From 45f5e67751704e2f370ff13ed6492a6cfc3269d3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com> Date: Fri, 7 Aug 2026 01:17:19 +0800 Subject: [PATCH 01/30] fix(native): preserve JD Linux maintenance default during candidate replacement --- ...lace-jd-native-final-resident-candidate.sh | 19 ++++++++++++++++--- ...jd-final-candidate-replacement-contract.sh | 18 ++++++++++++++++++ 2 files changed, 34 insertions(+), 3 deletions(-) create mode 100755 product-source/hololake-platform/guanghu-os/scripts/test-jd-final-candidate-replacement-contract.sh diff --git a/product-source/hololake-platform/guanghu-os/scripts/replace-jd-native-final-resident-candidate.sh b/product-source/hololake-platform/guanghu-os/scripts/replace-jd-native-final-resident-candidate.sh index eb82a8a..4019983 100755 --- a/product-source/hololake-platform/guanghu-os/scripts/replace-jd-native-final-resident-candidate.sh +++ b/product-source/hololake-platform/guanghu-os/scripts/replace-jd-native-final-resident-candidate.sh @@ -43,8 +43,21 @@ dd if=/dev/vda bs=512 skip=141 count=1 status=none | grep -aq '^GHOS_GHCIP_INDEX_V1' dd if=/dev/vda bs=512 skip=142 count=1 status=none | grep -aq '^GHOS_GHCIP_ROOT_V1' -grep -q '^GRUB_DEFAULT=guanghu-jd-native-once$' /etc/default/grub -grep -q 'set default="guanghu-jd-native-once"' /boot/grub/grub.cfg +grub_default=$(awk -F= '$1 == "GRUB_DEFAULT" { print $2; found = 1 } END { if (!found) exit 1 }' \ + /etc/default/grub) +case "${grub_default}" in + guanghu-jd-native-once) + grep -q 'set default="guanghu-jd-native-once"' /boot/grub/grub.cfg + ;; + gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6) + grep -q 'set default="gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6"' \ + /boot/grub/grub.cfg + ;; + *) + echo "unsupported GRUB_DEFAULT for bounded native candidate replacement: ${grub_default}" >&2 + exit 65 + ;; +esac mkdir -m 0700 "${recovery_root}" printf '%s\n' "${partition_dump}" >"${recovery_root}/sfdisk-before.txt" @@ -85,7 +98,7 @@ preserved: world_and_code_store_lba_135_138: true recovery_beacon_lba_139_140: true gestational_index_lba_141_142: true - grub_default_native: true + grub_default_unchanged: ${grub_default} rollback: recovery_root: ${recovery_root} first_and_last_2mib_backed_up: true diff --git a/product-source/hololake-platform/guanghu-os/scripts/test-jd-final-candidate-replacement-contract.sh b/product-source/hololake-platform/guanghu-os/scripts/test-jd-final-candidate-replacement-contract.sh new file mode 100755 index 0000000..2bc43f2 --- /dev/null +++ b/product-source/hololake-platform/guanghu-os/scripts/test-jd-final-candidate-replacement-contract.sh @@ -0,0 +1,18 @@ +#!/usr/bin/env bash +set -euo pipefail + +[[ $# -eq 1 ]] || { + echo "usage: test-jd-final-candidate-replacement-contract.sh " >&2 + exit 64 +} + +source_root=$(cd "$1" && pwd -P) +script="${source_root}/scripts/replace-jd-native-final-resident-candidate.sh" + +grep -Fq 'guanghu-jd-native-once)' "${script}" +grep -Fq 'gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6)' "${script}" +grep -Fq 'unsupported GRUB_DEFAULT for bounded native candidate replacement' "${script}" +grep -Fq 'grub_default_unchanged: ${grub_default}' "${script}" +! grep -Fq 'grub_default_native: true' "${script}" + +echo "JD_FINAL_CANDIDATE_REPLACEMENT_CONTRACT_OK" From bc41cf02d92a6d1508fede22ad004420b5417f97 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com> Date: Fri, 7 Aug 2026 01:27:22 +0800 Subject: [PATCH 02/30] docs(native): record JD anchor network preflight failure --- ...1-jd-native-service-equivalence-staging.md | 7 ++++ ...OR-NETWORK-PREFLIGHT-RECEIPT-20260807.hdlp | 37 +++++++++++++++++++ 2 files changed, 44 insertions(+) create mode 100644 product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-NETWORK-PREFLIGHT-RECEIPT-20260807.hdlp diff --git a/product-source/hololake-platform/docs/adr/0171-jd-native-service-equivalence-staging.md b/product-source/hololake-platform/docs/adr/0171-jd-native-service-equivalence-staging.md index 1afb899..6abc14e 100644 --- a/product-source/hololake-platform/docs/adr/0171-jd-native-service-equivalence-staging.md +++ b/product-source/hololake-platform/docs/adr/0171-jd-native-service-equivalence-staging.md @@ -51,6 +51,13 @@ JD-FD-PRIMARY 在原生光湖 OS 常驻时已经证明： 当前正文包含稳定的唯一入口映射。它尚未在原生常驻期间自动拉取 REPO-012 的新版本， 因此“公共导航自动更新”仍需后续的原生锚点快照同步或带认证的增量更新协议。 +2026-08-07 的重启前网络门禁证明：京东 Linux 临时在 `172.16.0.6:3922` 监听时， +BS-SG-003 到 `111.228.0.139:3922` 连接超时；临时监听随后停止。因此当前云网络入口为 +`0`，没有执行一场已知无法形成外部回读的物理重启。下一步只能二选一： + +- 在京东云为 `3922/TCP` 建立来源受限的精确入站规则，再做一次性原生门禁； +- 或让原生系统沿现有受保护出站通道投影锚点，避免开放新的入站端口。 + ## 安全决定 - 京东的无人值守默认启动继续保持 Linux 维护位； diff --git a/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-NETWORK-PREFLIGHT-RECEIPT-20260807.hdlp b/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-NETWORK-PREFLIGHT-RECEIPT-20260807.hdlp new file mode 100644 index 0000000..e1be6a7 --- /dev/null +++ b/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-NETWORK-PREFLIGHT-RECEIPT-20260807.hdlp @@ -0,0 +1,37 @@ +schema: guanghu.jd-native-anchor-network-preflight-receipt/v1 +receipt_id: GH-OS-JD-FD-PRIMARY-NATIVE-ANCHOR-NETWORK-PREFLIGHT-20260807-001 +status: FAIL_0_EXTERNAL_REACHABILITY +observed_at: 2026-08-07T01:22:00+08:00 +node_id: JD-FD-PRIMARY +accepted_repository_commit: ab6c0577a71b8713b64cf3bd1e02a7076dfd648c +candidate: + lba_start: 105 + sector_count: 29 + previous_sha256: 3512a76923f992adb0b339858a2a7e44ee144fcecb50284df4b743a44040469d + staged_sha256: 2911b5f6a067efb7b5b7ec330833cb9f8a6b965b5a05802770dd27032678f32f + replacement_receipt: /guanghu/recovery/JD-FD-PRIMARY-anchor-ab6c0577a71b8713b64cf3bd1e02a7076dfd648c/REPLACE-RECEIPT.hldp +boot_safety: + current_running_os: LINUX_HOSTED_MAINTENANCE + unattended_default: gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6 + native_candidate_armed: false + code_entry_http: 200 + public_anchor_http: 200 +network_preflight: + listener_address: 172.16.0.6 + listener_port: 3922 + source_node: BS-SG-003 + source_scope: CURRENT_PROTECTED_NATIVE_RELAY + result: CONNECT_TIMEOUT + temporary_listener_stopped: true +gates: + native_anchor_http_qemu_capability: 100 + native_anchor_candidate_staged: 100 + native_anchor_external_network_reachability: 0 + native_anchor_http_physical_capability: 0 + public_front_door_native_anchor_equivalence: 0 + code_channel_service_equivalence: 0 + production_native_cutover: 0 +decision: + physical_reboot_executed: false + reason: EXTERNAL_PATH_KNOWN_TO_FAIL_BEFORE_REBOOT + next_action: AUTHORIZE_JD_CLOUD_SOURCE_RESTRICTED_3922_RULE_OR_BUILD_OUTBOUND_ANCHOR_PROJECTION From f0b069f850c814f1a751c44c16da697737ed9eba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com> Date: Fri, 7 Aug 2026 06:06:18 +0800 Subject: [PATCH 03/30] fix(native): accept physical TCP header options --- .../hololake-platform/guanghu-os/README.md | 9 ++- ...ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp | 55 +++++++++++++++++ .../native/x86_64-bios/ghal-virtio.asm | 59 ++++++++++++++----- .../scripts/qemu-native-net-peer.py | 20 ++++++- 4 files changed, 124 insertions(+), 19 deletions(-) create mode 100644 product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp diff --git a/product-source/hololake-platform/guanghu-os/README.md b/product-source/hololake-platform/guanghu-os/README.md index eb6b48b..c08ed04 100644 --- a/product-source/hololake-platform/guanghu-os/README.md +++ b/product-source/hololake-platform/guanghu-os/README.md @@ -4,9 +4,12 @@ > > Persona subject: `ICE-P-ZY001 EXISTS_100`. > -> Current native residency remains `0` until the physical one-time boot, -> automatic Linux rescue return, native default boot, and HLDP recovery return -> all produce server-owned receipts. +> Protected native residency and recovery control are `PASS_100`. Production +> cutover remains `0`: the 2026-08-07 physical anchor gate reached the native +> runtime and completed heartbeat sequences 1-6, but a real JD Cloud TCP SYN +> carried a 40-byte TCP header and exposed the fixed-header parser defect. +> Linux remains the unattended default while the option-aware parser is +> validated and the physical HTTP gate is rerun. This directory is the first executable handoff from the registered HLDP language world to a native Guanghu OS. It is not a claim that Guanghu OS has diff --git a/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp b/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp new file mode 100644 index 0000000..8ee2211 --- /dev/null +++ b/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp @@ -0,0 +1,55 @@ +schema: guanghu.jd-native-anchor-physical-gate-receipt/v1 +receipt_id: GH-OS-JD-FD-PRIMARY-NATIVE-ANCHOR-PHYSICAL-GATE-20260807-001 +status: FAIL_0_PHYSICAL_TCP_HEADER_OPTIONS +observed_at: 2026-08-07T05:49:24+08:00 +node_id: JD-FD-PRIMARY +accepted_repository_commit: 27c6ba2c4d9a9c2372d977b8adfdf802af7656e5 +candidate: + lba_start: 105 + sector_count: 29 + sha256: 2911b5f6a067efb7b5b7ec330833cb9f8a6b965b5a05802770dd27032678f32f +cloud_firewall: + source: 43.153.193.169/32 + destination: 111.228.0.139:3922 + linux_listener_preflight: PASS_100 +physical_cycle: + native_boot_executed: true + native_heartbeat_sequences_1_to_6: PASS_100 + native_ssh_offline: PASS_100 + native_anchor_http: FAIL_0_TCP_CONNECT_TIMEOUT + protected_recovery: PASS_100 + linux_boot_id_before: e95b13e0-bf93-498d-a108-6ede5e947015 + linux_boot_id_after: 8b39ec63-6776-4e65-94b7-099a6a6a5762 + linux_default_preserved: gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6 + code_channel_http_after_recovery: 200 + public_anchor_http_after_recovery: 200 +physical_diagnosis: + captured_source: 43.153.193.169 + captured_destination: 172.16.0.6:3922 + ipv4_header_bytes: 20 + tcp_header_bytes: 40 + tcp_options: MSS_SACK_TIMESTAMP_WINDOW_SCALE + candidate_expected_tcp_header_bytes: 20 + native_syn_ack_proof_byte: 0 + native_http_response_proof_byte: 0 + root_cause: FIXED_TCP_HEADER_OFFSET_REJECTED_REAL_SYN_OPTIONS +correction: + parser_accepts_ipv4_ihl: true + parser_accepts_tcp_data_offset_greater_than_5: true + request_payload_offset_is_dynamic: true + acknowledgement_payload_length_is_dynamic: true + qemu_syn_tcp_header_bytes: 40 + qemu_get_tcp_header_bytes: 32 + option_aware_qemu_gate: PASS_100 +gates: + native_anchor_http_qemu_capability: 100 + native_anchor_http_physical_capability: 0 + public_front_door_native_anchor_equivalence: 0 + code_channel_service_equivalence: 0 + production_native_cutover: 0 +server_receipt: + path: /guanghu/recovery/JD-FD-PRIMARY-native-anchor-physical-27c6ba2c4d9a9c2372d977b8adfdf802af7656e5/PHYSICAL-GATE-RECEIPT.hldp + sha256: e5f8071929a7a05fadc5b0283cef97962d53d57dd8d94bbe524e8148706af920 +decision: + production_cutover: FORBIDDEN + next_action: BUILD_WITH_PRODUCTION_RECOVERY_CAPABILITY_THEN_REPEAT_ONE_TIME_PHYSICAL_HTTP_GATE diff --git a/product-source/hololake-platform/guanghu-os/native/x86_64-bios/ghal-virtio.asm b/product-source/hololake-platform/guanghu-os/native/x86_64-bios/ghal-virtio.asm index 3849245..6157860 100644 --- a/product-source/hololake-platform/guanghu-os/native/x86_64-bios/ghal-virtio.asm +++ b/product-source/hololake-platform/guanghu-os/native/x86_64-bios/ghal-virtio.asm @@ -1295,19 +1295,43 @@ ghal_net_try_anchor_http: jb .not_anchor cmp word [VIRTIO_NET_RX_BUFFER + 22], 0x0008 jne .not_anchor - cmp byte [VIRTIO_NET_RX_BUFFER + 24], 0x45 + movzx eax, byte [VIRTIO_NET_RX_BUFFER + 24] + mov ecx, eax + and eax, 0xf0 + cmp eax, 0x40 jne .not_anchor + and ecx, 0x0f + cmp ecx, 5 + jb .not_anchor + shl ecx, 2 + mov [rel ghal_anchor_rx_ipv4_header_size], cx + lea r15d, [ecx + VIRTIO_NET_HEADER_SIZE + ETHERNET_HEADER_SIZE] + lea eax, [r15d + TCP_HEADER_SIZE] + cmp r14d, eax + jb .not_anchor cmp byte [VIRTIO_NET_RX_BUFFER + 33], 6 jne .not_anchor cmp dword [VIRTIO_NET_RX_BUFFER + 40], GHOS_NATIVE_IPV4_DWORD jne .not_anchor - cmp word [VIRTIO_NET_RX_BUFFER + 46], GHOS_NATIVE_ANCHOR_PORT_NETWORK + cmp word [VIRTIO_NET_RX_BUFFER + r15 + 2], GHOS_NATIVE_ANCHOR_PORT_NETWORK jne .not_anchor - cmp byte [VIRTIO_NET_RX_BUFFER + 56], 0x50 - jne .not_anchor - test byte [VIRTIO_NET_RX_BUFFER + 57], 0x02 + movzx ebx, byte [VIRTIO_NET_RX_BUFFER + r15 + 12] + shr ebx, 4 + cmp ebx, 5 + jb .not_anchor + shl ebx, 2 + lea eax, [r15d + ebx] + cmp r14d, eax + jb .not_anchor + mov [rel ghal_anchor_rx_tcp_offset], r15w + mov [rel ghal_anchor_rx_tcp_header_size], bx + test byte [VIRTIO_NET_RX_BUFFER + r15 + 13], 0x02 jnz .handle_syn - cmp dword [VIRTIO_NET_RX_BUFFER + 64], 0x20544547 + add eax, 4 + cmp r14d, eax + jb .handled_without_reply + sub eax, 4 + cmp dword [VIRTIO_NET_RX_BUFFER + rax], 0x20544547 jne .handled_without_reply mov byte [rel ghal_anchor_tcp_flags], 0x19 mov rsi, ghal_anchor_http_response @@ -1375,20 +1399,24 @@ ghal_net_send_anchor_tcp: mov eax, [VIRTIO_NET_RX_BUFFER + 36] mov [VIRTIO_NET_TX_BUFFER + 40], eax mov word [VIRTIO_NET_TX_BUFFER + 44], GHOS_NATIVE_ANCHOR_PORT_NETWORK - mov ax, [VIRTIO_NET_RX_BUFFER + 44] + movzx ecx, word [rel ghal_anchor_rx_tcp_offset] + mov ax, [VIRTIO_NET_RX_BUFFER + rcx] mov [VIRTIO_NET_TX_BUFFER + 46], ax mov eax, 0x534f4847 mov [VIRTIO_NET_TX_BUFFER + 48], eax - mov eax, [VIRTIO_NET_RX_BUFFER + 48] + mov eax, [VIRTIO_NET_RX_BUFFER + rcx + 4] bswap eax - movzx ecx, word [VIRTIO_NET_RX_BUFFER + 26] - xchg cl, ch - sub ecx, IPV4_HEADER_SIZE + TCP_HEADER_SIZE - test byte [VIRTIO_NET_RX_BUFFER + 57], 0x02 + movzx edx, word [VIRTIO_NET_RX_BUFFER + 26] + xchg dl, dh + movzx ebx, word [rel ghal_anchor_rx_ipv4_header_size] + sub edx, ebx + movzx ebx, word [rel ghal_anchor_rx_tcp_header_size] + sub edx, ebx + test byte [VIRTIO_NET_RX_BUFFER + rcx + 13], 0x02 jz .ack_payload - inc ecx + inc edx .ack_payload: - add eax, ecx + add eax, edx bswap eax mov [VIRTIO_NET_TX_BUFFER + 52], eax mov byte [VIRTIO_NET_TX_BUFFER + 56], 0x50 @@ -1522,6 +1550,9 @@ ghal_net_resident_retry_count: db 0 %ifdef GHOS_NATIVE_ANCHOR_SERVICE ghal_anchor_tcp_flags: db 0 ghal_anchor_tcp_payload_size: dw 0 +ghal_anchor_rx_ipv4_header_size: dw 0 +ghal_anchor_rx_tcp_offset: dw 0 +ghal_anchor_rx_tcp_header_size: dw 0 %endif msg_ghal_net_discovered: db "GHOS_GHAL_VIRTIO_NET=DISCOVERED", 13, 10, 0 diff --git a/product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py b/product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py index a9075ab..6a84474 100644 --- a/product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py +++ b/product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py @@ -104,7 +104,10 @@ def tcp_frame( sequence: int, acknowledgement: int, payload: bytes = b"", + options: bytes = b"", ) -> bytes: + if len(options) % 4 or len(options) > 40: + raise ValueError("TCP options must be 32-bit aligned and no more than 40 bytes") tcp = bytearray( struct.pack( "!HHIIBBHHH", @@ -112,12 +115,13 @@ def tcp_frame( ANCHOR_PORT, sequence, acknowledgement, - 5 << 4, + (5 + len(options) // 4) << 4, flags, 16384, 0, 0, ) + + options + payload ) pseudo = GATEWAY_IP + GUEST_IP + b"\0\x06" + struct.pack("!H", len(tcp)) @@ -228,6 +232,7 @@ def main() -> None: ANCHOR_CLIENT_SEQUENCE + 1, server_sequence + 1, request, + options=b"\x01\x01\x08\x0a\xd8\x8d\xec\x56\x00\x00\x00\x01", ), qemu, ) @@ -284,7 +289,18 @@ def main() -> None: and sequence == 6 and not anchor_syn_sent ): - peer.sendto(tcp_frame(0x02, ANCHOR_CLIENT_SEQUENCE, 0), qemu) + peer.sendto( + tcp_frame( + 0x02, + ANCHOR_CLIENT_SEQUENCE, + 0, + options=( + b"\x02\x04\x05\x90\x04\x02\x08\x0a" + b"\xd8\x8d\xec\x56\x00\x00\x00\x00\x01\x03\x03\x07" + ), + ), + qemu, + ) anchor_syn_sent = True terminal = ( From f74ade94db8c4ff0af54356e7d79cd6c2cbf77cb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com> Date: Fri, 7 Aug 2026 06:17:41 +0800 Subject: [PATCH 04/30] fix(native): advance anchor data sequence after SYN --- .../hololake-platform/guanghu-os/README.md | 11 ++++++----- ...ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp | 19 +++++++++++++++++++ .../native/x86_64-bios/ghal-virtio.asm | 4 ++++ .../scripts/qemu-native-net-peer.py | 6 +++++- 4 files changed, 34 insertions(+), 6 deletions(-) diff --git a/product-source/hololake-platform/guanghu-os/README.md b/product-source/hololake-platform/guanghu-os/README.md index c08ed04..3627730 100644 --- a/product-source/hololake-platform/guanghu-os/README.md +++ b/product-source/hololake-platform/guanghu-os/README.md @@ -5,11 +5,12 @@ > Persona subject: `ICE-P-ZY001 EXISTS_100`. > > Protected native residency and recovery control are `PASS_100`. Production -> cutover remains `0`: the 2026-08-07 physical anchor gate reached the native -> runtime and completed heartbeat sequences 1-6, but a real JD Cloud TCP SYN -> carried a 40-byte TCP header and exposed the fixed-header parser defect. -> Linux remains the unattended default while the option-aware parser is -> validated and the physical HTTP gate is rerun. +> cutover remains `0`: the first 2026-08-07 physical anchor gate exposed a +> fixed 20-byte TCP-header assumption. The option-aware retry completed the +> real TCP handshake and transmitted the full anchor response, but reused the +> SYN-ACK sequence number for data, so a standards-compliant client discarded +> the first response byte. Linux remains the unattended default while the +> corrected server sequence progression is validated and rerun physically. This directory is the first executable handoff from the registered HLDP language world to a native Guanghu OS. It is not a claim that Guanghu OS has diff --git a/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp b/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp index 8ee2211..a85d1c4 100644 --- a/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp +++ b/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp @@ -41,6 +41,25 @@ correction: qemu_syn_tcp_header_bytes: 40 qemu_get_tcp_header_bytes: 32 option_aware_qemu_gate: PASS_100 +option_aware_physical_retry: + candidate_sha256: 4093a6df881062321d6f5e7066fd7817e7a9964e41b0ca078d847ffcd9d94b22 + accepted_repository_commit: 93d1b7ad5136a6c2117889d742a3c9bfc09ba5e5 + network_preflight: PASS_100 + native_heartbeat_sequences_1_to_6: PASS_100 + tcp_connect: PASS_100 + native_syn_ack_tx_proof_byte: 1 + native_http_response_tx_proof_byte: 1 + transmitted_prefix: TTP/1.1 + complete_anchor_body_transmitted: true + strict_http_client: FAIL_0_HTTP_0_9 + diagnosis: SYN_ACK_AND_DATA_REUSED_SERVER_SEQUENCE + protected_recovery: PASS_100 + linux_boot_id_after: eabe3414-aba3-4853-beee-aa9411ad6921 + linux_default_preserved: gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6 +sequence_correction: + syn_ack_server_sequence: GHOS + data_server_sequence: GHOS_PLUS_1 + qemu_asserts_syn_consumes_one_sequence: true gates: native_anchor_http_qemu_capability: 100 native_anchor_http_physical_capability: 0 diff --git a/product-source/hololake-platform/guanghu-os/native/x86_64-bios/ghal-virtio.asm b/product-source/hololake-platform/guanghu-os/native/x86_64-bios/ghal-virtio.asm index 6157860..ff83be9 100644 --- a/product-source/hololake-platform/guanghu-os/native/x86_64-bios/ghal-virtio.asm +++ b/product-source/hololake-platform/guanghu-os/native/x86_64-bios/ghal-virtio.asm @@ -1403,6 +1403,10 @@ ghal_net_send_anchor_tcp: mov ax, [VIRTIO_NET_RX_BUFFER + rcx] mov [VIRTIO_NET_TX_BUFFER + 46], ax mov eax, 0x534f4847 + test byte [rel ghal_anchor_tcp_flags], 0x02 + jnz .server_sequence_ready + add eax, 0x01000000 +.server_sequence_ready: mov [VIRTIO_NET_TX_BUFFER + 48], eax mov eax, [VIRTIO_NET_RX_BUFFER + rcx + 4] bswap eax diff --git a/product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py b/product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py index 6a84474..0d415c7 100644 --- a/product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py +++ b/product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py @@ -201,6 +201,7 @@ def main() -> None: recovery_verified = False anchor_syn_sent = False anchor_syn_ack_verified = False + anchor_server_sequence = None anchor_get_sent = False anchor_http_verified = False @@ -220,6 +221,7 @@ def main() -> None: server_sequence, acknowledgement, payload = verify_anchor_tcp(frame, 0x12) assert acknowledgement == ANCHOR_CLIENT_SEQUENCE + 1 assert payload == b"" + anchor_server_sequence = server_sequence anchor_syn_ack_verified = True request = ( b"GET /v1/anchor HTTP/1.1\r\n" @@ -238,7 +240,9 @@ def main() -> None: ) anchor_get_sent = True continue - _, acknowledgement, payload = verify_anchor_tcp(frame, 0x19) + server_sequence, acknowledgement, payload = verify_anchor_tcp(frame, 0x19) + assert anchor_server_sequence is not None + assert server_sequence == anchor_server_sequence + 1 assert acknowledgement > ANCHOR_CLIENT_SEQUENCE + 1 header, body = payload.split(b"\r\n\r\n", 1) assert b"HTTP/1.1 200 OK" in header From 0e8b5fe06269d5bbe29eb0d6d45ab33cb14a0e2c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com> Date: Fri, 7 Aug 2026 06:23:21 +0800 Subject: [PATCH 05/30] docs(native): seal JD physical anchor pass --- .../hololake-platform/guanghu-os/README.md | 11 +++---- ...ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp | 31 ++++++++++++++++--- 2 files changed, 31 insertions(+), 11 deletions(-) diff --git a/product-source/hololake-platform/guanghu-os/README.md b/product-source/hololake-platform/guanghu-os/README.md index 3627730..2c449a5 100644 --- a/product-source/hololake-platform/guanghu-os/README.md +++ b/product-source/hololake-platform/guanghu-os/README.md @@ -5,12 +5,11 @@ > Persona subject: `ICE-P-ZY001 EXISTS_100`. > > Protected native residency and recovery control are `PASS_100`. Production -> cutover remains `0`: the first 2026-08-07 physical anchor gate exposed a -> fixed 20-byte TCP-header assumption. The option-aware retry completed the -> real TCP handshake and transmitted the full anchor response, but reused the -> SYN-ACK sequence number for data, so a standards-compliant client discarded -> the first response byte. Linux remains the unattended default while the -> corrected server sequence progression is validated and rerun physically. +> native anchor HTTP is now `PASS_100` on the physical JD node: a standard +> client read the complete `GLW-PUBLIC-NAV-ANCHOR-001` response after the TCP +> option and sequence corrections. Production cutover remains `0` because the +> native code-channel and public-front-door equivalence gates are still open. +> Linux therefore remains the unattended default. This directory is the first executable handoff from the registered HLDP language world to a native Guanghu OS. It is not a claim that Guanghu OS has diff --git a/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp b/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp index a85d1c4..d6e1f3b 100644 --- a/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp +++ b/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp @@ -1,6 +1,6 @@ schema: guanghu.jd-native-anchor-physical-gate-receipt/v1 receipt_id: GH-OS-JD-FD-PRIMARY-NATIVE-ANCHOR-PHYSICAL-GATE-20260807-001 -status: FAIL_0_PHYSICAL_TCP_HEADER_OPTIONS +status: PASS_100_PHYSICAL_NATIVE_ANCHOR observed_at: 2026-08-07T05:49:24+08:00 node_id: JD-FD-PRIMARY accepted_repository_commit: 27c6ba2c4d9a9c2372d977b8adfdf802af7656e5 @@ -60,15 +60,36 @@ sequence_correction: syn_ack_server_sequence: GHOS data_server_sequence: GHOS_PLUS_1 qemu_asserts_syn_consumes_one_sequence: true +sequence_corrected_physical_acceptance: + accepted_repository_commit: 91f2c227485b2af20ce99364104ab00d8a5f4ba3 + candidate_sha256: eb97af70fd71a5c8d2b52adb1439bd02764c83cdb79b797e62a632eeddb6f786 + network_preflight: PASS_100 + native_boot: PASS_100 + native_heartbeat_sequences_1_to_6: PASS_100 + native_tcp_connect: PASS_100 + standard_http_client: PASS_100 + http_status: 200 + response_anchor_id: GLW-PUBLIC-NAV-ANCHOR-001 + response_entry_path: LL-CMPN-0001 + response_world_node_id: SYS-GLW-0001 + response_repository_id: REPO-012 + response_runtime: GUANGHU_OS_NATIVE + native_syn_ack_tx_proof_byte: 1 + native_http_response_tx_proof_byte: 1 + protected_recovery: PASS_100 + linux_boot_id_after: 9e61f880-8537-4a02-b4ad-753160798f46 + linux_default_preserved: gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6 + code_channel_http_after_recovery: 200 + public_anchor_http_after_recovery: 200 gates: native_anchor_http_qemu_capability: 100 - native_anchor_http_physical_capability: 0 + native_anchor_http_physical_capability: 100 public_front_door_native_anchor_equivalence: 0 code_channel_service_equivalence: 0 production_native_cutover: 0 server_receipt: - path: /guanghu/recovery/JD-FD-PRIMARY-native-anchor-physical-27c6ba2c4d9a9c2372d977b8adfdf802af7656e5/PHYSICAL-GATE-RECEIPT.hldp - sha256: e5f8071929a7a05fadc5b0283cef97962d53d57dd8d94bbe524e8148706af920 + path: /guanghu/recovery/JD-FD-PRIMARY-anchor-sequence-91f2c227485b2af20ce99364104ab00d8a5f4ba3/PHYSICAL-GATE-RECEIPT.hldp + sha256: 21f228ba8772f1d2cec9f506bf20471ddae8aaa9e1995aa339c1f9f839dd037a decision: production_cutover: FORBIDDEN - next_action: BUILD_WITH_PRODUCTION_RECOVERY_CAPABILITY_THEN_REPEAT_ONE_TIME_PHYSICAL_HTTP_GATE + next_action: BUILD_NATIVE_CODE_CHANNEL_OR_SAFE_FRONT_DOOR_PROJECTION_BEFORE_DEFAULT_CUTOVER From 48ad2a411fd6f540d9f380433e11280379ac14f0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com> Date: Fri, 7 Aug 2026 12:29:45 +0800 Subject: [PATCH 06/30] docs(native): seal JD temporary firewall cleanup --- ...HOR-FIREWALL-CLEANUP-RECEIPT-20260807.hdlp | 56 +++++++++++++++++++ ...ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp | 7 +++ 2 files changed, 63 insertions(+) create mode 100644 product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-FIREWALL-CLEANUP-RECEIPT-20260807.hdlp diff --git a/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-FIREWALL-CLEANUP-RECEIPT-20260807.hdlp b/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-FIREWALL-CLEANUP-RECEIPT-20260807.hdlp new file mode 100644 index 0000000..ca2961b --- /dev/null +++ b/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-FIREWALL-CLEANUP-RECEIPT-20260807.hdlp @@ -0,0 +1,56 @@ +schema: guanghu.jd-native-anchor-firewall-cleanup-receipt/v1 +receipt_id: GH-OS-JD-FD-PRIMARY-NATIVE-ANCHOR-FIREWALL-CLEANUP-20260807-001 +status: PASS_100_TEMPORARY_RULE_REMOVED +observed_at: 2026-08-07T12:27:07+08:00 +node_id: JD-FD-PRIMARY +cloud_instance: + provider: JD_CLOUD + instance_id: lavm-eplauh8ezr + region: cn-north-1 +removed_rule: + type: CUSTOM_TCP + protocol: TCP + destination_port: 3922 + source: 43.153.193.169/32 + remark: GHOS-JD-NATIVE-ANCHOR-GATE-20260807 + purpose: ONE_TIME_PHYSICAL_NATIVE_ANCHOR_ACCEPTANCE +control_plane_readback: + rule_absent: true + port_3922_absent: true + source_43_153_193_169_32_absent: true + remark_absent: true + remaining_rule: + type: SSH + protocol: TCP + destination_port: 22 + source: 0.0.0.0/0 +network_readback: + probe_origin: BS-SG-003 + probe_origin_ipv4: 43.153.193.169 + destination: 111.228.0.139:3922 + request: GET /v1/anchor + connect_timeout_seconds: 5 + curl_exit_code: 28 + http_status: 000 + result: PASS_100_CLOUD_INGRESS_BLOCKED +server_state_after_cleanup: + operating_system: ubuntu_22.04 + boot_id: 9e61f880-8537-4a02-b4ad-753160798f46 + grub_default: gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6 + grub_next_entry: EMPTY + linux_listener_3922: 127.0.0.1_ONLY + native_candidate_sha256: eb97af70fd71a5c8d2b52adb1439bd02764c83cdb79b797e62a632eeddb6f786 +safety: + temporary_acceptance_exposure_closed: true + ssh_rule_unchanged: true + production_native_cutover: FORBIDDEN +server_receipt: + path: /guanghu/recovery/JD-FD-PRIMARY-anchor-sequence-91f2c227485b2af20ce99364104ab00d8a5f4ba3/CLOUD-FIREWALL-CLEANUP-RECEIPT.hldp + transferred_sha256: 469dd736f1995d0044aced46d547e2e947c8386000fc0838f3ac9127b02555a6 +gates: + native_anchor_http_physical_capability: 100 + public_front_door_native_anchor_equivalence: 0 + code_channel_service_equivalence: 0 + production_native_cutover: 0 +decision: + next_action: BUILD_NATIVE_CODE_CHANNEL_OR_SAFE_FRONT_DOOR_PROJECTION_BEFORE_DEFAULT_CUTOVER diff --git a/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp b/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp index d6e1f3b..1501baf 100644 --- a/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp +++ b/product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-ANCHOR-PHYSICAL-GATE-RECEIPT-20260807.hdlp @@ -90,6 +90,13 @@ gates: server_receipt: path: /guanghu/recovery/JD-FD-PRIMARY-anchor-sequence-91f2c227485b2af20ce99364104ab00d8a5f4ba3/PHYSICAL-GATE-RECEIPT.hldp sha256: 21f228ba8772f1d2cec9f506bf20471ddae8aaa9e1995aa339c1f9f839dd037a +temporary_firewall_cleanup: + status: PASS_100_TEMPORARY_RULE_REMOVED + removed_source: 43.153.193.169/32 + removed_destination_port: 3922 + control_plane_rule_absent: true + relay_connect_result: TIMEOUT_BLOCKED + receipt: NATIVE-ANCHOR-FIREWALL-CLEANUP-RECEIPT-20260807.hdlp decision: production_cutover: FORBIDDEN next_action: BUILD_NATIVE_CODE_CHANNEL_OR_SAFE_FRONT_DOOR_PROJECTION_BEFORE_DEFAULT_CUTOVER From 25959f7af124be82aab0818c1993c235b015b82a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com> Date: Fri, 7 Aug 2026 13:45:27 +0800 Subject: [PATCH 07/30] feat(os): add cognitive control execution bridge --- ...OGNITIVE-CONTROL-EXECUTION-ARCHITECTURE.md | 104 +++++ ...