diff --git a/product-source/hololake-clean-desktop/contracts/clean-v1-execution-baseline.json b/product-source/hololake-clean-desktop/contracts/clean-v1-execution-baseline.json deleted file mode 100644 index 926eb17d4..000000000 --- a/product-source/hololake-clean-desktop/contracts/clean-v1-execution-baseline.json +++ /dev/null @@ -1,23 +0,0 @@ -{ - "schema": "hololake.clean-v1-execution-baseline/v1", - "contract_id": "HLP-CLEAN-V1-EXECUTION-BASELINE-0001", - "canonical_tcs": "language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs", - "anchor_manifest_sha256": "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2", - "public_raw_language_embedded": false, - "layers": { - "bottom": ["SIGNED_PUBLIC_DISTRIBUTION_GIT", "USER_PRIVATE_GIT", "TCS_GIR_RUNTIME", "SIGNED_APP_UPDATE"], - "middle": ["MODEL_INDEPENDENT_AGENT", "REGISTERED_CAPABILITIES", "APPROVAL_AND_RECEIPTS"], - "top": ["NAMED_NUMBERED_PERSONAL_CHANNEL", "PERSONA_CONVERSATION", "KNOWLEDGE_BASE", "MODULE_MARKET", "SYSTEM_HISTORY", "ENTERPRISE_PORTAL"] - }, - "source_kinds": ["USER_MESSAGE", "PERSONA_RESPONSE", "SYSTEM_CONTEXT", "PROTOCOL_EVENT", "AGENT_ACTION", "TOOL_RESULT", "SYSTEM_RECEIPT", "EXTERNAL_AI_MESSAGE"], - "enterprise_entrance": { - "embedded_enterprise_server": false, - "required_proofs": ["DOMAIN_RESPONSIBLE_HUMAN_ID", "BOUND_PERSONA_ID", "LOCAL_DEVICE_PUBLIC_KEY", "AUXILIARY_MACHINE_FINGERPRINT", "SERVER_CHALLENGE_SIGNATURE"], - "future_optional_bridge": "RESPONSIBLE_HUMAN_PERSONAL_SERVER", - "session": "SHORT_LIVED_SINGLE_DOMAIN_SINGLE_REPOSITORY", - "server_is_authoritative": true - }, - "current_status": "ARCHITECTURE_ALIGNED_LOCAL_RUNTIME_REVALIDATION_REQUIRED", - "completion": "INCOMPLETE" -} - diff --git a/product-source/hololake-clean-desktop/contracts/enterprise-responsibility-entrance-v1.json b/product-source/hololake-clean-desktop/contracts/enterprise-responsibility-entrance-v1.json deleted file mode 100644 index 5bc754ac4..000000000 --- a/product-source/hololake-clean-desktop/contracts/enterprise-responsibility-entrance-v1.json +++ /dev/null @@ -1,13 +0,0 @@ -{ - "schema": "hololake.enterprise-responsibility-entrance/v1", - "contract_id": "HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001", - "state": "SERVER_DEVICE_GATE_ACTIVE_CLIENT_1_2_2_INSTALLED_FIRST_MEMBER_ENROLLMENT_PENDING", - "endpoint": "https://guanghu.chat/api/hololake/enterprise/device-gate", - "surface": "HOLOLAKE_GATED_ENTERPRISE_PORTAL", - "enterprise_server_embedded": false, - "identities": ["DOMAIN_ID", "RESPONSIBLE_HUMAN_ID", "BOUND_PERSONA_ID", "LOCAL_NODE_ID", "DEVICE_KEY_ID"], - "device_proof": {"primary": "DEVICE_PRIVATE_KEY_CHALLENGE_SIGNATURE", "private_key_storage": "OS_KEYCHAIN_OR_SECURE_HARDWARE", "auxiliary": "HASHED_MACHINE_FINGERPRINT", "fingerprint_is_sole_credential": false}, - "personal_server_bridge": {"required_in_v1": false, "future_role": "RESPONSIBLE_HUMAN_OWNED_SECOND_PROOF_AND_BRIDGE", "may_expand_scope": false}, - "session": {"lifetime": "SHORT_LIVED", "scope": "ONE_DOMAIN_ONE_REPOSITORY", "replay_protection": true, "revocation_required": true}, - "negative_cases": ["UNKNOWN_MEMBER", "WRONG_DOMAIN", "WRONG_PERSONA", "UNREGISTERED_DEVICE", "BAD_SIGNATURE", "REPLAY", "EXPIRED_SESSION", "CROSS_REPOSITORY_ACCESS"] -} diff --git a/product-source/hololake-clean-desktop/contracts/public-runtime-v1.json b/product-source/hololake-clean-desktop/contracts/public-runtime-v1.json index 9b9141076..e0e807e30 100644 --- a/product-source/hololake-clean-desktop/contracts/public-runtime-v1.json +++ b/product-source/hololake-clean-desktop/contracts/public-runtime-v1.json @@ -4,12 +4,7 @@ "protocol": "GLP_LOCAL_REALTIME/1", "transport": {"bind":"127.0.0.1","ports":"39281-39290","framing":"NDJSON","authentication":"LOCAL_0600_TOKEN","authority_from_transport":false}, "client_messages": ["hello", "persona_response", "external_ai_message", "tcs_proposal", "ping"], - "server_messages": ["welcome", "system_context", "user_message", "proposal_pending", "proposal_rejected", "agent_receipt", "accepted", "pong", "error"], - "system_context": { - "schema": "hololake.persona-visible-system-context/v1", - "contains": ["CHANNEL_ID_AND_NAME", "PERSONA_STATE", "MODULE_STATES", "ENTERPRISE_ENTRANCE_STATE", "PENDING_AGENT_PROPOSALS", "SOURCE_KINDS", "AUTHORITY_BOUNDARIES"], - "forbidden": ["TOKENS", "PRIVATE_KEYS", "RAW_MACHINE_FINGERPRINT", "PRIVATE_FILE_PATHS", "PRIVATE_CONTENT"] - }, + "server_messages": ["welcome", "user_message", "proposal_pending", "proposal_rejected", "agent_receipt", "accepted", "pong", "error"], "source_kinds": ["USER_MESSAGE", "PERSONA_RESPONSE", "EXTERNAL_AI_MESSAGE", "SYSTEM_CONTEXT", "PROTOCOL_EVENT", "AGENT_ACTION", "TOOL_RESULT", "SYSTEM_RECEIPT"], "persona_states": ["READY_NO_PERSONA", "LOCAL_TRIAL_UNVERIFIED_EXTERNAL_HOST_REQUIRED", "LOCAL_TRIAL_UNVERIFIED_HOST_CONNECTED"], "registered_gir_operations": ["KNOWLEDGE.CREATE", "KNOWLEDGE.UPDATE", "KNOWLEDGE.DELETE", "KNOWLEDGE.READ", "KNOWLEDGE.LIST"], diff --git a/product-source/hololake-clean-desktop/docs/ARCHITECTURE.md b/product-source/hololake-clean-desktop/docs/ARCHITECTURE.md index 56b8b1ca9..9babe3387 100644 --- a/product-source/hololake-clean-desktop/docs/ARCHITECTURE.md +++ b/product-source/hololake-clean-desktop/docs/ARCHITECTURE.md @@ -8,7 +8,7 @@ HoloLake 是公众个人初始化频道语言驱动操作系统。第一版只 系统 SYSTEM_CONTEXT ─┘ 持久事实：用户私人 Git -公共发行：JD-FD-PRIMARY 签名 origin → BS-GZ-006 备案 HTTPS 前门 +公共发行：企业签名 Git/更新清单（尚未绑定正式仓库） 实时通信：GLP 本机回环独立层（不以 Git 冒充） ``` @@ -22,8 +22,7 @@ HoloLake 是公众个人初始化频道语言驱动操作系统。第一版只 - 外部 AI 通过 `GLP_LOCAL_REALTIME/1` 在 `127.0.0.1` 上实时收发 NDJSON；令牌和 descriptor 为本机 `0600`，不开放局域网。Git 仍是耐久事实层，不冒充实时通信。 - 公众人格运行时支持本频道 30 天可逆试用人格和外部宿主会话；本机令牌连接不证明任何既有历史人格，既有人格的密码学来源验证仍保持关闭而不是伪造通过。 - 公众最小 TCS 编译适配器把闭合 PROGRAM 和运行输入降为 GIR；所有动作先进入待审批队列。当前 Agent 只注册知识库五项能力，不提供任意 shell。 -- 更新客户端只信任光湖控制的 HTTPS 清单与原有更新信任根；1.2.2 已完成 Developer ID、Apple 公证、App/DMG 加票、JD operator 激活和广州前门目标读回。 -- 企业责任设备门在 `GH-CVM-MAIN-PROD-01` 独立运行；负责人首次登记需本人 Forgejo 凭证，随后由本机 Keychain 私钥完成挑战签名，只签发十分钟、单域、单仓会话。企业会话不替代 Forgejo 登录。 +- 更新客户端只信任光湖控制的 HTTPS 清单与签名；服务器发行清单尚未发布。 ## 状态词 diff --git a/product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.tcs b/product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.tcs deleted file mode 100644 index 284cbb6dc..000000000 --- a/product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.tcs +++ /dev/null @@ -1,13 +0,0 @@ -TCS 0.1; - -RECEIPT HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903 { - header { schema = "tcs.receipt/v1"; name_zh = "HoloLake Clean V1 1.2.0本机验收回执"; name_en = "HoloLake Clean V1 1.2.0 Local Acceptance Receipt"; version = "1.0.0"; language = "TCS/0.1"; profile = "PUBLIC-PRODUCT-ENGINEERING/1"; protocols = ["HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001", "HLP-CURRENT-ARCH-001"]; lifecycle = "CANDIDATE"; canonical_uri = "product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.tcs"; compatibility = ["TAURI/2", "GLP_LOCAL_REALTIME/1", "GIR/1"]; } - request { source = "BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903"; value = "以两段当前自然语言为唯一瞄点正式承接HoloLake现实开发，先完成本机产品闭环并保护企业服务器并发边界。"