domain-number-routing.test.mjs

@@ -65,7 +65,7 @@ test('the locked Qoder world template is the running client structure, not a ski
   assert.equal(contract.desktop_install_acceptance.mac_arm64, 'BOOTSTRAP_REBUILD_REQUIRED')
   assert.equal(contract.desktop_install_acceptance.mac_x86_64, 'NOT_BUILT')
   assert.equal(contract.desktop_install_acceptance.windows, 'NOT_BUILT')
-  assert.equal(contract.desktop_install_acceptance.automatic_update_channel, 'TRUST_PROVISIONED_PUBLIC_ROUTE_PENDING')
+  assert.equal(contract.desktop_install_acceptance.automatic_update_channel, 'BOOTSTRAP_TRUST_AND_PUBLIC_ENDPOINT_READY_NO_ACTIVE_RELEASE')
   assert.match(frontend, /number-nucleus/)
   assert.match(frontend, /worldStage === 'domain'/)
   assert.match(frontend, /worldStage === 'channel'/)

product-source/hololake-native-desktop/scripts/foundation.test.mjs

@@ -58,16 +58,16 @@ test('release activation remains explicitly human controlled', () => {
   assert.equal(foundation.release_broadcast_activation_requires_repeated_expected_facts, true)
   assert.equal(foundation.release_broadcast_operator_automatic_restart_allowed, false)
   assert.equal(foundation.release_public_path_prefix, '/hololake/releases')
-  assert.equal(foundation.release_public_route_deployed, false)
+  assert.equal(foundation.release_public_route_deployed, true)
   assert.equal(publicRoute.publicPathPrefix, foundation.release_public_path_prefix)
   assert.equal(publicRoute.proxyRequestUriPolicy, 'PRESERVE_FULL_PUBLIC_PATH')
-  assert.equal(publicRoute.frontDoorLoopbackPort, null)
+  assert.equal(publicRoute.frontDoorLoopbackPort, 19440)
-  assert.equal(publicRoute.deployed, false)
+  assert.equal(publicRoute.deployed, true)
   assert.equal(foundation.release_front_door_bounded_config_renderer_implemented, true)
   assert.equal(foundation.release_pipeline_automatic_upload_allowed, false)
   assert.equal(
     foundation.release_production_activation_state,
-    'BOOTSTRAP_CLIENT_TRUST_PROVISIONED_PENDING_PUBLIC_ROUTE_AND_FIRST_NOTARIZED_RELEASE',
+    'PUBLIC_ROUTE_AND_BOOTSTRAP_TRUST_READY_PENDING_FIRST_SIGNED_NOTARIZED_RELEASE',
   )
 })
 

product-source/hololake-native-desktop/server/release-broadcast/README.md

@@ -11,20 +11,20 @@ receipt form one exact evidence chain. Invalid evidence locks the whole release
 endpoint until an operator fixes the evidence and explicitly restarts the
 service.
 
-The service listens only on `127.0.0.1`. Public HTTPS routing, updater trust-key
+The service listens only on `127.0.0.1`. The public HTTPS path is carried by a
-provisioning, artifact upload, activation, and desktop rollout are independent
+dedicated, port-forwarding-only identity from JD-FD-PRIMARY to BS-GZ-006 and
-deployment gates.
+currently returns the origin's empty fail-closed `204` response. Artifact
+upload, activation, and desktop rollout remain independent deployment gates.
 
 The registered public namespace is `/hololake/releases`. The loopback origin
 accepts the manifest at both its operator health-check path `/latest.json` and
 the public updater path `/hololake/releases/latest.json`; release package URLs
 must remain under that same public prefix. The front-door proxy must therefore
-preserve the full request URI. Its loopback tunnel port remains deliberately
+preserve the full request URI. The registered BS-GZ-006 loopback tunnel port is
-unassigned until the BS-GZ-006 route owner returns the live, non-conflicting
+`19440`; it is not a public listener.
-topology.
 
-Once that port is returned and independently verified, `render-front-door.mjs
+`render-front-door.mjs --loopback-port PORT` renders the bounded Nginx
---loopback-port PORT` renders the bounded Nginx location. It refuses an omitted
+location. It refuses an omitted
 port, preserves the full public request path by leaving `proxy_pass` without a
 URI suffix, accepts only GET and HEAD, forwards no request body, and strips
 authorization, cookies, and client forwarding headers. Rendering is not

product-source/hololake-native-desktop/server/release-broadcast/public-route.json

@@ -1,13 +1,13 @@
 {
   "schema": "hololake.release-public-route/v1",
-  "state": "REGISTERED_PENDING_FRONT_DOOR_DEPLOYMENT",
+  "state": "DEPLOYED_EMPTY_FAIL_CLOSED",
   "publicBaseUrl": "https://guanghulab.com/hololake/releases",
   "releaseEndpoint": "https://guanghulab.com/hololake/releases/latest.json",
   "publicPathPrefix": "/hololake/releases",
   "originNode": "JD-FD-PRIMARY",
   "originListener": "127.0.0.1:3940",
   "frontDoorNode": "BS-GZ-006",
-  "frontDoorLoopbackPort": null,
+  "frontDoorLoopbackPort": 19440,
   "proxyRequestUriPolicy": "PRESERVE_FULL_PUBLIC_PATH",
   "allowedMethods": ["GET", "HEAD"],
   "requestBodyAllowed": false,
@@ -15,5 +15,5 @@
   "packageCachePolicy": "PUBLIC_IMMUTABLE",
   "automaticUpload": false,
   "automaticActivation": false,
-  "deployed": false
+  "deployed": true
 }