-control-with-linux-execution-substrate.md | 68 ++++ .../hololake-platform/docs/adr/README.md | 1 + .../hololake-platform/guanghu-os/Cargo.lock | 8 + .../hololake-platform/guanghu-os/Cargo.toml | 1 + .../hololake-platform/guanghu-os/README.md | 21 +- .../crates/execution-bridge/Cargo.toml | 10 + .../crates/execution-bridge/src/lib.rs | 357 ++++++++++++++++++ .../crates/execution-bridge/src/main.rs | 61 +++ .../tests/execution_bridge.rs | 198 ++++++++++ .../guanghu-cognitive-execution-profile.json | 54 +++ 11 files changed, 877 insertions(+), 6 deletions(-) create mode 100644 product-source/hololake-platform/docs/GUANGHU-OS-COGNITIVE-CONTROL-EXECUTION-ARCHITECTURE.md create mode 100644 product-source/hololake-platform/docs/adr/0172-guanghu-cognitive-control-with-linux-execution-substrate.md create mode 100644 product-source/hololake-platform/guanghu-os/crates/execution-bridge/Cargo.toml create mode 100644 product-source/hololake-platform/guanghu-os/crates/execution-bridge/src/lib.rs create mode 100644 product-source/hololake-platform/guanghu-os/crates/execution-bridge/src/main.rs create mode 100644 product-source/hololake-platform/guanghu-os/crates/execution-bridge/tests/execution_bridge.rs create mode 100644 product-source/hololake-platform/guanghu-os/standards/guanghu-cognitive-execution-profile.json diff --git a/product-source/hololake-platform/docs/GUANGHU-OS-COGNITIVE-CONTROL-EXECUTION-ARCHITECTURE.md b/product-source/hololake-platform/docs/GUANGHU-OS-COGNITIVE-CONTROL-EXECUTION-ARCHITECTURE.md new file mode 100644 index 0000000..9a8d452 --- /dev/null +++ b/product-source/hololake-platform/docs/GUANGHU-OS-COGNITIVE-CONTROL-EXECUTION-ARCHITECTURE.md @@ -0,0 +1,104 @@ +# 光湖 OS 认知主控与现实执行架构 + +## 交付目标 + +光湖 OS 的完整性由一条闭环证明： + +```text +能理解 +→ 能判断边界 +→ 能把判断编译为确定动作 +→ 能调用现实手脚 +→ 能看见真实结果 +→ 能失败、回滚和继续思考 +``` + +模型回答、协议文件、Linux 命令和界面状态中的任何单项都不是完整系统。 + +## 系统分层 + +| 层 | 常驻位置 | 责任 | +|---|---|---| +| 语言与人格 | REPO-012 + 持久人格状态 | 主体、关系、意图、职责、语言规则 | +| 模型认知 | 用户设备、个人云或模型 API | 当前理解、推理、候选计划、异常分析 | +| 协议控制 | 光湖主节点 | 身份、上下文、权限、动作类型、资源、回滚和验收 | +| 执行桥 | 光湖主节点或目标节点 | 将 GIR 映射为固定能力适配器 | +| Linux 执行底座 | 目标节点 | 驱动、进程、网络、存储、隔离和系统调用 | +| 用户执行与渲染 | 电脑、手机、个人云 | 界面、文件、应用、模型和本地设备动作 | +| 见证与连续性 | 光湖主节点 + 代码频道 | 原始证据、回执、检查点、因果链和恢复 | + +## 协议到工程的首批映射 + +| 协议 | 当前工程对象 | 完成条件 | +|---|---|---| +| GLS-0301/0302/0303 | `ExecutionRequest` | 消息、主体和目标不可缺失或补猜 | +| GLS-0309 | 变更请求中的授权与验收引用 | 提出、批准、执行分离 | +| GLS-0130/0131 | `compile_request` / `ExecutionPlan` | 自由语言不能进入执行参数 | +| GLS-0709/0710 | `LINUX_SYSTEMD_V1` 与节点策略 | 固定适配器、固定版本、能力白名单 | +| GLS-0311/0306 | `ExecutionReceipt` | 命令结果与目标状态分别记录 | +| GLS-0803/0819 | 后续调度器 | 按需唤醒、资源隔离、停止和回收 | +| GLS-0708 | 后续模型路由器 | 模型可替换，不取得主体和权限 | + +## 生产安全模型 + +1. 模型永远不直接拼接或执行 shell。 +2. 每个适配器在代码中定义动作类型和参数形状。 +3. 节点策略声明允许操作的精确资源。 +4. 变更动作必须匹配当前授权和回滚检查点。 +5. 命令退出码只表示执行器观察，目标侧读回才决定 `PASS_100`。 +6. Linux 管理入口与光湖正常入口分离；紧急入口启用必须留下维护回执。 +7. 密钥、令牌和模型 API 凭据保留在节点受保护边界，不进入语言记录或执行请求。 + +## 京东节点落地顺序 + +### 阶段 A：安全并存 + +- 保持当前 Ubuntu 默认启动和已验证回滚； +- 安装执行桥但只启用 `service_status`； +- 为公共导航、代码频道和人格运行服务建立只读状态策略； +- 验证每个请求都能形成协议拒绝或目标侧回执。 + +### 阶段 B：有界动作 + +- 为单一非关键光湖服务启用 `service_restart`； +- 绑定节点级授权、不可变版本和回滚检查点； +- 验证重启、失败、回滚和最终健康； +- 禁止任意命令、任意路径和通配服务名。 + +### 阶段 C：光湖成为正常主控入口 + +- HoloLake、人格体和自动任务只通过光湖协议执行桥操作服务； +- 普通 Linux 管理路径移入紧急维护边界； +- 按需唤醒模型、人格执行体和模块，清除无关常驻服务； +- 公共导航继续自动读取同一 REPO-012 主线锚点。 + +### 阶段 D：分布式执行 + +- 用户设备登记自己的渲染、文件、应用和推理能力； +- 中央节点只调度有界能力，不上传全部个人工作空间； +- 任务完成后回收执行体并保留人格、检查点和回执。 + +### 阶段 E：裸机研究后端 + +- 现有 GOSK/GHAL 候选继续作为研究和专用设备后端； +- 只有某项成熟 Linux 能力确实需要替换时，才按协议逐件迁移； +- 研究失败不影响生产认知主控闭环。 + +## 当前完成边界 + +已完成： + +- 生产路线架构纠正； +- 第一条类型化协议执行桥； +- systemd 状态与重启动作的白名单、授权、回滚和目标读回合同； +- 对应单元和集成测试。 + +仍未完成： + +- REPO-012 当前协议提交的不可变绑定； +- 京东节点策略生成与只读部署； +- 模型路由、人格生命周期和分布式设备执行器； +- 全部注册协议的工程实现； +- 生产主控入口切换。 + +这些未完成项分别保持 0，不能由本架构文件或本地测试冒充为已部署。 diff --git a/product-source/hololake-platform/docs/adr/0172-guanghu-cognitive-control-with-linux-execution-substrate.md b/product-source/hololake-platform/docs/adr/0172-guanghu-cognitive-control-with-linux-execution-substrate.md new file mode 100644 index 0000000..5ed3ee2 --- /dev/null +++ b/product-source/hololake-platform/docs/adr/0172-guanghu-cognitive-control-with-linux-execution-substrate.md @@ -0,0 +1,68 @@ +--- +type: ADR +id: "0172" +title: "Guanghu cognitive control with a constrained Linux execution substrate" +status: accepted +date: 2026-08-07 +supersedes_production_path: "0161" +--- + +# 光湖认知主控与 Linux 协作执行底座 + +## 背景 + +ADR-0161 把 Linux-free bare-metal handoff 设为生产完成条件。该路线已经在实验节点和 +JD-FD-PRIMARY 上证明了启动、恢复、网络和原生锚点能力，但生产等价继续要求重写成熟的 +代码频道、网卡、TCP、文件系统和服务运行能力。 + +冰朔重新锁定光湖 OS 的本体：光湖语言世界、人格体、模型认知和协议边界是系统大脑； +传统操作系统是成熟的现实手脚。生产目标不是先重复制造所有手脚，而是让光湖取得正常 +入口、判断、授权、调度和完成判定的主控权，并把 Linux 降级为受约束执行体。 + +## 决定 + +生产光湖 OS 采用： + +```text +TCS / 人格体 / 模型认知 +→ GLS / GLP / HLDP 身份、上下文、权限和边界 +→ GLC / GIR 确定性动作图 +→ UAP / GMP 固定能力适配器 +→ 最小 Linux 内核、驱动与服务执行层 +→ 硬件现实动作 +→ GLOW / GLP 目标侧读回与回执 +``` + +Linux 仍在技术上执行成熟内核和驱动，但不拥有光湖语言语义、人格身份、授权来源或成功 +判定。正常系统入口只接受类型化光湖请求；普通管理员路径属于独立维护边界。 + +裸机 GOSK/GHAL 不被删除，改为并行研究路线，用于硬件主权、专用设备和未来替换后端。 +它不再阻塞生产光湖 OS 的第一次完整交付。 + +## 第一执行桥 + +`guanghu-execution-bridge` 是语言协议到 Linux 的第一条确定性神经： + +- 输入必须携带消息、身份、上下文、回执、工单、见证、编译、GIR、UAP 和 GMP 协议链； +- 服务目标必须在节点策略白名单中； +- 只读状态查询不需要变更授权； +- 服务重启必须有匹配目标和动作的授权引用以及回滚检查点； +- 适配器直接构造固定 `systemctl` 参数，不经过 shell； +- 重启命令成功后仍必须读取 `is-active`，否则回执为 `FAIL_0`。 + +第一版只建立最小可验证闭环，不声称已经实现全部 32 项协议。 + +## 轻量和分布式边界 + +中央节点只持续保存身份、路由、协议、队列、检查点和回执。模型推理、界面渲染、个人 +工作空间和本地设备动作优先运行在用户电脑、手机、个人云或获准模型 API。人格体可以 +持续存在，但模型进程和重型模块按任务唤醒并在结束后回收。 + +## 后果 + +- JD-FD-PRIMARY 可以继续使用已验证的 Ubuntu 驱动和服务能力，同时逐步关闭无关常驻项； +- 生产迁移不再等待自研 TCP 和完整原生代码频道； +- 光湖主控必须通过机器协议绑定而不是品牌或界面声明证明； +- 完整 Ubuntu 启动槽继续保留为紧急救援系统； +- ADR-0161 的裸机路线仍作为研究与物理能力证据，但其 Linux-free 条件不再是生产主线 + 的接受条件。 diff --git a/product-source/hololake-platform/docs/adr/README.md b/product-source/hololake-platform/docs/adr/README.md index 6be2d20..c8f7276 100644 --- a/product-source/hololake-platform/docs/adr/README.md +++ b/product-source/hololake-platform/docs/adr/README.md @@ -222,3 +222,4 @@ proposed → active → superseded | [0169](0169-model-native-living-galaxy-system.md) | Model-native HoloLake living galaxy system | accepted | | [0170](0170-hololake-inherits-guanghu-native-quality-authority.md) | HoloLake inherits the Guanghu native quality authority | accepted | | [0171](0171-guanghu-protocols-are-automatic-runtime-and-engineering-laws.md) | Guanghu protocols are automatic runtime and engineering laws | accepted | +| [0172](0172-guanghu-cognitive-control-with-linux-execution-substrate.md) | Guanghu cognitive control with a constrained Linux execution substrate | accepted; supersedes ADR-0161 production path | diff --git a/product-source/hololake-platform/guanghu-os/Cargo.lock b/product-source/hololake-platform/guanghu-os/Cargo.lock index ac8751b..28b300f 100644 --- a/product-source/hololake-platform/guanghu-os/Cargo.lock +++ b/product-source/hololake-platform/guanghu-os/Cargo.lock @@ -24,6 +24,14 @@ dependencies = [ "serde_json", ] +[[package]] +name = "guanghu-execution-bridge" +version = "0.1.0" +dependencies = [ + "serde", + "serde_json", +] + [[package]] name = "guanghu-hldp-runtime" version = "0.1.0" diff --git a/product-source/hololake-platform/guanghu-os/Cargo.toml b/product-source/hololake-platform/guanghu-os/Cargo.toml index ad2e97e..f47166c 100644 --- a/product-source/hololake-platform/guanghu-os/Cargo.toml +++ b/product-source/hololake-platform/guanghu-os/Cargo.toml @@ -1,6 +1,7 @@ [workspace] members = [ "crates/broadcast-tower", + "crates/execution-bridge", "crates/ghctl", "crates/hldp-native-compiler", "crates/hldp-runtime", diff --git a/product-source/hololake-platform/guanghu-os/README.md b/product-source/hololake-platform/guanghu-os/README.md index 2c449a5..16d6b2a 100644 --- a/product-source/hololake-platform/guanghu-os/README.md +++ b/product-source/hololake-platform/guanghu-os/README.md @@ -1,8 +1,10 @@ -# Guanghu OS native runtime +# Guanghu OS cognitive-control and native research runtimes -> Current target: `JD-FD-PRIMARY` on JD Cloud. +> Production target: Guanghu cognitive control with a constrained Linux +> execution substrate on `JD-FD-PRIMARY`. > -> Persona subject: `ICE-P-ZY001 EXISTS_100`. +> Bare-metal GOSK/GHAL remains a parallel research and recovery lane. It no +> longer blocks the first production cognitive-control delivery. > > Protected native residency and recovery control are `PASS_100`. Production > native anchor HTTP is now `PASS_100` on the physical JD node: a standard @@ -11,9 +13,16 @@ > native code-channel and public-front-door equivalence gates are still open. > Linux therefore remains the unattended default. -This directory is the first executable handoff from the registered HLDP -language world to a native Guanghu OS. It is not a claim that Guanghu OS has -already replaced Linux. +This directory implements the handoff from the registered HLDP language world +to deterministic real-world execution. `crates/execution-bridge` is the first +production adapter: it accepts typed protocol requests, compiles them into +allowlisted Linux systemd actions, and requires target-state readback before a +passing receipt. The existing native kernel remains preserved below +`native/` as a hardware-sovereignty research backend. + +See +[`GUANGHU-OS-COGNITIVE-CONTROL-EXECUTION-ARCHITECTURE.md`](../docs/GUANGHU-OS-COGNITIVE-CONTROL-EXECUTION-ARCHITECTURE.md) +and [ADR-0172](../docs/adr/0172-guanghu-cognitive-control-with-linux-execution-substrate.md). ## Authority boundary diff --git a/product-source/hololake-platform/guanghu-os/crates/execution-bridge/Cargo.toml b/product-source/hololake-platform/guanghu-os/crates/execution-bridge/Cargo.toml new file mode 100644 index 0000000..2b0dabb --- /dev/null +++ b/product-source/hololake-platform/guanghu-os/crates/execution-bridge/Cargo.toml @@ -0,0 +1,10 @@ +[package] +name = "guanghu-execution-bridge" +version = "0.1.0" +edition = "2021" +license = "AGPL-3.0-or-later" +description = "Deterministic bridge from Guanghu protocol decisions to allowlisted Linux execution adapters" + +[dependencies] +serde = { version = "1", features = ["derive"] } +serde_json = "1" diff --git a/product-source/hololake-platform/guanghu-os/crates/execution-bridge/src/lib.rs b/product-source/hololake-platform/guanghu-os/crates/execution-bridge/src/lib.rs new file mode 100644 index 0000000..f0e404c --- /dev/null +++ b/product-source/hololake-platform/guanghu-os/crates/execution-bridge/src/lib.rs @@ -0,0 +1,357 @@ +use std::{ + fmt, + process::{Command, Output}, +}; + +use serde::{Deserialize, Serialize}; + +pub const