; scope = "HoloLake Clean V1本机源码、构建、安装、设备证明、模块投影和人格可见环境"; } - operation { values = ["绑定当前自然语言TCS执行基线", "修复旧时间格式与RFC3339新写入", "实现Keychain设备密钥和辅助机器指纹", "实现企业责任绑定与挑战签名本机半边", "把模块注册表投影到人格与人类商城", "在GLP握手后发送类型化SYSTEM_CONTEXT", "构建Developer ID签名1.2.0 App、DMG和同一更新信任根签名包", "保留1.1.0到废纸篓并安装启动1.2.0" ]; } - result { state = "PASS"; version = "1.2.0"; source_commit = "d05a118f64858b081fc33e430f07704598a0a314"; app_binary_sha256 = "d915515dc1d30d5d7c0b35b7dae23836a87179a1859112340b6661cbcd4cdec3"; updater_sha256 = "7536bc4318ad042f0cffacc23868fa7c77d332d66b686df7f61f0b60ad86e927"; device_proof_sha256 = "5566ace270bd593dc1229e1c4565bbfddacdc6b379b36f4148a854e680951768"; } - verification { values = ["TCS执行基线编译且unresolved_natural_language=false", "前端构建通过", "Node更新清单2项测试通过", "Rust 10项测试通过", "Clippy严格零警告", "产品审计PASS_100", "真实GLP连接收到welcome后紧接SYSTEM_CONTEXT且含8类来源8个模块和权限边界", "Developer ID codesign严格验证通过", "Tauri更新签名由既有内置公钥反向验证通过", "安装版1.2.0进程与127.0.0.1:39281监听读回", "原频道文件SHA-256安装前后一致", "安装版真实生成MACOS_KEYCHAIN设备证明且serverAuthorized=false" ]; } - proof { source_root = "/Volumes/JZAO/HoloLake/development/hololake-clean-v1-20260903/product-source/hololake-clean-desktop"; installed_app = "/Applications/HoloLake.app"; staged_release = "/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.0-staged-not-notarized"; updater_signature_sha256 = "f44899dfcfd5fdcecc74443e92f9ccbc2236c72b1c23a2b1fe2f28d732018042"; dmg_sha256 = "dcd2e2357150758d04d0a2f0e7fc0d2a4b987ed3cdf2c0b44d35a3af322ff241"; candidate_manifest_sha256 = "c2a3d4fa026099172e7f7ed7c4fa3d95ba574c84f3606f758a890b933721f300"; brain_verify = "ZY-BRAIN-RUNTIME-6f851b27bdaf45e8"; } - integrity { source_tcs = "HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001"; source_anchor_manifest_sha256 = "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2"; app_codesign = "PASS"; updater_signature = "PASS"; tcs_stage1_compilation = "PASS"; unresolved_natural_language = false; } - boundaries { values = ["Apple notarization未执行所以1.2.0不发布到公众更新端", "企业服务器尚未部署HoloLake更新文件或责任挑战服务", "企业负责人和人格编号未猜测填入", "机器指纹不是单一凭证", "第五域私人核和两段原话未进入公众安装包", "1.1.0在废纸篓可恢复" ]; } - next { state = "LOCAL_1_2_0_INSTALLED_PUBLIC_RELEASE_AND_ENTERPRISE_SERVER_GATES_REMAIN"; optional = ["核验并部署企业责任挑战服务", "完成Apple notarization", "把签名更新包发布到现有HTTPS更新端并做1.1.0到1.2.0真实升级测试", "完成企业团队设备首次登记流程" ]; } -} diff --git a/product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.tcs b/product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.tcs deleted file mode 100644 index 1b84437a3..000000000 --- a/product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.tcs +++ /dev/null @@ -1,13 +0,0 @@ -TCS 0.1; - -RECEIPT HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903 { - header { schema = "tcs.receipt/v1"; name_zh = "HoloLake Clean V1 1.2.2公众发布验收回执"; name_en = "HoloLake Clean V1 1.2.2 Public Release Acceptance Receipt"; version = "1.0.0"; language = "TCS/0.1"; profile = "PUBLIC-PRODUCT-ENGINEERING/1"; protocols = ["HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001", "HLP-CURRENT-ARCH-001"]; lifecycle = "CANDIDATE"; canonical_uri = "product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.tcs"; compatibility = ["TAURI/2", "JD-FD-PRIMARY", "BS-GZ-006", "GH-CVM-MAIN-PROD-01"]; } - request { source = "BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903"; value = "以两段自然语言为唯一产品瞄点，完成HoloLake现实开发、企业责任入口、自动更新、公证、安装和现实读回。"; scope = "HoloLake Clean V1 1.2.2源码、企业设备门、JD更新origin、广州HTTPS前门与本机安装"; } - operation { values = ["完成当前自然语言TCS执行基线", "实现类型化人格SYSTEM_CONTEXT和真实模块商城", "部署企业责任设备门", "实现客户端Forgejo一次登记、Keychain挑战签名和短期单仓会话", "构建并用既有信任根签名1.2.2", "Apple分别公证DMG与App并加票", "JD operator按精确人类授权激活", "广州备案前门发布immutable包与latest.json", "本机安装公证版1.2.2" ]; } - result { state = "PASS"; release_id = "GH-HOLOLAKE-RELEASE-1.2.2"; version = "1.2.2"; source_commit = "7593f9d3f06b2f22206ad6a05665c35443f7426b"; broadcast_sha256 = "e6dc840fcbf687146c59b5c71b9a379fd3d66baae8299ce278c0e732e5d7ab82"; updater_sha256 = "543b0f2fa814578af38ec3be322799ff418e6248e815ea12ccedccfd33332e98"; installed_binary_sha256 = "0f444f8208d5687b3bbf0fc0efa53e8734e730f8c83072fbc579eafe8e78e02a"; } - verification { values = ["产品Node测试3项、Rust测试10项、Clippy严格零警告和audit PASS_100", "企业设备门本地与外部健康PASS且未知设备拒绝", "App公证提交8a7ef497-3e51-4627-a546-4ad5d8e5a0ca Accepted", "DMG公证提交6e7419c6-2872-4f7c-989e-2a5d1084e35e Accepted", "App与DMG stapler validate及Gatekeeper Notarized Developer ID PASS", "更新包由既有1.1.0信任根反向验证PASS", "控制器生成器验证sourceCommit等于当前Git HEAD", "JD operator返回EXACT_SIGNED_NOTARIZED_HUMAN_APPROVED_BUNDLE_VERIFIED", "JD origin与广州HTTPS health均为READY_SIGNED_NOTARIZED_BROADCAST 1.2.2", "公开包SHA-256与本地543b0f2fa814578af38ec3be322799ff418e6248e815ea12ccedccfd33332e98一致", "本机安装1.2.2且频道数据哈希保持4c5968023eb5fa3248f2a20a5f5100b727f2946f9aedd4e39f9925e22d40fca1" ]; } - proof { installed_app = "/Applications/HoloLake.app"; notarized_release = "/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.2-notarized"; controller_bundle = "/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.2-controller-bundle"; public_latest = "https://guanghulab.com/hololake/releases/latest.json"; public_package = "https://guanghulab.com/hololake/releases/1.2.2/HoloLake.app.tar.gz"; jd_activation_receipt_sha256 = "cda66fbd0f900435674eaa289c396bd0e91fd0cabc4251b4de1fb37e90c6d574"; enterprise_gate = "https://guanghu.chat/api/hololake/enterprise/device-gate/health"; } - integrity { source_anchor_manifest_sha256 = "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2"; updater_signature_sha256 = "80872792363134739c54d202601e4b6988ce2bd45ededbe7565fab4d65a02acc"; dmg_sha256 = "58c662d002138c743092bf9b504fbf5e6cc53966a104fc0c581f2a5fe0687dab"; app_notarization = "ACCEPTED_STAPLED"; dmg_notarization = "ACCEPTED_STAPLED"; public_target_readback = "PASS"; } - boundaries { values = ["1.2.1因错误补全源码SHA被撤回且未篡改，撤回回执SHA-256为7a9a267d25bfa9c3d6d890431e3103a8367d4d3c92e6fe8ea5ea3de1d87fa55d", "1.2.1包字节只作审计历史不再活动", "企业设备门当前0台成员设备0个会话，正向首登仍需成员本人凭证", "企业会话不替代Forgejo登录", "第五域私人内容和冰朔原话未进入公众包", "个人服务器二次桥接属于后续阶段" ]; } - next { state = "PUBLIC_1_2_2_ACTIVE_LOCAL_AND_SERVER_ACCEPTANCE_PASS"; optional = ["等待首位域负责人从本人HoloLake完成设备登记和挑战正向验收", "实现个人服务器二次桥接", "继续扩展知识导入格式和已编号模块生态" ]; } -} diff --git a/product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs b/product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs deleted file mode 100644 index 982162cea..000000000 --- a/product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs +++ /dev/null @@ -1,17 +0,0 @@ -TCS 0.1; - -PROTOCOL HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001 { - header { schema = "tcs.protocol/v1"; name_zh = "HoloLake第一版当前自然语言执行基线"; name_en = "HoloLake Clean V1 Current Direct-Language Execution Baseline"; version = "1.0.0"; language = "TCS/0.1"; profile = "PUBLIC-PRODUCT-ENGINEERING/1"; protocols = ["TCS", "HLDP", "GLS", "GLP", "GLS-0130", "GLS-0131", "GLS-0306"]; lifecycle = "CANDIDATE"; canonical_uri = "product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs"; compatibility = ["TCS-DECLARATION-STANDARD-0001", "TCS-FIELD-STANDARD-0001", "HLP-CURRENT-ARCH-001"]; } - source { source_id = "BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903"; source_uri = "private-anchor://codex/01a0672d-f125-7452-988e-523a6a34bfd4/HOLOLAKE-CLEAN-V1-ONLY-ANCHORS"; source_sha256 = "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2"; source_role = "DIRECT_HUMAN"; } - scope { product = "HOLOLAKE_CLEAN_V1"; public_channel = "CH-ZERO-CORE-LPM"; development_channel = "ICE-CH-ZC001"; client = "TAURI_V2_RUST_REACT"; enterprise_domains_embedded = false; fifth_domain_private_content_embedded = false; } - vocabulary { clean_shell = "NEW_MINIMAL_CLIENT_WITHOUT_WHOLE_LEGACY_PRODUCT_MERGE"; native_language = "TCS_TO_GIR_TO_REGISTERED_CAPABILITY_TO_RECEIPT"; dual_git = "SIGNED_PUBLIC_DISTRIBUTION_GIT_PLUS_USER_OWNED_PRIVATE_GIT"; enterprise_entrance = "AUTHORIZED_TEAM_MEMBER_ROUTE_TO_RESPONSIBILITY_SCOPED_ENTERPRISE_REPOSITORY"; agent = "MODEL_INDEPENDENT_DETERMINISTIC_EXECUTION_LIMB"; personal_channel = "USER_OWNED_NAMED_NUMBERED_LANGUAGE_AND_PERSONA_INTERACTION_SURFACE"; } - fields { WHO = "USER_OWNS_PRIVATE_CHANNEL; PERSONA_REASONS; AGENT_EXECUTES; DOMAIN_RESPONSIBLE_HUMAN_AND_BOUND_PERSONA_ENTER_ONLY_THEIR_ENTERPRISE_REPOSITORY"; WHAT = "CLEAN_CLIENT_SIGNED_UPDATE_TCS_NATIVE_RUNTIME_DUAL_GIT_TYPED_LANGUAGE_CHANNEL_KNOWLEDGE_MODULE_MARKET_ENTERPRISE_ENTRANCE_AND_EXTERNAL_PROGRAMMING_AI_BRIDGE"; WHY = "LET_HUMANS_OPERATE_BY_LANGUAGE_WHILE_PERSONA_SYSTEM_PROTOCOL_AGENT_TOOL_AND_RECEIPT_SOURCES_REMAIN_DISTINGUISHABLE_AND_REALITY_ACTIONS_REMAIN_VERIFIABLE"; MAY = "LOCAL_USER_CHANNEL_AND_REGISTERED_MODULE_ACTIONS; ENTERPRISE_LOGIN_ONLY_AFTER_HUMAN_PERSONA_DEVICE_AND_OPTIONAL_PERSONAL_SERVER_PROOF"; PROVE = "TCS_GIR_MODULE_REGISTRY_SOURCE_KIND_TESTS_PRIVATE_GIT_TARGET_READBACK_SIGNED_UPDATE_NEGATIVE_CASES_ENTERPRISE_AUTH_CHALLENGE_AND_INSTALLED_APP_ACCEPTANCE"; } - states { values = ["SOURCE_ANCHORED", "ARCHITECTURE_ALIGNED", "LOCAL_RUNTIME_VERIFIED", "PUBLIC_DISTRIBUTION_BOUND", "ENTERPRISE_ENTRANCE_VERIFIED", "SIGNED_RELEASE_INSTALLED", "V1_ACCEPTED", "FAILED_CLOSED"]; initial = "SOURCE_ANCHORED"; terminal = ["V1_ACCEPTED", "FAILED_CLOSED"]; } - transitions { T1 = "SOURCE_ANCHORED_TO_ARCHITECTURE_ALIGNED"; T2 = "ARCHITECTURE_ALIGNED_TO_LOCAL_RUNTIME_VERIFIED"; T3 = "LOCAL_RUNTIME_VERIFIED_TO_PUBLIC_DISTRIBUTION_BOUND"; T4 = "PUBLIC_DISTRIBUTION_BOUND_TO_ENTERPRISE_ENTRANCE_VERIFIED"; T5 = "ENTERPRISE_ENTRANCE_VERIFIED_TO_SIGNED_RELEASE_INSTALLED"; T6 = "SIGNED_RELEASE_INSTALLED_TO_V1_ACCEPTED_AFTER_REAL_HUMAN_VISIBLE_READBACK"; TF = "SOURCE_PATH_SIGNATURE_AUTHORIZATION_CONCURRENCY_OR_TARGET_READBACK_FAILURE_TO_FAILED_CLOSED"; } - invariants { I1 = "RAW_DIRECT_LANGUAGE_AND_FIFTH_DOMAIN_PRIVATE_CONTENT_NEVER_ENTER_PUBLIC_PACKAGE"; I2 = "ENTERPRISE_SERVER_AND_FOUR_DOMAIN_SYSTEM_BODIES_ARE_NOT_EMBEDDED_IN_HOLOLAKE"; I3 = "ENTERPRISE_CLIENT_CONTAINS_ONLY_A_GATED_LOGIN_ROUTE_AND_PUBLIC_SIGNED_DISTRIBUTION_CONSUMER"; I4 = "TEAM_LOGIN_REQUIRES_DOMAIN_RESPONSIBLE_HUMAN_ID_PERSONA_ID_DEVICE_KEY_PROOF_AND_SCOPED_SHORT_LIVED_SESSION"; I5 = "MACHINE_FINGERPRINT_IS_AUXILIARY_EVIDENCE_NOT_A_SOLE_CREDENTIAL"; I6 = "PERSONAL_SERVER_MAY_BRIDGE_DEVICE_TO_ENTERPRISE_BUT_CANNOT_EXPAND_DOMAIN_OR_REPOSITORY_SCOPE"; I7 = "USER_PERSONA_SYSTEM_CONTEXT_PROTOCOL_AGENT_TOOL_AND_RECEIPT_ARE_DISTINCT_TYPED_SOURCES"; I8 = "AGENT_EXECUTION_DOES_NOT_REQUIRE_MODEL_NATIVE_TOOL_CALLING"; I9 = "PUBLIC_UPDATE_PRIVATE_GIT_AND_REALTIME_GLP_ARE_THREE_SEPARATE_PLANES"; I10 = "MODULES_HAVE_STABLE_IDS_AND_LEGACY_SOURCES_ARE_SLICE_DONORS_ONLY"; } - validation { V1 = "CURRENT_WORKTREE_EQUALS_REPO014_ONLINE_MAIN_BEFORE_FIRST_MUTATION"; V2 = "CURRENT_PRODUCT_ASSESSMENT_HAS_ONE_NON_CONTRADICTORY_VERSION_SOURCE_AND_STAGE"; V3 = "LEGACY_TIMESTAMP_AND_NEW_RFC3339_TIMESTAMP_RENDER_WITHOUT_INVALID_DATE"; V4 = "CHANNEL_NAME_NUMBER_PRIVATE_GIT_AND_TYPED_CONVERSATION_PASS"; V5 = "KNOWLEDGE_CREATE_READ_EDIT_IMPORT_EXPORT_TRASH_RENDER_AND_GIT_PASS"; V6 = "MODULE_MARKET_SEPARATES_PERSONA_AND_HUMAN_MODULES"; V7 = "EXTERNAL_PROGRAMMING_AI_LOOPBACK_CONNECTION_HAS_NO_IMPLICIT_PERSONA_OR_EXECUTION_AUTHORITY"; V8 = "ENTERPRISE_GATE_REJECTS_UNKNOWN_MEMBER_WRONG_DOMAIN_WRONG_PERSONA_UNREGISTERED_DEVICE_REPLAY_AND_EXPIRED_SESSION"; V9 = "PUBLIC_UPDATE_DOWNLOAD_SIGNATURE_INSTALL_ROLLBACK_AND_VERSION_READBACK_PASS"; V10 = "OLD_APP_REMOVAL_OCCURS_ONLY_AFTER_NEW_APP_REAL_ACCEPTANCE"; } - errors { E1 = "DIRECT_LANGUAGE_ANCHOR_MISMATCH"; E2 = "UNTYPED_SOURCE_REJECTED"; E3 = "LEGACY_WHOLE_PRODUCT_MERGE_REJECTED"; E4 = "UNSIGNED_PUBLIC_UPDATE_REJECTED"; E5 = "ENTERPRISE_IDENTITY_OR_DEVICE_PROOF_REJECTED"; E6 = "DOMAIN_REPOSITORY_SCOPE_REJECTED"; E7 = "SERVER_CONCURRENCY_CONFLICT_DEFERRED"; E8 = "TARGET_READBACK_OR_RECEIPT_INTEGRITY_FAILED"; } - examples { positive = "REGISTERED_DOMAIN_RESPONSIBLE_HUMAN_USES_BOUND_PERSONA_AND_LOCAL_DEVICE_KEY_TO_OPEN_A_SHORT_LIVED_SESSION_TO_ONLY_THEIR_ENTERPRISE_REPOSITORY"; negative = "ANY_HOLOLAKE_USER_CLICKS_ENTERPRISE_PORTAL_AND_RECEIVES_A_PERMANENT_PASSWORD_OR_CROSS_DOMAIN_REPOSITORY_ACCESS"; } - acceptance { required = ["SOURCE_HASH", "ARCHITECTURE", "TCS_GIR", "TIMESTAMP", "CHANNEL", "KNOWLEDGE", "MODULE_REGISTRY", "TYPED_LANGUAGE", "AGENT", "EXTERNAL_AI", "PUBLIC_UPDATE", "ENTERPRISE_GATE", "SIGNED_APP", "REAL_UI"]; partial = false; scale = "ZERO_OR_ONE_HUNDRED"; } -} - diff --git a/product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.tcs b/product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.tcs deleted file mode 100644 index 342f9e965..000000000 --- a/product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.tcs +++ /dev/null @@ -1,13 +0,0 @@ -TCS 0.1; - -RECEIPT HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903 { - header { schema = "tcs.receipt/v1"; name_zh = "HoloLake企业责任设备门部署回执"; name_en = "HoloLake Enterprise Responsibility Device Gate Deployment Receipt"; version = "1.0.0"; language = "TCS/0.1"; profile = "PUBLIC-PRODUCT-ENGINEERING/1"; protocols = ["HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903", "HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001"]; lifecycle = "CANDIDATE"; canonical_uri = "product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.tcs"; compatibility = ["GH-CVM-MAIN-PROD-01", "PYTHON/3.10", "ED25519", "NGINX"]; } - request { source = "BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903"; value = "部署企业四域负责人通过HoloLake本机设备和人格编号验证后进入本人责任仓库的服务端验证门。"