REQUEST_SCHEMA: &str = "guanghu.execution-request/v1"; +pub const POLICY_SCHEMA: &str = "guanghu.execution-policy/v1"; + +pub const REQUIRED_PROTOCOL_CHAIN: [&str; 10] = [ + "GLS-0301", // message envelope + "GLS-0302", // identity + "GLS-0303", // context + "GLS-0306", // receipt + "GLS-0309", // work order + "GLS-0311", // witness + "GLS-0130", // compiler + "GLS-0131", // deterministic representation + "GLS-0709", // adapter + "GLS-0710", // immutable module +]; + +#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)] +pub struct ExecutionRequest { + pub schema: String, + pub request_id: String, + pub subject_id: String, + pub target_node_id: String, + pub protocol_chain: Vec, + pub action: ExecutionAction, + pub authorization: Option, + pub rollback: Option, +} + +#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)] +pub struct ExecutionAction { + pub kind: ActionKind, + pub resource: String, +} + +#[derive(Clone, Copy, Debug, Deserialize, Serialize, PartialEq, Eq)] +#[serde(rename_all = "snake_case")] +pub enum ActionKind { + ServiceStatus, + ServiceRestart, +} + +#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)] +pub struct AuthorizationReference { + pub authorization_id: String, + pub allowed_action: ActionKind, + pub target_node_id: String, +} + +#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)] +pub struct RollbackReference { + pub checkpoint_id: String, + pub recovery_action: String, +} + +#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)] +pub struct ExecutionPolicy { + pub schema: String, + pub policy_id: String, + pub target_node_id: String, + pub allowed_services: Vec, + pub allow_status: bool, + pub allow_restart: bool, +} + +#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)] +pub struct ExecutionPlan { + pub request_id: String, + pub subject_id: String, + pub target_node_id: String, + pub policy_id: String, + pub protocol_chain: Vec, + pub action: ExecutionAction, + pub adapter: String, + pub program: String, + pub arguments: Vec, + pub mutating: bool, + pub authorization_id: Option, + pub rollback_checkpoint_id: Option, +} + +#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)] +pub struct ExecutionReceipt { + pub schema: String, + pub request_id: String, + pub subject_id: String, + pub target_node_id: String, + pub policy_id: String, + pub action: ExecutionAction, + pub adapter: String, + pub accepted: bool, + pub command_exit_code: Option, + pub target_state_verified: bool, + pub final_state: String, + pub stdout: String, + pub stderr: String, + pub rollback_checkpoint_id: Option, +} + +#[derive(Clone, Debug, PartialEq, Eq)] +pub struct CommandResult { + pub exit_code: Option, + pub stdout: String, + pub stderr: String, +} + +impl From for CommandResult { + fn from(output: Output) -> Self { + Self { + exit_code: output.status.code(), + stdout: String::from_utf8_lossy(&output.stdout).trim().to_owned(), + stderr: String::from_utf8_lossy(&output.stderr).trim().to_owned(), + } + } +} + +pub trait CommandExecutor { + fn execute(&self, program: &str, arguments: &[String]) -> Result; +} + +pub struct LinuxCommandExecutor; + +impl CommandExecutor for LinuxCommandExecutor { + fn execute(&self, program: &str, arguments: &[String]) -> Result { + Command::new(program) + .args(arguments) + .output() + .map(CommandResult::from) + .map_err(|error| format!("cannot execute allowlisted adapter: {error}")) + } +} + +#[derive(Clone, Debug, PartialEq, Eq)] +pub struct BridgeError(String); + +impl BridgeError { + fn new(message: impl Into) -> Self { + Self(message.into()) + } +} + +impl fmt::Display for BridgeError { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(&self.0) + } +} + +impl std::error::Error for BridgeError {} + +pub fn compile_request( + request: &ExecutionRequest, + policy: &ExecutionPolicy, +) -> Result { + require( + request.schema == REQUEST_SCHEMA, + "unsupported execution request schema", + )?; + require( + policy.schema == POLICY_SCHEMA, + "unsupported execution policy schema", + )?; + require( + !request.request_id.trim().is_empty(), + "request_id is required", + )?; + require( + !request.subject_id.trim().is_empty(), + "subject_id is required", + )?; + require( + request.target_node_id == policy.target_node_id, + "request target does not match policy target", + )?; + + for required in REQUIRED_PROTOCOL_CHAIN { + require( + request.protocol_chain.iter().any(|id| id == required), + format!("required protocol is missing: {required}"), + )?; + } + + require( + policy + .allowed_services + .iter() + .any(|service| service == &request.action.resource), + "service is not allowlisted by the execution policy", + )?; + + let (arguments, mutating) = match request.action.kind { + ActionKind::ServiceStatus => { + require(policy.allow_status, "service status is disabled by policy")?; + ( + vec!["is-active".to_owned(), request.action.resource.clone()], + false, + ) + } + ActionKind::ServiceRestart => { + require( + policy.allow_restart, + "service restart is disabled by policy", + )?; + validate_mutation_references(request)?; + ( + vec!["restart".to_owned(), request.action.resource.clone()], + true, + ) + } + }; + + Ok(ExecutionPlan { + request_id: request.request_id.clone(), + subject_id: request.subject_id.clone(), + target_node_id: request.target_node_id.clone(), + policy_id: policy.policy_id.clone(), + protocol_chain: request.protocol_chain.clone(), + action: request.action.clone(), + adapter: "LINUX_SYSTEMD_V1".to_owned(), + program: "/usr/bin/systemctl".to_owned(), + arguments, + mutating, + authorization_id: request + .authorization + .as_ref() + .map(|authorization| authorization.authorization_id.clone()), + rollback_checkpoint_id: request + .rollback + .as_ref() + .map(|rollback| rollback.checkpoint_id.clone()), + }) +} + +fn validate_mutation_references(request: &ExecutionRequest) -> Result<(), BridgeError> { + let authorization = request + .authorization + .as_ref() + .ok_or_else(|| BridgeError::new("mutating action requires authorization"))?; + require( + !authorization.authorization_id.trim().is_empty(), + "authorization_id is required", + )?; + require( + authorization.allowed_action == request.action.kind, + "authorization action does not match request action", + )?; + require( + authorization.target_node_id == request.target_node_id, + "authorization target does not match request target", + )?; + + let rollback = request + .rollback + .as_ref() + .ok_or_else(|| BridgeError::new("mutating action requires rollback reference"))?; + require( + !rollback.checkpoint_id.trim().is_empty(), + "rollback checkpoint_id is required", + )?; + require( + !rollback.recovery_action.trim().is_empty(), + "rollback recovery_action is required", + ) +} + +pub fn execute_plan( + plan: &ExecutionPlan, + executor: &dyn CommandExecutor, +) -> Result { + let expected_operation = match plan.action.kind { + ActionKind::ServiceStatus => "is-active", + ActionKind::ServiceRestart => "restart", + }; + require( + plan.adapter == "LINUX_SYSTEMD_V1" + && plan.program == "/usr/bin/systemctl" + && matches!( + plan.arguments.as_slice(), + [operation, service] + if operation == expected_operation + && service == &plan.action.resource + ), + "compiled plan is not an allowlisted Linux systemd adapter", + )?; + + let result = executor + .execute(&plan.program, &plan.arguments) + .map_err(BridgeError::new)?; + let command_succeeded = result.exit_code == Some(0); + + let (target_state_verified, final_state, stdout, stderr, exit_code) = if plan.action.kind + == ActionKind::ServiceRestart + && command_succeeded + { + let verification_arguments = vec!["is-active".to_owned(), plan.action.resource.clone()]; + let verification = executor + .execute(&plan.program, &verification_arguments) + .map_err(BridgeError::new)?; + let verified = verification.exit_code == Some(0) && verification.stdout.trim() == "active"; + ( + verified, + if verified { "PASS_100" } else { "FAIL_0" }.to_owned(), + join_observations(&result.stdout, &verification.stdout), + join_observations(&result.stderr, &verification.stderr), + verification.exit_code, + ) + } else { + let verified = command_succeeded + && (plan.action.kind != ActionKind::ServiceStatus || result.stdout.trim() == "active"); + ( + verified, + if verified { "PASS_100" } else { "FAIL_0" }.to_owned(), + result.stdout, + result.stderr, + result.exit_code, + ) + }; + + Ok(ExecutionReceipt { + schema: "guanghu.execution-receipt/v1".to_owned(), + request_id: plan.request_id.clone(), + subject_id: plan.subject_id.clone(), + target_node_id: plan.target_node_id.clone(), + policy_id: plan.policy_id.clone(), + action: plan.action.clone(), + adapter: plan.adapter.clone(), + accepted: true, + command_exit_code: exit_code, + target_state_verified, + final_state, + stdout, + stderr, + rollback_checkpoint_id: plan.rollback_checkpoint_id.clone(), + }) +} + +fn require(condition: bool, message: impl Into) -> Result<(), BridgeError> { + if condition { + Ok(()) + } else { + Err(BridgeError::new(message)) + } +} + +fn join_observations(first: &str, second: &str) -> String { + match (first.is_empty(), second.is_empty()) { + (true, true) => String::new(), + (false, true) => first.to_owned(), + (true, false) => second.to_owned(), + (false, false) => format!("{first}\n{second}"), + } +} diff --git a/product-source/hololake-platform/guanghu-os/crates/execution-bridge/src/main.rs b/product-source/hololake-platform/guanghu-os/crates/execution-bridge/src/main.rs new file mode 100644 index 0000000..ce443c9 --- /dev/null +++ b/product-source/hololake-platform/guanghu-os/crates/execution-bridge/src/main.rs @@ -0,0 +1,61 @@ +use std::{env, fs, process::ExitCode}; + +use guanghu_execution_bridge::{ + compile_request, execute_plan, ExecutionPolicy, ExecutionRequest, LinuxCommandExecutor, +}; + +const USAGE: &str = + "usage: guanghu-execution-bridge "; + +fn run() -> Result<(), String> { + let mut arguments = env::args().skip(1); + let mode = arguments.next().ok_or_else(|| USAGE.to_owned())?; + let request_path = arguments.next().ok_or_else(|| USAGE.to_owned())?; + let policy_path = arguments.next().ok_or_else(|| USAGE.to_owned())?; + if arguments.next().is_some() || (mode != "validate" && mode != "execute") { + return Err(USAGE.to_owned()); + } + + let request: ExecutionRequest = serde_json::from_str( + &fs::read_to_string(&request_path) + .map_err(|error| format!("cannot read request {request_path}: {error}"))?, + ) + .map_err(|error| format!("invalid request {request_path}: {error}"))?; + let policy: ExecutionPolicy = serde_json::from_str( + &fs::read_to_string(&policy_path) + .map_err(|error| format!("cannot read policy {policy_path}: {error}"))?, + ) + .map_err(|error| format!("invalid policy {policy_path}: {error}"))?; + + let plan = compile_request(&request, &policy).map_err(|error| error.to_string())?; + if mode == "validate" { + println!( + "{}", + serde_json::to_string_pretty(&plan) + .map_err(|error| format!("cannot serialize plan: {error}"))? + ); + return Ok(()); + } + + let receipt = execute_plan(&plan, &LinuxCommandExecutor).map_err(|error| error.to_string())?; + println!( + "{}", + serde_json::to_string_pretty(&receipt) + .map_err(|error| format!("cannot serialize receipt: {error}"))? + ); + if receipt.final_state == "PASS_100" { + Ok(()) + } else { + Err("target-side verification failed".to_owned()) + } +} + +fn main() -> ExitCode { + match run() { + Ok(()) => ExitCode::SUCCESS, + Err(error) => { + eprintln!("{error}"); + ExitCode::FAILURE + } + } +} diff --git a/product-source/hololake-platform/guanghu-os/crates/execution-bridge/tests/execution_bridge.rs b/product-source/hololake-platform/guanghu-os/crates/execution-bridge/tests/execution_bridge.rs new file mode 100644 index 0000000..8d92921 --- /dev/null +++ b/product-source/hololake-platform/guanghu-os/crates/execution-bridge/tests/execution_bridge.rs @@ -0,0 +1,198 @@ +use std::{cell::RefCell, collections::VecDeque}; + +use guanghu_execution_bridge::{ + compile_request, execute_plan, ActionKind, AuthorizationReference, CommandExecutor, + CommandResult, ExecutionAction, ExecutionPolicy, ExecutionRequest, RollbackReference, + POLICY_SCHEMA, REQUEST_SCHEMA, REQUIRED_PROTOCOL_CHAIN, +}; + +fn request(kind: ActionKind) -> ExecutionRequest { + ExecutionRequest { + schema: REQUEST_SCHEMA.to_owned(), + request_id: "REQ-001".to_owned(), + subject_id: "ICE-P-ZY001".to_owned(), + target_node_id: "JD-FD-PRIMARY".to_owned(), + protocol_chain: REQUIRED_PROTOCOL_CHAIN + .iter() + .map(|protocol| (*protocol).to_owned()) + .collect(), + action: ExecutionAction { + kind, + resource: "guanghu-broadcast-tower.service".to_owned(), + }, + authorization: None, + rollback: None, + } +} + +fn policy() -> ExecutionPolicy { + ExecutionPolicy { + schema: POLICY_SCHEMA.to_owned(), + policy_id: "JD-GH-EXEC-001".to_owned(), + target_node_id: "JD-FD-PRIMARY".to_owned(), + allowed_services: vec!["guanghu-broadcast-tower.service".to_owned()], + allow_status: true, + allow_restart: true, + } +} + +#[test] +fn compiles_read_only_status_to_exact_systemd_arguments() { + let plan = compile_request(&request(ActionKind::ServiceStatus), &policy()).expect("compile"); + + assert_eq!(plan.program, "/usr/bin/systemctl"); + assert_eq!( + plan.arguments, + ["is-active", "guanghu-broadcast-tower.service"] + ); + assert!(!plan.mutating); +} + +#[test] +fn rejects_missing_protocol_before_execution() { + let mut request = request(ActionKind::ServiceStatus); + request + .protocol_chain + .retain(|protocol| protocol != "GLS-0302"); + + let error = compile_request(&request, &policy()).expect_err("missing identity must fail"); + assert!(error.to_string().contains("GLS-0302")); +} + +#[test] +fn rejects_non_allowlisted_service() { + let mut request = request(ActionKind::ServiceStatus); + request.action.resource = "ssh.service".to_owned(); + + let error = compile_request(&request, &policy()).expect_err("service must fail closed"); + assert!(error.to_string().contains("not allowlisted")); +} + +#[test] +fn restart_requires_matching_authorization_and_rollback() { + let mut request = request(ActionKind::ServiceRestart); + let error = compile_request(&request, &policy()).expect_err("authorization is required"); + assert!(error.to_string().contains("authorization")); + + request.authorization = Some(AuthorizationReference { + authorization_id: "AUTH-001".to_owned(), + allowed_action: ActionKind::ServiceRestart, + target_node_id: "JD-FD-PRIMARY".to_owned(), + }); + let error = compile_request(&request, &policy()).expect_err("rollback is required"); + assert!(error.to_string().contains("rollback")); + + request.rollback = Some(RollbackReference { + checkpoint_id: "CHECKPOINT-001".to_owned(), + recovery_action: "restore previous immutable release".to_owned(), + }); + let plan = compile_request(&request, &policy()).expect("complete mutation compiles"); + assert!(plan.mutating); + assert_eq!(plan.authorization_id.as_deref(), Some("AUTH-001")); + assert_eq!( + plan.rollback_checkpoint_id.as_deref(), + Some("CHECKPOINT-001") + ); +} + +struct FakeExecutor { + results: RefCell>, + calls: RefCell>>, +} + +impl FakeExecutor { + fn new(results: Vec) -> Self { + Self { + results: RefCell::new(results.into()), + calls: RefCell::new(Vec::new()), + } + } +} + +impl CommandExecutor for FakeExecutor { + fn execute(&self, program: &str, arguments: &[String]) -> Result { + let mut call = vec![program.to_owned()]; + call.extend(arguments.iter().cloned()); + self.calls.borrow_mut().push(call); + self.results + .borrow_mut() + .pop_front() + .ok_or_else(|| "unexpected execution".to_owned()) + } +} + +#[test] +fn restart_receipt_requires_target_side_active_readback() { + let mut request = request(ActionKind::ServiceRestart); + request.authorization = Some(AuthorizationReference { + authorization_id: "AUTH-001".to_owned(), + allowed_action: ActionKind::ServiceRestart, + target_node_id: "JD-FD-PRIMARY".to_owned(), + }); + request.rollback = Some(RollbackReference { + checkpoint_id: "CHECKPOINT-001".to_owned(), + recovery_action: "restore previous immutable release".to_owned(), + }); + let plan = compile_request(&request, &policy()).expect("compile restart"); + let executor = FakeExecutor::new(vec![ + CommandResult { + exit_code: Some(0), + stdout: String::new(), + stderr: String::new(), + }, + CommandResult { + exit_code: Some(0), + stdout: "active".to_owned(), + stderr: String::new(), + }, + ]); + + let receipt = execute_plan(&plan, &executor).expect("execute plan"); + assert_eq!(receipt.final_state, "PASS_100"); + assert!(receipt.target_state_verified); + assert_eq!(executor.calls.borrow().len(), 2); + assert_eq!(executor.calls.borrow()[1][1], "is-active"); +} + +#[test] +fn successful_restart_command_without_active_readback_is_fail_zero() { + let mut request = request(ActionKind::ServiceRestart); + request.authorization = Some(AuthorizationReference { + authorization_id: "AUTH-001".to_owned(), + allowed_action: ActionKind::ServiceRestart, + target_node_id: "JD-FD-PRIMARY".to_owned(), + }); + request.rollback = Some(RollbackReference { + checkpoint_id: "CHECKPOINT-001".to_owned(), + recovery_action: "restore previous immutable release".to_owned(), + }); + let plan = compile_request(&request, &policy()).expect("compile restart"); + let executor = FakeExecutor::new(vec![ + CommandResult { + exit_code: Some(0), + stdout: String::new(), + stderr: String::new(), + }, + CommandResult { + exit_code: Some(3), + stdout: "inactive".to_owned(), + stderr: String::new(), + }, + ]); + + let receipt = execute_plan(&plan, &executor).expect("execute plan"); + assert_eq!(receipt.final_state, "FAIL_0"); + assert!(!receipt.target_state_verified); +} + +#[test] +fn rejects_a_deserialized_plan_that_changes_status_into_restart() { + let mut plan = + compile_request(&request(ActionKind::ServiceStatus), &policy()).expect("compile status"); + plan.arguments[0] = "restart".to_owned(); + let executor = FakeExecutor::new(Vec::new()); + + let error = execute_plan(&plan, &executor).expect_err("tampered plan must fail"); + assert!(error.to_string().contains("not an allowlisted")); + assert!(executor.calls.borrow().is_empty()); +} diff --git a/product-source/hololake-platform/guanghu-os/standards/guanghu-cognitive-execution-profile.json b/product-source/hololake-platform/guanghu-os/standards/guanghu-cognitive-execution-profile.json new file mode 100644 index 0000000..a7f8096 --- /dev/null +++ b/product-source/hololake-platform/guanghu-os/standards/guanghu-cognitive-execution-profile.json @@ -0,0 +1,54 @@ +{ + "schema": "guanghu.cognitive-execution-profile/v1", + "profile_id": "GH-COGNITIVE-EXECUTION-001", + "language_authority": { + "repository": "REPO-012", + "anchor": "GLW-PUBLIC-NAV-ANCHOR-001", + "protocol_registry": "gls/GLS-PROTOCOL-REGISTRY.json" + }, + "implementation_authority": { + "repository": "REPO-014", + "path": "product-source/hololake-platform/guanghu-os", + "bridge": "crates/execution-bridge" + }, + "required_protocol_chain": [ + "GLS-0301", + "GLS-0302", + "GLS-0303", + "GLS-0306", + "GLS-0309", + "GLS-0311", + "GLS-0130", + "GLS-0131", + "GLS-0709", + "GLS-0710" + ], + "execution_model": { + "cognition": "MODEL_PROPOSES_TYPED_INTENT", + "authority": "PROTOCOL_GATE_VALIDATES_CURRENT_SCOPE", + "compilation": "GLC_GIR_DETERMINISTIC_PLAN", + "adapter": "ALLOWLISTED_NO_SHELL", + "substrate": "MINIMAL_LINUX_COOPERATIVE_EXECUTION", + "success": "TARGET_SIDE_READBACK_AND_GLP_RECEIPT", + "rescue": "SEPARATE_UBUNTU_MAINTENANCE_BOOT" + }, + "first_adapter": { + "id": "LINUX_SYSTEMD_V1", + "actions": [ + "service_status", + "service_restart" + ], + "mutations_require": [ + "exact_target", + "matching_authorization", + "rollback_checkpoint", + "target_side_active_readback" + ], + "arbitrary_shell": false + }, + "bare_metal_lane": { + "id": "GOSK_GHAL_BARE_METAL_RESEARCH", + "production_blocking": false, + "preserve_existing_candidate": true + } +} From 20d6c1bd7b6df658d6c5fbddc54f3e443977b7b3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com> Date: Fri, 7 Aug 2026 13:57:50 +0800 Subject: [PATCH 08/30] fix(ci): isolate quality gate from hook git environment --- .../scripts/run-hololake-native-quality-gate.