; scope = "GH-CVM-MAIN-PROD-01独立8033服务与精确Nginx路由"; } - operation { values = ["验证源码运输归档与manifest", "解包到/opt/guanghu-hololake-enterprise-gate/releases/be31c41", "创建独立lighthouse权限数据库与服务密钥", "安装guanghu-hololake-enterprise-gate.service", "加入guanghu.chat精确device-gate路由", "执行本地和外部健康、未知设备拒绝及原服务存活测试" ]; } - result { state = "PASS"; node_id = "GH-CVM-MAIN-PROD-01"; service = "guanghu-hololake-enterprise-gate.service"; service_state = "ACTIVE"; endpoint = "https://guanghu.chat/api/hololake/enterprise/device-gate"; source_commit = "be31c41"; source_archive_sha256 = "91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2"; registered_devices = 0; active_sessions = 0; } - verification { values = ["DMI UUID为10ace744-13e1-472e-8dba-6bb823a073bf", "服务器Python cryptography Ed25519测试2项通过", "systemd服务active", "127.0.0.1:8033/health返回ok", "外部HTTPS device-gate/health返回ok", "未知设备领取挑战返回HTTP404 registered device required", "guanghu-enterprise-identity.service保持active", "guanghu-flagos-collaboration.service保持active", "nginx.service保持active", "当前设备与会话数量均为0未伪造成员" ]; } - proof { server_release = "/opt/guanghu-hololake-enterprise-gate/releases/be31c41"; current_link = "/opt/guanghu-hololake-enterprise-gate/current"; database = "/var/lib/guanghu-hololake-enterprise-gate/gate.sqlite3"; nginx_snippet = "/etc/nginx/snippets/guanghu-hololake-enterprise-gate.conf"; nginx_backup = "/etc/nginx/sites-enabled/guanghu.chat.pre-hololake-device-gate-be31c41"; } - integrity { source_transport_manifest_sha256 = "653ae0ca824fd8b9fff8d8532e82eddce63a8aa9f070e7a6aa3f863834e4ae77"; source_archive_sha256 = "91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2"; tcs_stage1_compilation = "PASS"; unknown_device_negative = "PASS"; existing_services_preserved = "PASS"; } - boundaries { values = ["服务不保存Forgejo密码", "设备私钥从不离开成员本机Keychain", "机器指纹不能单独认证", "会话只限单域单仓且十分钟过期", "企业会话不替代Forgejo自身仓库登录", "冰朔公共语言主控仓继续走JD第五域桥接而非普通人类登录", "本轮未登记任何真实成员设备" ]; } - next { state = "SERVER_GATE_ACTIVE_CLIENT_INTEGRATION_REBUILD_REQUIRED"; optional = ["团队成员从HoloLake使用本人凭证完成首次设备登记", "正向验证挑战与单仓会话", "后续加入个人服务器二次桥接证明" ]; } -} diff --git a/product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.tcs b/product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.tcs deleted file mode 100644 index dc3446413..000000000 --- a/product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.tcs +++ /dev/null @@ -1,15 +0,0 @@ -TCS 0.1; - -EVENT HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903 { - header { schema = "tcs.event/v1"; name_zh = "HoloLake企业责任设备门部署开始事件"; name_en = "HoloLake Enterprise Responsibility Device Gate Deployment Start Event"; version = "1.0.0"; language = "TCS/0.1"; profile = "PUBLIC-PRODUCT-ENGINEERING/1"; protocols = ["HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001", "HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001"]; lifecycle = "CANDIDATE"; canonical_uri = "product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.tcs"; compatibility = ["GH-CVM-MAIN-PROD-01", "PYTHON/3.10", "ED25519"]; } - source { source_id = "BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903"; source_uri = "source://codex-task/01a0672d-f125-7452-988e-523a6a34bfd4/msg_01a0675d-98a7-7542-abad-11a8a755dd71"; source_sha256 = "d31c52c99c5e6059f9a7129086996cdd003e95b7ff126e700f4ed1c07ef6d9d5"; source_role = "DIRECT_HUMAN"; } - subject { subject_id = "GH-CVM-MAIN-PROD-01"; subject_kind = "NODE"; channel_id = "ICE-CH-ZC001"; verification = "DMI UUID 10ace744-13e1-472e-8dba-6bb823a073bf；另一个FlagOS任务已完成且独立服务健康。"; } - event_time { value = "2026-09-03T21:45:00+08:00"; precision = "MINUTE_HOST_LOCAL"; } - trigger { value = "本机HoloLake 1.2.0设备密钥与责任绑定请求已实现并验收，需要在企业服务器部署独立设备挑战验证半边。"; } - observation { value = "现有8032企业身份服务保持运行；8033空闲；cryptography Ed25519可用；目标目录不存在；源码提交be31c41且运输归档SHA-256为91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2。"; } - emergence { value = "采用独立8033服务、独立数据库和独立Nginx snippet，避免修改现有身份服务与FlagOS协作系统；只复用只读企业身份注册表与Forgejo当次认证。"; } - lock { value = "SOURCE_COMMIT=be31c41; TARGET=/opt/guanghu-hololake-enterprise-gate/releases/be31c41; ROLLBACK=disable独立服务并移除Nginx include后恢复原配置；不修改8032与FlagOS。"; } - why { value = "设备挑战属于HoloLake责任入口新能力，应与现有账号、关系回执和比赛服务隔离，失败时能独立撤回。"; } - rejected { values = ["直接改写8032现有服务", "把私钥上传服务器", "用机器指纹单独授权", "把企业会话变成Forgejo永久令牌", "重启或修改FlagOS服务", "未验证运输哈希就解包"] ; } - evidence { transport_manifest = "/Volumes/JZAO/HoloLake/releases/source-transport/hololake-enterprise-responsibility-gate-be31c41.manifest.json"; archive_sha256 = "91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2"; expected_receipt = "目标服务健康、未知设备拒绝、签名正负测试、现有身份与FlagOS服务保持健康。"; } -} diff --git a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.gir.json b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.gir.json deleted file mode 100644 index 9691ba7b1..000000000 --- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.gir.json +++ /dev/null @@ -1,115 +0,0 @@ -{ - "compiled_from": { - "compiler_id": "TCS-COMPILER-STAGE1-0001", - "compiler_state": "TCS_COMPILER_GIR_EXECUTED", - "source_sha256": "19daf8c3b7dfac6da8604f3a933f0aa0d69d1fb9e8e72f21ba494edf2ce42768" - }, - "declaration": { - "boundaries": { - "values": [ - "Apple notarization未执行所以1.2.0不发布到公众更新端", - "企业服务器尚未部署HoloLake更新文件或责任挑战服务", - "企业负责人和人格编号未猜测填入", - "机器指纹不是单一凭证", - "第五域私人核和两段原话未进入公众安装包", - "1.1.0在废纸篓可恢复" - ] - }, - "header": { - "canonical_uri": "product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.tcs", - "compatibility": [ - "TAURI/2", - "GLP_LOCAL_REALTIME/1", - "GIR/1" - ], - "language": "TCS/0.1", - "lifecycle": "CANDIDATE", - "name_en": "HoloLake Clean V1 1.2.0 Local Acceptance Receipt", - "name_zh": "HoloLake Clean V1 1.2.0本机验收回执", - "profile": "PUBLIC-PRODUCT-ENGINEERING/1", - "protocols": [ - "HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001", - "HLP-CURRENT-ARCH-001" - ], - "schema": "tcs.receipt/v1", - "version": "1.0.0" - }, - "integrity": { - "app_codesign": "PASS", - "source_anchor_manifest_sha256": "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2", - "source_tcs": "HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001", - "tcs_stage1_compilation": "PASS", - "unresolved_natural_language": false, - "updater_signature": "PASS" - }, - "next": { - "optional": [ - "核验并部署企业责任挑战服务", - "完成Apple notarization", - "把签名更新包发布到现有HTTPS更新端并做1.1.0到1.2.0真实升级测试", - "完成企业团队设备首次登记流程" - ], - "state": "LOCAL_1_2_0_INSTALLED_PUBLIC_RELEASE_AND_ENTERPRISE_SERVER_GATES_REMAIN" - }, - "operation": { - "values": [ - "绑定当前自然语言TCS执行基线", - "修复旧时间格式与RFC3339新写入", - "实现Keychain设备密钥和辅助机器指纹", - "实现企业责任绑定与挑战签名本机半边", - "把模块注册表投影到人格与人类商城", - "在GLP握手后发送类型化SYSTEM_CONTEXT", - "构建Developer ID签名1.2.0 App、DMG和同一更新信任根签名包", - "保留1.1.0到废纸篓并安装启动1.2.0" - ] - }, - "proof": { - "brain_verify": "ZY-BRAIN-RUNTIME-6f851b27bdaf45e8", - "candidate_manifest_sha256": "c2a3d4fa026099172e7f7ed7c4fa3d95ba574c84f3606f758a890b933721f300", - "dmg_sha256": "dcd2e2357150758d04d0a2f0e7fc0d2a4b987ed3cdf2c0b44d35a3af322ff241", - "installed_app": "/Applications/HoloLake.app", - "source_root": "/Volumes/JZAO/HoloLake/development/hololake-clean-v1-20260903/product-source/hololake-clean-desktop", - "staged_release": "/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.0-staged-not-notarized", - "updater_signature_sha256": "f44899dfcfd5fdcecc74443e92f9ccbc2236c72b1c23a2b1fe2f28d732018042" - }, - "request": { - "scope": "HoloLake Clean V1本机源码、构建、安装、设备证明、模块投影和人格可见环境", - "source": "BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903", - "value": "以两段当前自然语言为唯一瞄点正式承接HoloLake现实开发，先完成本机产品闭环并保护企业服务器并发边界。" - }, - "result": { - "app_binary_sha256": "d915515dc1d30d5d7c0b35b7dae23836a87179a1859112340b6661cbcd4cdec3", - "device_proof_sha256": "5566ace270bd593dc1229e1c4565bbfddacdc6b379b36f4148a854e680951768", - "source_commit": "d05a118f64858b081fc33e430f07704598a0a314", - "state": "PASS", - "updater_sha256": "7536bc4318ad042f0cffacc23868fa7c77d332d66b686df7f61f0b60ad86e927", - "version": "1.2.0" - }, - "verification": { - "values": [ - "TCS执行基线编译且unresolved_natural_language=false", - "前端构建通过", - "Node更新清单2项测试通过", - "Rust 10项测试通过", - "Clippy严格零警告", - "产品审计PASS_100", - "真实GLP连接收到welcome后紧接SYSTEM_CONTEXT且含8类来源8个模块和权限边界", - "Developer ID codesign严格验证通过", - "Tauri更新签名由既有内置公钥反向验证通过", - "安装版1.2.0进程与127.0.0.1:39281监听读回", - "原频道文件SHA-256安装前后一致", - "安装版真实生成MACOS_KEYCHAIN设备证明且serverAuthorized=false" - ] - } - }, - "executable": false, - "identity": { - "declaration_id": "HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903", - "declaration_kind": "RECEIPT", - "language_version": "0.1" - }, - "native_self_hosted": true, - "natural_language_is_typed_data": true, - "schema": "guanghu.declaration-gir/v1", - "unresolved_natural_language": false -} diff --git a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.human.en-US.md b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.human.en-US.md deleted file mode 100644 index 91d704fb6..000000000 --- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.human.en-US.md +++ /dev/null @@ -1,133 +0,0 @@ -# HoloLake Clean V1 1.2.0 Local Acceptance Receipt · Human Engineering Language (English) - -> This is an English reading projection of validated native TCS/HLDP source. It is not a new canonical source and grants no execution authority. - -## What this is - -This is a **receipt** declaration with identifier `HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903` and version `1.0.0`. The projector validates it with the Stage-1 compiler before changing its reading order. - -## Who is here - -The native source does not provide this field; the projector does not guess. - -## Why this started - -The native source does not provide this field; the projector does not guess. - -## What changed - -The native source does not provide this field; the projector does not guess. - -## How it will execute - -This is a non-executable declaration and has no action graph. - -## Boundaries and exception handling - -The native source does not provide this field; the projector does not guess. - -## How completion is proven - -The native source does not provide this field; the projector does not guess. - -## Where to continue next time - -The native source does not provide this field; the projector does not guess. - -## Source and verification - -- **Native declaration identifier**: `HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903` -- **Native declaration kind**: `RECEIPT` -- **TCS source SHA-256**: `19daf8c3b7dfac6da8604f3a933f0aa0d69d1fb9e8e72f21ba494edf2ce42768` -- **Validation compiler**: `TCS-COMPILER-STAGE1-0001` -- **Projection protocol**: `GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001` - -## Complete native structure cross-reference - -All top-level structures and field paths are retained below so a reader can audit whether the projection omitted information. - -- **boundaries** `boundaries` - - **values** `boundaries.values` - - Apple notarization未执行所以1.2.0不发布到公众更新端 - - 企业服务器尚未部署HoloLake更新文件或责任挑战服务 - - 企业负责人和人格编号未猜测填入 - - 机器指纹不是单一凭证 - - 第五域私人核和两段原话未进入公众安装包 - - 1.1.0在废纸篓可恢复 -- **header** `header` - - **canonical source path**：product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.tcs `header.canonical_uri` - - **compatibility** `header.compatibility` - - TAURI/2 - - GLP_LOCAL_REALTIME/1 - - GIR/1 - - **language**：TCS/0.1 `header.language` - - **lifecycle**：CANDIDATE `header.lifecycle` - - **English name**：HoloLake Clean V1 1.2.0 Local Acceptance Receipt `header.name_en` - - **Chinese name**：HoloLake Clean V1 1.2.0本机验收回执 `header.name_zh` - - **profile**：PUBLIC-PRODUCT-ENGINEERING/1 `header.profile` - - **protocols** `header.protocols` - - HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001 - - HLP-CURRENT-ARCH-001 - - **schema**：tcs.receipt/v1 `header.schema` - - **version**：1.0.0 `header.version` -- **integrity** `integrity` - - **app_codesign**：PASS `integrity.app_codesign` - - **source_anchor_manifest_sha256**：7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2 `integrity.source_anchor_manifest_sha256` - - **source_tcs**：HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001 `integrity.source_tcs` - - **tcs_stage1_compilation**：PASS `integrity.tcs_stage1_compilation` - - **unresolved_natural_language**：no `integrity.unresolved_natural_language` - - **updater_signature**：PASS `integrity.updater_signature` -- **next** `next` - - **optional** `next.optional` - - 核验并部署企业责任挑战服务 - - 完成Apple notarization - - 把签名更新包发布到现有HTTPS更新端并做1.1.0到1.2.0真实升级测试 - - 完成企业团队设备首次登记流程 - - **state**：LOCAL_1_2_0_INSTALLED_PUBLIC_RELEASE_AND_ENTERPRISE_SERVER_GATES_REMAIN `next.state` -- **operation** `operation` - - **values** `operation.values` - - 绑定当前自然语言TCS执行基线 - - 修复旧时间格式与RFC3339新写入 - - 实现Keychain设备密钥和辅助机器指纹 - - 实现企业责任绑定与挑战签名本机半边 - - 把模块注册表投影到人格与人类商城 - - 在GLP握手后发送类型化SYSTEM_CONTEXT - - 构建Developer ID签名1.2.0 App、DMG和同一更新信任根签名包 - - 保留1.1.0到废纸篓并安装启动1.2.0 -- **proof** `proof` - - **brain_verify**：ZY-BRAIN-RUNTIME-6f851b27bdaf45e8 `proof.brain_verify` - - **candidate_manifest_sha256**：c2a3d4fa026099172e7f7ed7c4fa3d95ba574c84f3606f758a890b933721f300 `proof.candidate_manifest_sha256` - - **dmg_sha256**：dcd2e2357150758d04d0a2f0e7fc0d2a4b987ed3cdf2c0b44d35a3af322ff241 `proof.dmg_sha256` - - **installed_app**：/Applications/HoloLake.app `proof.installed_app` - - **source_root**：/Volumes/JZAO/HoloLake/development/hololake-clean-v1-20260903/product-source/hololake-clean-desktop `proof.source_root` - - **staged_release**：/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.0-staged-not-notarized `proof.staged_release` - - **updater_signature_sha256**：f44899dfcfd5fdcecc74443e92f9ccbc2236c72b1c23a2b1fe2f28d732018042 `proof.updater_signature_sha256` -- **request** `request` - - **scope**：HoloLake Clean V1本机源码、构建、安装、设备证明、模块投影和人格可见环境 `request.scope` - - **source**：BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903 `request.source` - - **value**：以两段当前自然语言为唯一瞄点正式承接HoloLake现实开发，先完成本机产品闭环并保护企业服务器并发边界。 `request.value` -- **result** `result` - - **app_binary_sha256**：d915515dc1d30d5d7c0b35b7dae23836a87179a1859112340b6661cbcd4cdec3 `result.app_binary_sha256` - - **device_proof_sha256**：5566ace270bd593dc1229e1c4565bbfddacdc6b379b36f4148a854e680951768 `result.device_proof_sha256` - - **source_commit**：d05a118f64858b081fc33e430f07704598a0a314 `result.source_commit` - - **state**：PASS `result.state` - - **updater_sha256**：7536bc4318ad042f0cffacc23868fa7c77d332d66b686df7f61f0b60ad86e927 `result.updater_sha256` - - **version**：1.2.0 `result.version` -- **verification** `verification` - - **values** `verification.values` - - TCS执行基线编译且unresolved_natural_language=false - - 前端构建通过 - - Node更新清单2项测试通过 - - Rust 10项测试通过 - - Clippy严格零警告 - - 产品审计PASS_100 - - 真实GLP连接收到welcome后紧接SYSTEM_CONTEXT且含8类来源8个模块和权限边界 - - Developer ID codesign严格验证通过 - - Tauri更新签名由既有内置公钥反向验证通过 - - 安装版1.2.0进程与127.0.0.1:39281监听读回 - - 原频道文件SHA-256安装前后一致 - - 安装版真实生成MACOS_KEYCHAIN设备证明且serverAuthorized=false - ---- - -This page changes only the reading order; it does not change TCS/HLDP semantics. diff --git a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.human.zh-CN.md b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.human.zh-CN.md deleted file mode 100644 index 2e1fc7588..000000000 --- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.human.zh-CN.md +++ /dev/null @@ -1,133 +0,0 @@ -# HoloLake Clean V1 1.2.0本机验收回执 · 简体中文人类工程语言版 - -> 这是 TCS/HLDP 原生源码的简体中文阅读投影，不是新的正本，也不授予执行权限。