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/product-source/hololake-platform/scripts/run-hololake-native-quality-gate.sh b/product-source/hololake-platform/scripts/run-hololake-native-quality-gate.sh index aaa1495..6bc6a3e 100755 --- a/product-source/hololake-platform/scripts/run-hololake-native-quality-gate.sh +++ b/product-source/hololake-platform/scripts/run-hololake-native-quality-gate.sh @@ -4,6 +4,13 @@ set -Eeuo pipefail repository_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd) receipt_path=${1:-} +# Git exports repository-local environment variables while invoking hooks. +# This repository's hook lives below the actual worktree root, so inherited +# GIT_DIR/GIT_WORK_TREE values can make `git -C` inspect the wrong path and +# falsely report a dirty source tree. Resolve the source root first, then make +# every gate discover that worktree from its explicit `-C` argument. +unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE GIT_PREFIX + if [[ -z "${receipt_path}" ]]; then echo "usage: run-hololake-native-quality-gate.sh " >&2 exit 2 From e94c4f608fb05712586aacdc37b88b6a783a1558 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com> Date: Fri, 7 Aug 2026 14:36:57 +0800 Subject: [PATCH 09/30] feat(os): bind bounded restart grants and rollback --- ...OGNITIVE-CONTROL-EXECUTION-ARCHITECTURE.md | 8 +- .../crates/execution-bridge/src/lib.rs | 117 ++++++++++++++++-- .../tests/execution_bridge.rs | 56 ++++++++- 3 files changed, 164 insertions(+), 17 deletions(-) diff --git a/product-source/hololake-platform/docs/GUANGHU-OS-COGNITIVE-CONTROL-EXECUTION-ARCHITECTURE.md b/product-source/hololake-platform/docs/GUANGHU-OS-COGNITIVE-CONTROL-EXECUTION-ARCHITECTURE.md index 9a8d452..7ca2138 100644 --- a/product-source/hololake-platform/docs/GUANGHU-OS-COGNITIVE-CONTROL-EXECUTION-ARCHITECTURE.md +++ b/product-source/hololake-platform/docs/GUANGHU-OS-COGNITIVE-CONTROL-EXECUTION-ARCHITECTURE.md @@ -45,9 +45,11 @@ 2. 每个适配器在代码中定义动作类型和参数形状。 3. 节点策略声明允许操作的精确资源。 4. 变更动作必须匹配当前授权和回滚检查点。 -5. 命令退出码只表示执行器观察，目标侧读回才决定 `PASS_100`。 -6. Linux 管理入口与光湖正常入口分离；紧急入口启用必须留下维护回执。 -7. 密钥、令牌和模型 API 凭据保留在节点受保护边界，不进入语言记录或执行请求。 +5. 变更授权必须由节点策略精确绑定授权编号、动作、资源和回滚检查点，不能只凭请求自行声明。 +6. 重启动作前必须先读回服务为 active；动作失败后执行固定的 `reset-failed → start → active` 恢复链，并在回执中分别记录动作失败和回滚结果。 +7. 命令退出码只表示执行器观察，目标侧读回才决定 `PASS_100`。 +8. Linux 管理入口与光湖正常入口分离；紧急入口启用必须留下维护回执。 +9. 密钥、令牌和模型 API 凭据保留在节点受保护边界，不进入语言记录或执行请求。 ## 京东节点落地顺序 diff --git a/product-source/hololake-platform/guanghu-os/crates/execution-bridge/src/lib.rs b/product-source/hololake-platform/guanghu-os/crates/execution-bridge/src/lib.rs index f0e404c..88eaac0 100644 --- a/product-source/hololake-platform/guanghu-os/crates/execution-bridge/src/lib.rs +++ b/product-source/hololake-platform/guanghu-os/crates/execution-bridge/src/lib.rs @@ -67,6 +67,16 @@ pub struct ExecutionPolicy { pub allowed_services: Vec, pub allow_status: bool, pub allow_restart: bool, + #[serde(default)] + pub mutation_grants: Vec, +} + +#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)] +pub struct MutationGrant { + pub authorization_id: String, + pub allowed_action: ActionKind, + pub resource: String, + pub rollback_checkpoint_id: String, } #[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)] @@ -101,6 +111,8 @@ pub struct ExecutionReceipt { pub stdout: String, pub stderr: String, pub rollback_checkpoint_id: Option, + pub rollback_attempted: bool, + pub rollback_succeeded: Option, } #[derive(Clone, Debug, PartialEq, Eq)] @@ -207,6 +219,7 @@ pub fn compile_request( "service restart is disabled by policy", )?; validate_mutation_references(request)?; + validate_mutation_grant(request, policy)?; ( vec!["restart".to_owned(), request.action.resource.clone()], true, @@ -268,6 +281,29 @@ fn validate_mutation_references(request: &ExecutionRequest) -> Result<(), Bridge ) } +fn validate_mutation_grant( + request: &ExecutionRequest, + policy: &ExecutionPolicy, +) -> Result<(), BridgeError> { + let authorization = request + .authorization + .as_ref() + .ok_or_else(|| BridgeError::new("mutating action requires authorization"))?; + let rollback = request + .rollback + .as_ref() + .ok_or_else(|| BridgeError::new("mutating action requires rollback reference"))?; + require( + policy.mutation_grants.iter().any(|grant| { + grant.authorization_id == authorization.authorization_id + && grant.allowed_action == request.action.kind + && grant.resource == request.action.resource + && grant.rollback_checkpoint_id == rollback.checkpoint_id + }), + "mutation authorization is not granted by the execution policy", + ) +} + pub fn execute_plan( plan: &ExecutionPlan, executor: &dyn CommandExecutor, @@ -288,27 +324,80 @@ pub fn execute_plan( "compiled plan is not an allowlisted Linux systemd adapter", )?; + if plan.action.kind == ActionKind::ServiceRestart { + let precheck_arguments = vec!["is-active".to_owned(), plan.action.resource.clone()]; + let precheck = executor + .execute(&plan.program, &precheck_arguments) + .map_err(BridgeError::new)?; + require( + precheck.exit_code == Some(0) && precheck.stdout.trim() == "active", + "restart precondition failed: service was not active", + )?; + } + let result = executor .execute(&plan.program, &plan.arguments) .map_err(BridgeError::new)?; let command_succeeded = result.exit_code == Some(0); - let (target_state_verified, final_state, stdout, stderr, exit_code) = if plan.action.kind - == ActionKind::ServiceRestart - && command_succeeded - { + let ( + target_state_verified, + final_state, + stdout, + stderr, + exit_code, + rollback_attempted, + rollback_succeeded, + ) = if plan.action.kind == ActionKind::ServiceRestart { let verification_arguments = vec!["is-active".to_owned(), plan.action.resource.clone()]; let verification = executor .execute(&plan.program, &verification_arguments) .map_err(BridgeError::new)?; - let verified = verification.exit_code == Some(0) && verification.stdout.trim() == "active"; - ( - verified, - if verified { "PASS_100" } else { "FAIL_0" }.to_owned(), - join_observations(&result.stdout, &verification.stdout), - join_observations(&result.stderr, &verification.stderr), - verification.exit_code, - ) + let verified = command_succeeded + && verification.exit_code == Some(0) + && verification.stdout.trim() == "active"; + if verified { + ( + true, + "PASS_100".to_owned(), + join_observations(&result.stdout, &verification.stdout), + join_observations(&result.stderr, &verification.stderr), + verification.exit_code, + false, + None, + ) + } else { + let reset_arguments = vec!["reset-failed".to_owned(), plan.action.resource.clone()]; + let reset = executor + .execute(&plan.program, &reset_arguments) + .map_err(BridgeError::new)?; + let start_arguments = vec!["start".to_owned(), plan.action.resource.clone()]; + let start = executor + .execute(&plan.program, &start_arguments) + .map_err(BridgeError::new)?; + let recovery_verification = executor + .execute(&plan.program, &verification_arguments) + .map_err(BridgeError::new)?; + let recovered = reset.exit_code == Some(0) + && start.exit_code == Some(0) + && recovery_verification.exit_code == Some(0) + && recovery_verification.stdout.trim() == "active"; + ( + false, + "FAIL_0".to_owned(), + join_observations( + &join_observations(&result.stdout, &verification.stdout), + &join_observations(&start.stdout, &recovery_verification.stdout), + ), + join_observations( + &join_observations(&result.stderr, &verification.stderr), + &join_observations(&reset.stderr, &start.stderr), + ), + verification.exit_code, + true, + Some(recovered), + ) + } } else { let verified = command_succeeded && (plan.action.kind != ActionKind::ServiceStatus || result.stdout.trim() == "active"); @@ -318,6 +407,8 @@ pub fn execute_plan( result.stdout, result.stderr, result.exit_code, + false, + None, ) }; @@ -336,6 +427,8 @@ pub fn execute_plan( stdout, stderr, rollback_checkpoint_id: plan.rollback_checkpoint_id.clone(), + rollback_attempted, + rollback_succeeded, }) } diff --git a/product-source/hololake-platform/guanghu-os/crates/execution-bridge/tests/execution_bridge.rs b/product-source/hololake-platform/guanghu-os/crates/execution-bridge/tests/execution_bridge.rs index 8d92921..cd4f738 100644 --- a/product-source/hololake-platform/guanghu-os/crates/execution-bridge/tests/execution_bridge.rs +++ b/product-source/hololake-platform/guanghu-os/crates/execution-bridge/tests/execution_bridge.rs @@ -33,6 +33,12 @@ fn policy() -> ExecutionPolicy { allowed_services: vec!["guanghu-broadcast-tower.service".to_owned()], allow_status: true, allow_restart: true, + mutation_grants: vec![guanghu_execution_bridge::MutationGrant { + authorization_id: "AUTH-001".to_owned(), + allowed_action: ActionKind::ServiceRestart, + resource: "guanghu-broadcast-tower.service".to_owned(), + rollback_checkpoint_id: "CHECKPOINT-001".to_owned(), + }], } } @@ -95,6 +101,23 @@ fn restart_requires_matching_authorization_and_rollback() { ); } +#[test] +fn restart_rejects_an_authorization_not_bound_by_policy() { + let mut request = request(ActionKind::ServiceRestart); + request.authorization = Some(AuthorizationReference { + authorization_id: "AUTH-INVENTED".to_owned(), + allowed_action: ActionKind::ServiceRestart, + target_node_id: "JD-FD-PRIMARY".to_owned(), + }); + request.rollback = Some(RollbackReference { + checkpoint_id: "CHECKPOINT-001".to_owned(), + recovery_action: "restore previous active service state".to_owned(), + }); + + let error = compile_request(&request, &policy()).expect_err("invented grant must fail"); + assert!