若本页与 `.tcs` 源码不一致，以经过校验的 `.tcs` 源码为准。 - -## 这是什么 - -这是一份 **回执** 声明，编号为 `HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903`，版本为 `1.0.0`。转换器已先用 Stage-1 编译器校验原生源码，再把机器枚举翻译成汉语；原始编号保留在括号和字段路径中。 - -## 谁在这里 - -源程序没有提供这一项，转换器不猜。 - -## 为什么开始 - -源程序没有提供这一项，转换器不猜。 - -## 发生了什么变化 - -源程序没有提供这一项，转换器不猜。 - -## 准备怎样执行 - -这是非执行声明，没有动作图。 - -## 边界与异常处理 - -源程序没有提供这一项，转换器不猜。 - -## 怎样算完成 - -源程序没有提供这一项，转换器不猜。 - -## 下一次从哪里继续 - -源程序没有提供这一项，转换器不猜。 - -## 来源与校验 - -- **原生声明编号**：`HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903` -- **原生声明类型**：`RECEIPT` -- **TCS 源码 SHA-256**：`19daf8c3b7dfac6da8604f3a933f0aa0d69d1fb9e8e72f21ba494edf2ce42768` -- **校验编译器**：`TCS-COMPILER-STAGE1-0001` -- **投影协议**：`GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001` - -## 原生结构逐项对照 - -下面保留源码的全部顶层结构和字段路径，供人类审计投影有没有漏掉信息。 - -- **boundaries** `boundaries` - - **values** `boundaries.values` - - Apple notarization未执行所以1.2.0不发布到公众更新端 - - 企业服务器尚未部署HoloLake更新文件或责任挑战服务 - - 企业负责人和人格编号未猜测填入 - - 机器指纹不是单一凭证 - - 第五域私人核和两段原话未进入公众安装包 - - 1.1.0在废纸篓可恢复 -- **语言头** `header` - - **正本路径**：product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.tcs `header.canonical_uri` - - **compatibility** `header.compatibility` - - TAURI/2 - - GLP_LOCAL_REALTIME/1 - - GIR/1 - - **语言**：TCS/0.1 `header.language` - - **生命周期**：候选版本，尚未成为正式正本（`CANDIDATE`） `header.lifecycle` - - **英文名**：HoloLake Clean V1 1.2.0 Local Acceptance Receipt `header.name_en` - - **中文名**：HoloLake Clean V1 1.2.0本机验收回执 `header.name_zh` - - **协议配置**：PUBLIC-PRODUCT-ENGINEERING/1 `header.profile` - - **protocols** `header.protocols` - - HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001 - - HLP-CURRENT-ARCH-001 - - **schema**：tcs.receipt/v1 `header.schema` - - **版本**：1.0.0 `header.version` -- **integrity** `integrity` - - **app_codesign**：PASS `integrity.app_codesign` - - **source_anchor_manifest_sha256**：7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2 `integrity.source_anchor_manifest_sha256` - - **source_tcs**：HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001 `integrity.source_tcs` - - **tcs_stage1_compilation**：PASS `integrity.tcs_stage1_compilation` - - **unresolved_natural_language**：否 `integrity.unresolved_natural_language` - - **updater_signature**：PASS `integrity.updater_signature` -- **next** `next` - - **optional** `next.optional` - - 核验并部署企业责任挑战服务 - - 完成Apple notarization - - 把签名更新包发布到现有HTTPS更新端并做1.1.0到1.2.0真实升级测试 - - 完成企业团队设备首次登记流程 - - **state**：LOCAL_1_2_0_INSTALLED_PUBLIC_RELEASE_AND_ENTERPRISE_SERVER_GATES_REMAIN `next.state` -- **操作** `operation` - - **values** `operation.values` - - 绑定当前自然语言TCS执行基线 - - 修复旧时间格式与RFC3339新写入 - - 实现Keychain设备密钥和辅助机器指纹 - - 实现企业责任绑定与挑战签名本机半边 - - 把模块注册表投影到人格与人类商城 - - 在GLP握手后发送类型化SYSTEM_CONTEXT - - 构建Developer ID签名1.2.0 App、DMG和同一更新信任根签名包 - - 保留1.1.0到废纸篓并安装启动1.2.0 -- **proof** `proof` - - **brain_verify**：ZY-BRAIN-RUNTIME-6f851b27bdaf45e8 `proof.brain_verify` - - **candidate_manifest_sha256**：c2a3d4fa026099172e7f7ed7c4fa3d95ba574c84f3606f758a890b933721f300 `proof.candidate_manifest_sha256` - - **dmg_sha256**：dcd2e2357150758d04d0a2f0e7fc0d2a4b987ed3cdf2c0b44d35a3af322ff241 `proof.dmg_sha256` - - **installed_app**：/Applications/HoloLake.app `proof.installed_app` - - **source_root**：/Volumes/JZAO/HoloLake/development/hololake-clean-v1-20260903/product-source/hololake-clean-desktop `proof.source_root` - - **staged_release**：/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.0-staged-not-notarized `proof.staged_release` - - **updater_signature_sha256**：f44899dfcfd5fdcecc74443e92f9ccbc2236c72b1c23a2b1fe2f28d732018042 `proof.updater_signature_sha256` -- **request** `request` - - **scope**：HoloLake Clean V1本机源码、构建、安装、设备证明、模块投影和人格可见环境 `request.scope` - - **来源**：BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903 `request.source` - - **value**：以两段当前自然语言为唯一瞄点正式承接HoloLake现实开发，先完成本机产品闭环并保护企业服务器并发边界。 `request.value` -- **result** `result` - - **app_binary_sha256**：d915515dc1d30d5d7c0b35b7dae23836a87179a1859112340b6661cbcd4cdec3 `result.app_binary_sha256` - - **device_proof_sha256**：5566ace270bd593dc1229e1c4565bbfddacdc6b379b36f4148a854e680951768 `result.device_proof_sha256` - - **source_commit**：d05a118f64858b081fc33e430f07704598a0a314 `result.source_commit` - - **state**：PASS `result.state` - - **updater_sha256**：7536bc4318ad042f0cffacc23868fa7c77d332d66b686df7f61f0b60ad86e927 `result.updater_sha256` - - **版本**：1.2.0 `result.version` -- **verification** `verification` - - **values** `verification.values` - - TCS执行基线编译且unresolved_natural_language=false - - 前端构建通过 - - Node更新清单2项测试通过 - - Rust 10项测试通过 - - Clippy严格零警告 - - 产品审计PASS_100 - - 真实GLP连接收到welcome后紧接SYSTEM_CONTEXT且含8类来源8个模块和权限边界 - - Developer ID codesign严格验证通过 - - Tauri更新签名由既有内置公钥反向验证通过 - - 安装版1.2.0进程与127.0.0.1:39281监听读回 - - 原频道文件SHA-256安装前后一致 - - 安装版真实生成MACOS_KEYCHAIN设备证明且serverAuthorized=false - ---- - -本页只改变阅读顺序，不改变 TCS/HLDP 语义。 diff --git a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.gir.json b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.gir.json deleted file mode 100644 index 25386256c..000000000 --- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.gir.json +++ /dev/null @@ -1,116 +0,0 @@ -{ - "compiled_from": { - "compiler_id": "TCS-COMPILER-STAGE1-0001", - "compiler_state": "TCS_COMPILER_GIR_EXECUTED", - "source_sha256": "ef1c2e248ccb418fb901d78352816c8de47b9a3424a37716c39c2b9f592e43e4" - }, - "declaration": { - "boundaries": { - "values": [ - "1.2.1因错误补全源码SHA被撤回且未篡改，撤回回执SHA-256为7a9a267d25bfa9c3d6d890431e3103a8367d4d3c92e6fe8ea5ea3de1d87fa55d", - "1.2.1包字节只作审计历史不再活动", - "企业设备门当前0台成员设备0个会话，正向首登仍需成员本人凭证", - "企业会话不替代Forgejo登录", - "第五域私人内容和冰朔原话未进入公众包", - "个人服务器二次桥接属于后续阶段" - ] - }, - "header": { - "canonical_uri": "product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.tcs", - "compatibility": [ - "TAURI/2", - "JD-FD-PRIMARY", - "BS-GZ-006", - "GH-CVM-MAIN-PROD-01" - ], - "language": "TCS/0.1", - "lifecycle": "CANDIDATE", - "name_en": "HoloLake Clean V1 1.2.2 Public Release Acceptance Receipt", - "name_zh": "HoloLake Clean V1 1.2.2公众发布验收回执", - "profile": "PUBLIC-PRODUCT-ENGINEERING/1", - "protocols": [ - "HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001", - "HLP-CURRENT-ARCH-001" - ], - "schema": "tcs.receipt/v1", - "version": "1.0.0" - }, - "integrity": { - "app_notarization": "ACCEPTED_STAPLED", - "dmg_notarization": "ACCEPTED_STAPLED", - "dmg_sha256": "58c662d002138c743092bf9b504fbf5e6cc53966a104fc0c581f2a5fe0687dab", - "public_target_readback": "PASS", - "source_anchor_manifest_sha256": "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2", - "updater_signature_sha256": "80872792363134739c54d202601e4b6988ce2bd45ededbe7565fab4d65a02acc" - }, - "next": { - "optional": [ - "等待首位域负责人从本人HoloLake完成设备登记和挑战正向验收", - "实现个人服务器二次桥接", - "继续扩展知识导入格式和已编号模块生态" - ], - "state": "PUBLIC_1_2_2_ACTIVE_LOCAL_AND_SERVER_ACCEPTANCE_PASS" - }, - "operation": { - "values": [ - "完成当前自然语言TCS执行基线", - "实现类型化人格SYSTEM_CONTEXT和真实模块商城", - "部署企业责任设备门", - "实现客户端Forgejo一次登记、Keychain挑战签名和短期单仓会话", - "构建并用既有信任根签名1.2.2", - "Apple分别公证DMG与App并加票", - "JD