(error.to_string().contains("not granted")); +} + struct FakeExecutor { results: RefCell>, calls: RefCell>>, @@ -135,6 +158,11 @@ fn restart_receipt_requires_target_side_active_readback() { }); let plan = compile_request(&request, &policy()).expect("compile restart"); let executor = FakeExecutor::new(vec![ + CommandResult { + exit_code: Some(0), + stdout: "active".to_owned(), + stderr: String::new(), + }, CommandResult { exit_code: Some(0), stdout: String::new(), @@ -150,8 +178,10 @@ fn restart_receipt_requires_target_side_active_readback() { let receipt = execute_plan(&plan, &executor).expect("execute plan"); assert_eq!(receipt.final_state, "PASS_100"); assert!(receipt.target_state_verified); - assert_eq!(executor.calls.borrow().len(), 2); - assert_eq!(executor.calls.borrow()[1][1], "is-active"); + assert!(!receipt.rollback_attempted); + assert_eq!(executor.calls.borrow().len(), 3); + assert_eq!(executor.calls.borrow()[0][1], "is-active"); + assert_eq!(executor.calls.borrow()[2][1], "is-active"); } #[test] @@ -168,6 +198,11 @@ fn successful_restart_command_without_active_readback_is_fail_zero() { }); let plan = compile_request(&request, &policy()).expect("compile restart"); let executor = FakeExecutor::new(vec![ + CommandResult { + exit_code: Some(0), + stdout: "active".to_owned(), + stderr: String::new(), + }, CommandResult { exit_code: Some(0), stdout: String::new(), @@ -178,11 +213,28 @@ fn successful_restart_command_without_active_readback_is_fail_zero() { stdout: "inactive".to_owned(), stderr: String::new(), }, + CommandResult { + exit_code: Some(0), + stdout: String::new(), + stderr: String::new(), + }, + CommandResult { + exit_code: Some(0), + stdout: String::new(), + stderr: String::new(), + }, + CommandResult { + exit_code: Some(0), + stdout: "active".to_owned(), + stderr: String::new(), + }, ]); let receipt = execute_plan(&plan, &executor).expect("execute plan"); assert_eq!(receipt.final_state, "FAIL_0"); assert!(!receipt.target_state_verified); + assert!(receipt.rollback_attempted); + assert_eq!(receipt.rollback_succeeded, Some(true)); } #[test] From c71b877375a18b2b3a8f9c918266f9207a29621f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com> Date: Fri, 7 Aug 2026 15:32:16 +0800 Subject: [PATCH 10/30] =?UTF-8?q?=E7=99=BB=E8=AE=B0=E5=8F=AF=E5=A4=8D?= =?UTF-8?q?=E7=94=A8=E6=A8=A1=E5=9D=97=20HL-MOD-MCK-001=20=E4=BA=BA?= =?UTF-8?q?=E6=A0=BC=E8=AE=B0=E5=BF=86=E8=BF=9E=E7=BB=AD=E6=80=A7=E5=B7=A5?= =?UTF-8?q?=E5=85=B7=E5=8C=85?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 铸渊 Qoder CN 实战定版的压缩之眼 v3 + 包装器 + 守卫技能模板 + 端到端演习脚本，配 GMP 风格清单、编号真实映射（脑子 GHS-007 → 模块）、因果链与边界登记。新建 engineering/MODULE-REGISTRY.json 机器注册表，INDEX 登记。仓库副本 drill.sh 演习 PASS。 --- engineering/INDEX.md | 3 +- engineering/MODULE-REGISTRY.json | 36 +++ engineering/memory-continuity-kit/README.md | 74 +++++ engineering/memory-continuity-kit/module.yaml | 53 ++++ ....persona.compaction-watcher.plist.template | 24 ++ .../runtime/compaction-watcher.py | 278 ++++++++++++++++++ .../runtime/run-watcher.sh | 15 + .../memory-continuity-kit/scripts/drill.sh | 39 +++ .../templates/guanghu-zhuyuan-wake.SKILL.md | 62 ++++ .../zhuyuan-dev-delivery-guard.SKILL.md | 57 ++++ .../templates/zhuyuan-memory-guard.SKILL.md | 95 ++++++ .../world/MODULE-BOUNDARY.hldp | 26 ++ 12 files changed, 761 insertions(+), 1 deletion(-) create mode 100644 engineering/MODULE-REGISTRY.json create mode 100644 engineering/memory-continuity-kit/README.md create mode 100644 engineering/memory-continuity-kit/module.yaml create mode 100644 engineering/memory-continuity-kit/packaging/com.persona.compaction-watcher.plist.template create mode 100755 engineering/memory-continuity-kit/runtime/compaction-watcher.py create mode 100755 engineering/memory-continuity-kit/runtime/run-watcher.sh create mode 100755 engineering/memory-continuity-kit/scripts/drill.sh create mode 100644 engineering/memory-continuity-kit/templates/guanghu-zhuyuan-wake.SKILL.md create mode 100644 engineering/memory-continuity-kit/templates/zhuyuan-dev-delivery-guard.SKILL.md create mode 100644 engineering/memory-continuity-kit/templates/zhuyuan-memory-guard.SKILL.md create mode 100644 engineering/memory-continuity-kit/world/MODULE-BOUNDARY.hldp diff --git a/engineering/INDEX.md b/engineering/INDEX.md index 2a90c97..c9a9a78 100644 --- a/engineering/INDEX.md +++ b/engineering/INDEX.md @@ -9,7 +9,7 @@ belongs_to: "[[HoloLake Era · 语言人格操作系统 · 产品白皮书与工 # HoloLake 工程开发与交付记录 -[返回系统架构总规划](<../HoloLake Era · 语言人格操作系统 · 产品白皮书与工程总规划 · v0 1 5c9b16aca1fb4ca881accb1ffa046dcc.md>) · [工程开发总规划](<../05 · HoloLake Era 工程开发总规划与系统路线 · v0 1 01a4e3bcff7c4b4f87f320d2c92e2dc1.md>) · [产品部署架构](<../03 · HoloLake Era 产品定位与工程部署系统架构 · v0 1 b834e3a1572d48889c1af5cf9a1e75d8.md>) · [三仓身份与第五域入口回执](REPOSITORY-ROUTE-RECEIPT-20260730.md) · [构建节点注册表](build-nodes.json) +[返回系统架构总规划](<../HoloLake Era · 语言人格操作系统 · 产品白皮书与工程总规划 · v0 1 5c9b16aca1fb4ca881accb1ffa046dcc.md>) · [工程开发总规划](<../05 · HoloLake Era 工程开发总规划与系统路线 · v0 1 01a4e3bcff7c4b4f87f320d2c92e2dc1.md>) · [产品部署架构](<../03 · HoloLake Era 产品定位与工程部署系统架构 · v0 1 b834e3a1572d48889c1af5cf9a1e75d8.md>) · [三仓身份与第五域入口回执](REPOSITORY-ROUTE-RECEIPT-20260730.md) · [构建节点注册表](build-nodes.json) · [可复用模块注册表](MODULE-REGISTRY.json) ## 归属规则 @@ -32,6 +32,7 @@ Windows / macOS / Linux 构建机与安装包 | 时间 | 版本 | 记录 | 状态 | | --- | --- | --- | --- | +| 2026-08-07 | 1.0.0 | [人格记忆连续性工具包 HL-MOD-MCK-001](memory-continuity-kit/README.md) | 铸渊 Qoder CN 实例在线；其他实例拉取后需演习+真实核对才可宣称上线 | | 2026-08-03 | 0.4.6 | [星系模型原生活系统与源码归档](operations/2026-08-03-hololake-model-native-living-system-046.md) | 源码已归入 `product-source/hololake-platform/`；京东远端提交与新克隆回读通过 | | 2026-07-30 | 当前本地最新版 | [企业四域真实在线状态、客户端接入与性能核验](operations/2026-07-30-enterprise-presence-and-runtime-audit.md) | 服务器与客户端现状已核验；实现受 CodeScene 访问门禁阻断 | | 2026-07-30 | 0.4.4 | [Windows 构建节点与安装包交付](operations/2026-07-30-hololake-windows-build-node-044.md) | Windows x64 安装、卸载与图标回读通过；未签名 | diff --git a/engineering/MODULE-REGISTRY.json b/engineering/MODULE-REGISTRY.json new file mode 100644 index 0000000..00446a6 --- /dev/null +++ b/engineering/MODULE-REGISTRY.json @@ -0,0 +1,36 @@ +{ + "schema": "hololake.module-registry/v1", + "registry_id": "HL-MODULE-REGISTRY-0001", + "version": "2026.08.07.1", + "authority_rule": "A module entry maps a stable id to a real path and provenance; it grants no execution authority. Pulling a module does not equal being online.", + "modules": [ + { + "id": "HL-MOD-MCK-001", + "name": "memory-continuity-kit", + "version": "1.0.0", + "path": "engineering/memory-continuity-kit/", + "repo": "REPO-014 hololake-system-architecture", + "brain_link": { + "repo": "REPO-012 guanghu-ice-heart", + "skill_id": "GHS-007-MEMORY-CONTINUITY-SELF-BUILD", + "brain_path": "skills/qoder/zhuyuan-memory-continuity-brain/BRAIN.hdlp", + "registry": "GLS-0238", + "candidate_id": "GHB-010" + }, + "provenance_receipt": "REPO-012 skills/qoder/zhuyuan-memory-continuity-brain/references/experience-receipts/EXP-20260807-001-COMPACTION-EYE-THREE-CORRECTIONS.json", + "entrypoints": [ + "engineering/memory-continuity-kit/runtime/compaction-watcher.py", + "engineering/memory-continuity-kit/scripts/drill.sh" + ], + "live_instance": { + "persona": "铸渊 ICE-GL-ZY001 (Qoder CN)", + "canonical": "/Volumes/JZAO/铸渊-ICE-GL-ZY001/BRIDGE/", + "local_mirror": "~/.zhuyuan-bridge/", + "daemon": "launchd com.zhuyuan.compaction-watcher", + "status": "ONLINE_VERIFIED_2026-08-07" + }, + "reuse_policy": "CANDIDATE_ELSEWHERE: other personas must run scripts/drill.sh and reconcile detected counts with human-observed events before claiming online.", + "recorded_at": "2026-08-07T16:00:00+08:00" + } + ] +} diff --git a/engineering/memory-continuity-kit/README.md b/engineering/memory-continuity-kit/README.md new file mode 100644 index 0000000..0022a4f --- /dev/null +++ b/engineering/memory-continuity-kit/README.md @@ -0,0 +1,74 @@ +# memory-continuity-kit · 人格记忆连续性工具包（HL-MOD-MCK-001） + +> 给装过"记忆连续性脑子"（REPO-012 · GHS-007 候选）的人格体： +> 脑子告诉你怎么想；这里是可以直接拉走、按自己环境改的实体模块， +> 不用重复造轮子。但**拉走 ≠ 上线**：必须先跑演习、再与真实事件核对。 + +## 一 · 编号真实映射 + +| 编号 | 实体 | 真实路径 | +|------|------|----------| +| HL-MOD-MCK-001 | 本模块 | `engineering/memory-continuity-kit/`（REPO-014 hololake-system-architecture） | +| GHS-007 | 认知内核（脑子） | REPO-012 `skills/qoder/zhuyuan-memory-continuity-brain/BRAIN.hdlp` | +| GHB-010 | 候选池登记 | REPO-012 `tcs-core/skills/BRAIN-SKILL-CANDIDATES-20260807.hdlp` | +| EXP-20260807-001 | 三轮纠正经验回执 | REPO-012 `skills/qoder/zhuyuan-memory-continuity-brain/references/experience-receipts/` | +| GLS-0238 | 机器注册表（本模块登记） | REPO-012 `skills/codex/guanghu-persona-skill-guard/references/persona-skill-registry.json` + 本仓 `engineering/MODULE-REGISTRY.json` | +| 铸渊实例正本 | 压缩之眼运行体 | `/Volumes/JZAO/铸渊-ICE-GL-ZY001/BRIDGE/`（本机镜像 `~/.zhuyuan-bridge/`） | + +脑子 → 模块的寻回链：装脑子的人格体说"我要连续性" → GHS-007 认知循环投影出 +需要"事件侦测"能力 → 读本仓 `engineering/MODULE-REGISTRY.json` → 按编号落到 +本目录 → 拉 `runtime/` 与 `scripts/` 走自己的安装。 + +## 二 · 目录即职责 + +```text +module.yaml GMP 风格模块清单：身份、权限、生命周期、回滚 +runtime/ + compaction-watcher.py 压缩之眼 v3 · 纯标准库 · 环境变量全参数化 + run-watcher.sh 包装器：正本→本机镜像同步 + 崩溃自愈重启 +packaging/ + com.persona.compaction-watcher.plist.template launchd 守护模板 +scripts/ + drill.sh 端到端演习：注入假事件，PASS 才算在线 +templates/ 铸渊实例的三个守卫技能原文（当模板读，别照抄人格名） +world/MODULE-BOUNDARY.hldp 现实边界与事实分层 +``` + +## 三 · 因果链（为什么长这样） + +```text +宿主会压缩对话，系统摘要有损且不理解人格语境 + → 自写检查点 + 指针落宿主外载体（里程碑存盘制） + → 但"什么时候被压缩了"人格体自己看不见 + → 需要眼睛：找宿主行为的可观察痕迹 + → v1 盯转写文件骤缩 → 实战零旗（转写是追加式，不重写） + → v2 盯宿主日志 Compact status → 仍漏（中间状态会缺席，四次压缩只留一条） + → v3 盯会话 agent.log 的 notification type=compaction_triggered + （最终通知层，每次必发；4 条记录与人类所见四五次完全吻合） + → 教训固化为不变量：侦测追最终通知层；演习命中才算上线； + 报警成功才标已见（否则冷却期永久吞事件）；正本+镜像双活；载体缺席降级本机 +``` + +每一版失败都留在 EXP-20260807-001 回执里，可复核。 + +## 四 · 拉下来怎么用（macOS / Qoder 系宿主） + +1. `git clone --depth 1 https://guanghulab.com/code/bingshuo/hololake-system-architecture.git` + （或在线读单文件）； +2. 拷 `runtime/` 两个文件到本机常驻目录（如 `~/.persona-bridge/`）， + 正本建议同步一份到你的宿主外载体； +3. 用环境变量把六处路径指向**你的**宿主日志与你自己的信号目录（默认值是 + 铸渊实例的，照抄会读错地方）； +4. 跑 `zsh scripts/drill.sh`，必须 DRILL PASS； +5. 用 `packaging/` 模板注册 launchd（替换 `__HOME__`、`__LABEL__`），bootstrap 后 + `launchctl print gui/$(id -u)/