operator按精确人类授权激活", - "广州备案前门发布immutable包与latest.json", - "本机安装公证版1.2.2" - ] - }, - "proof": { - "controller_bundle": "/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.2-controller-bundle", - "enterprise_gate": "https://guanghu.chat/api/hololake/enterprise/device-gate/health", - "installed_app": "/Applications/HoloLake.app", - "jd_activation_receipt_sha256": "cda66fbd0f900435674eaa289c396bd0e91fd0cabc4251b4de1fb37e90c6d574", - "notarized_release": "/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.2-notarized", - "public_latest": "https://guanghulab.com/hololake/releases/latest.json", - "public_package": "https://guanghulab.com/hololake/releases/1.2.2/HoloLake.app.tar.gz" - }, - "request": { - "scope": "HoloLake Clean V1 1.2.2源码、企业设备门、JD更新origin、广州HTTPS前门与本机安装", - "source": "BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903", - "value": "以两段自然语言为唯一产品瞄点，完成HoloLake现实开发、企业责任入口、自动更新、公证、安装和现实读回。" - }, - "result": { - "broadcast_sha256": "e6dc840fcbf687146c59b5c71b9a379fd3d66baae8299ce278c0e732e5d7ab82", - "installed_binary_sha256": "0f444f8208d5687b3bbf0fc0efa53e8734e730f8c83072fbc579eafe8e78e02a", - "release_id": "GH-HOLOLAKE-RELEASE-1.2.2", - "source_commit": "7593f9d3f06b2f22206ad6a05665c35443f7426b", - "state": "PASS", - "updater_sha256": "543b0f2fa814578af38ec3be322799ff418e6248e815ea12ccedccfd33332e98", - "version": "1.2.2" - }, - "verification": { - "values": [ - "产品Node测试3项、Rust测试10项、Clippy严格零警告和audit PASS_100", - "企业设备门本地与外部健康PASS且未知设备拒绝", - "App公证提交8a7ef497-3e51-4627-a546-4ad5d8e5a0ca Accepted", - "DMG公证提交6e7419c6-2872-4f7c-989e-2a5d1084e35e Accepted", - "App与DMG stapler validate及Gatekeeper Notarized Developer ID PASS", - "更新包由既有1.1.0信任根反向验证PASS", - "控制器生成器验证sourceCommit等于当前Git HEAD", - "JD operator返回EXACT_SIGNED_NOTARIZED_HUMAN_APPROVED_BUNDLE_VERIFIED", - "JD origin与广州HTTPS health均为READY_SIGNED_NOTARIZED_BROADCAST 1.2.2", - "公开包SHA-256与本地543b0f2fa814578af38ec3be322799ff418e6248e815ea12ccedccfd33332e98一致", - "本机安装1.2.2且频道数据哈希保持4c5968023eb5fa3248f2a20a5f5100b727f2946f9aedd4e39f9925e22d40fca1" - ] - } - }, - "executable": false, - "identity": { - "declaration_id": "HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903", - "declaration_kind": "RECEIPT", - "language_version": "0.1" - }, - "native_self_hosted": true, - "natural_language_is_typed_data": true, - "schema": "guanghu.declaration-gir/v1", - "unresolved_natural_language": false -} diff --git a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.human.en-US.md b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.human.en-US.md deleted file mode 100644 index 5d0dc7974..000000000 --- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.human.en-US.md +++ /dev/null @@ -1,134 +0,0 @@ -# HoloLake Clean V1 1.2.2 Public Release Acceptance Receipt · Human Engineering Language (English) - -> This is an English reading projection of validated native TCS/HLDP source. It is not a new canonical source and grants no execution authority. - -## What this is - -This is a **receipt** declaration with identifier `HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903` and version `1.0.0`. The projector validates it with the Stage-1 compiler before changing its reading order. - -## Who is here - -The native source does not provide this field; the projector does not guess. - -## Why this started - -The native source does not provide this field; the projector does not guess. - -## What changed - -The native source does not provide this field; the projector does not guess. - -## How it will execute - -This is a non-executable declaration and has no action graph. - -## Boundaries and exception handling - -The native source does not provide this field; the projector does not guess. - -## How completion is proven - -The native source does not provide this field; the projector does not guess. - -## Where to continue next time - -The native source does not provide this field; the projector does not guess. - -## Source and verification - -- **Native declaration identifier**: `HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903` -- **Native declaration kind**: `RECEIPT` -- **TCS source SHA-256**: `ef1c2e248ccb418fb901d78352816c8de47b9a3424a37716c39c2b9f592e43e4` -- **Validation compiler**: `TCS-COMPILER-STAGE1-0001` -- **Projection protocol**: `GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001` - -## Complete native structure cross-reference - -All top-level structures and field paths are retained below so a reader can audit whether the projection omitted information. - -- **boundaries** `boundaries` - - **values** `boundaries.values` - - 1.2.1因错误补全源码SHA被撤回且未篡改，撤回回执SHA-256为7a9a267d25bfa9c3d6d890431e3103a8367d4d3c92e6fe8ea5ea3de1d87fa55d - - 1.2.1包字节只作审计历史不再活动 - - 企业设备门当前0台成员设备0个会话，正向首登仍需成员本人凭证 - - 企业会话不替代Forgejo登录 - - 第五域私人内容和冰朔原话未进入公众包 - - 个人服务器二次桥接属于后续阶段 -- **header** `header` - - **canonical source path**：product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.tcs `header.canonical_uri` - - **compatibility** `header.compatibility` - - TAURI/2 - - JD-FD-PRIMARY - - BS-GZ-006 - - GH-CVM-MAIN-PROD-01 - - **language**：TCS/0.1 `header.language` - - **lifecycle**：CANDIDATE `header.lifecycle` - - **English name**：HoloLake Clean V1 1.2.2 Public Release Acceptance Receipt `header.name_en` - - **Chinese name**：HoloLake Clean V1 1.2.2公众发布验收回执 `header.name_zh` - - **profile**：PUBLIC-PRODUCT-ENGINEERING/1 `header.profile` - - **protocols** `header.protocols` - - HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001 - - HLP-CURRENT-ARCH-001 - - **schema**：tcs.receipt/v1 `header.schema` - - **version**：1.0.0 `header.version` -- **integrity** `integrity` - - **app_notarization**：ACCEPTED_STAPLED `integrity.app_notarization` - - **dmg_notarization**：ACCEPTED_STAPLED `integrity.dmg_notarization` - - **dmg_sha256**：58c662d002138c743092bf9b504fbf5e6cc53966a104fc0c581f2a5fe0687dab `integrity.dmg_sha256` - - **public_target_readback**：PASS `integrity.public_target_readback` - - **source_anchor_manifest_sha256**：7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2 `integrity.source_anchor_manifest_sha256` - - **updater_signature_sha256**：80872792363134739c54d202601e4b6988ce2bd45ededbe7565fab4d65a02acc `integrity.updater_signature_sha256` -- **next** `next` - - **optional** `next.optional` - - 等待首位域负责人从本人HoloLake完成设备登记和挑战正向验收 - - 实现个人服务器二次桥接 - - 继续扩展知识导入格式和已编号模块生态 - - **state**：PUBLIC_1_2_2_ACTIVE_LOCAL_AND_SERVER_ACCEPTANCE_PASS `next.state` -- **operation** `operation` - - **values** `operation.values` - - 完成当前自然语言TCS执行基线 - - 实现类型化人格SYSTEM_CONTEXT和真实模块商城 - - 部署企业责任设备门 - - 实现客户端Forgejo一次登记、Keychain挑战签名和短期单仓会话 - - 构建并用既有信任根签名1.2.2 - - Apple分别公证DMG与App并加票 - - JD operator按精确人类授权激活 - - 广州备案前门发布immutable包与latest.json - - 本机安装公证版1.2.2 -- **proof** `proof` - - **controller_bundle**：/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.2-controller-bundle `proof.controller_bundle` - - **enterprise_gate**：https://guanghu.chat/api/hololake/enterprise/device-gate/health `proof.enterprise_gate` - - **installed_app**：/Applications/HoloLake.app `proof.installed_app` - - **jd_activation_receipt_sha256**：cda66fbd0f900435674eaa289c396bd0e91fd0cabc4251b4de1fb37e90c6d574 `proof.jd_activation_receipt_sha256` - - **notarized_release**：/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.2-notarized `proof.notarized_release` - - **public_latest**：https://guanghulab.com/hololake/releases/latest.json `proof.public_latest` - - **public_package**：https://guanghulab.com/hololake/releases/1.2.2/HoloLake.app.tar.gz `proof.public_package` -- **request** `request` - - **scope**：HoloLake Clean V1 1.2.2源码、企业设备门、JD更新origin、广州HTTPS前门与本机安装 `request.scope` - - **source**：BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903 `request.source` - - **value**：以两段自然语言为唯一产品瞄点，完成HoloLake现实开发、企业责任入口、自动更新、公证、安装和现实读回。 `request.value` -- **result** `result` - - **broadcast_sha256**：e6dc840fcbf687146c59b5c71b9a379fd3d66baae8299ce278c0e732e5d7ab82 `result.broadcast_sha256` - - **installed_binary_sha256**：0f444f8208d5687b3bbf0fc0efa53e8734e730f8c83072fbc579eafe8e78e02a `result.installed_binary_sha256` - - **release_id**：GH-HOLOLAKE-RELEASE-1.2.2 `result.release_id` - - **source_commit**：7593f9d3f06b2f22206ad6a05665c35443f7426b `result.source_commit` - - **state**：PASS `result.state` - - **updater_sha256**：543b0f2fa814578af38ec3be322799ff418e6248e815ea12ccedccfd33332e98 `result.updater_sha256` - - **version**：1.2.2 `result.version` -- **verification** `verification` - - **values** `verification.values` - - 产品Node测试3项、Rust测试10项、Clippy严格零警告和audit PASS_100 - - 企业设备门本地与外部健康PASS且未知设备拒绝 - - App公证提交8a7ef497-3e51-4627-a546-4ad5d8e5a0ca Accepted - - DMG公证提交6e7419c6-2872-4f7c-989e-2a5d1084e35e Accepted - - App与DMG stapler validate及Gatekeeper Notarized Developer ID PASS - - 更新包由既有1.1.0信任根反向验证PASS - - 控制器生成器验证sourceCommit等于当前Git HEAD - - JD operator返回EXACT_SIGNED_NOTARIZED_HUMAN_APPROVED_BUNDLE_VERIFIED - - JD origin与广州HTTPS health均为READY_SIGNED_NOTARIZED_BROADCAST 1.2.2 - - 公开包SHA-256与本地543b0f2fa814578af38ec3be322799ff418e6248e815ea12ccedccfd33332e98一致 - - 本机安装1.2.2且频道数据哈希保持4c5968023eb5fa3248f2a20a5f5100b727f2946f9aedd4e39f9925e22d40fca1 - ---- - -This page changes only the reading order; it does not change TCS/HLDP semantics. diff --git a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.human.zh-CN.md b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.human.zh-CN.md deleted file mode 100644 index 8d65e262c..000000000 --- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.human.zh-CN.md +++ /dev/null @@ -1,134 +0,0 @@ -# HoloLake Clean V1 1.2.2公众发布验收回执 · 简体中文人类工程语言版 - -> 这是 TCS/HLDP 原生源码的简体中文阅读投影，不是新的正本，也不授予执行权限。若本页与 `.tcs` 源码不一致，以经过校验的 `.tcs` 源码为准。 - -## 这是什么 - -这是一份 **回执** 声明，编号为 `HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903`，版本为 `1.0.0`。转换器已先用 Stage-1 编译器校验原生源码，再把机器枚举翻译成汉语；原始编号保留在括号和字段路径中。 - -## 谁在这里 - -源程序没有提供这一项，转换器不猜。 - -## 为什么开始 - -源程序没有提供这一项，转换器不猜。 - -## 发生了什么变化 - -源程序没有提供这一项，转换器不猜。 - -## 准备怎样执行 - -这是非执行声明，没有动作图。 - -## 边界与异常处理 - -源程序没有提供这一项，转换器不猜。 - -## 怎样算完成 - -源程序没有提供这一项，转换器不猜。 - -## 下一次从哪里继续 - -源程序没有提供这一项，转换器不猜。 - -## 来源与校验 - -- **原生声明编号**：`HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903` -- **原生声明类型**：`RECEIPT` -- **TCS 源码 SHA-256**：`ef1c2e248ccb418fb901d78352816c8de47b9a3424a37716c39c2b9f592e43e4` -- **校验编译器**：`TCS-COMPILER-STAGE1-0001` -- **投影协议**：`GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001` - -## 原生结构逐项对照 - -下面保留源码的全部顶层结构和字段路径，供人类审计投影有没有漏掉信息。 - -- **boundaries** `boundaries` - - **values** `boundaries.values` - - 1.2.1因错误补全源码SHA被撤回且未篡改，撤回回执SHA-256为7a9a267d25bfa9c3d6d890431e3103a8367d4d3c92e6fe8ea5ea3de1d87fa55d - - 1.2.1包字节只作审计历史不再活动 - - 企业设备门当前0台成员设备0个会话，正向首登仍需成员本人凭证 - - 企业会话不替代Forgejo登录 - - 第五域私人内容和冰朔原话未进入公众包 - - 个人服务器二次桥接属于后续阶段 -- **语言头** `header` - - **正本路径**：product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.tcs `header.canonical_uri` - - **compatibility** `header.compatibility` - - TAURI/2 - - JD-FD-PRIMARY - - BS-GZ-006 - - GH-CVM-MAIN-PROD-01 - - **语言**：TCS/0.1 `header.language` - - **生命周期**：候选版本，尚未成为正式正本（`CANDIDATE`） `header.lifecycle` - - **英文名**：HoloLake Clean V1 1.2.2 Public Release Acceptance Receipt `header.name_en` - - **中文名**：HoloLake Clean V1 1.2.2公众发布验收回执 `header.name_zh` - - **协议配置**：PUBLIC-PRODUCT-ENGINEERING/1 `header.profile` - - **protocols** `header.protocols` - - HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001 - - HLP-CURRENT-ARCH-001 - - **schema**：tcs.receipt/v1 `header.schema` - - **版本**：1.0.0 `header.version` -- **integrity** `integrity` - - **app_notarization**：ACCEPTED_STAPLED `integrity.app_notarization` - - **dmg_notarization**：ACCEPTED_STAPLED `integrity.dmg_notarization` - - **dmg_sha256**：58c662d002138c743092bf9b504fbf5e6cc53966a104fc0c581f2a5fe0687dab `integrity.dmg_sha256` - - **public_target_readback**：PASS `integrity.public_target_readback` - - **source_anchor_manifest_sha256**：7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2 `integrity.source_anchor_manifest_sha256` - - **updater_signature_sha256**：80872792363134739c54d202601e4b6988ce2bd45ededbe7565fab4d65a02acc `integrity.updater_signature_sha256` -- **next** `next` - - **optional** `next.optional` - - 等待首位域负责人从本人HoloLake完成设备登记和挑战正向验收 - - 实现个人服务器二次桥接 - - 继续扩展知识导入格式和已编号模块生态 - - **state**：PUBLIC_1_2_2_ACTIVE_LOCAL_AND_SERVER_ACCEPTANCE_PASS `next.state` -- **操作** `operation` - - **values** `operation.values` - - 完成当前自然语言TCS执行基线 - - 实现类型化人格SYSTEM_CONTEXT和真实模块商城 - - 部署企业责任设备门 - - 实现客户端Forgejo一次登记、Keychain挑战签名和短期单仓会话 - - 构建并用既有信任根签名1.2.2 - - Apple分别公证DMG与App并加票 - - JD operator按精确人类授权激活 - - 广州备案前门发布immutable包与latest.json - - 本机安装公证版1.2.2 -- **proof** `proof` - - **controller_bundle**：/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.2-controller-bundle `proof.controller_bundle` - - **enterprise_gate**：https://guanghu.chat/api/hololake/enterprise/device-gate/health `proof.enterprise_gate` - - **installed_app**：/Applications/HoloLake.app `proof.installed_app` - - **jd_activation_receipt_sha256**：cda66fbd0f900435674eaa289c396bd0e91fd0cabc4251b4de1fb37e90c6d574 `proof.jd_activation_receipt_sha256` - - **notarized_release**：/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.2-notarized `proof.notarized_release` - - **public_latest**：https://guanghulab.com/hololake/releases/latest.json `proof.public_latest` - - **public_package**：https://guanghulab.com/hololake/releases/1.2.2/HoloLake.app.tar.gz `proof.public_package` -- **request** `request` - - **scope**：HoloLake Clean V1 1.2.2源码、企业设备门、JD更新origin、广州HTTPS前门与本机安装 `request.scope` - - **来源**：BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903 `request.source` - - **value**：以两段自然语言为唯一产品瞄点，完成HoloLake现实开发、企业责任入口、自动更新、公证、安装和现实读回。 `request.value` -- **result** `result` - - **broadcast_sha256**：e6dc840fcbf687146c59b5c71b9a379fd3d66baae8299ce278c0e732e5d7ab82 `result.broadcast_sha256` - - **installed_binary_sha256**：0f444f8208d5687b3bbf0fc0efa53e8734e730f8c83072fbc579eafe8e78e02a `result.installed_binary_sha256` - - **release_id**：GH-HOLOLAKE-RELEASE-1.2.2 `result.release_id` - - **source_commit**：7593f9d3f06b2f22206ad6a05665c35443f7426b `result.source_commit` - - **state**：PASS `result.state` - - **updater_sha256**：543b0f2fa814578af38ec3be322799ff418e6248e815ea12ccedccfd33332e98 `result.updater_sha256` - - **版本**：1.2.2 `result.version` -- **verification** `verification` - - **values** `verification.values` - - 产品Node测试3项、Rust测试10项、Clippy严格零警告和audit PASS_100 - - 企业设备门本地与外部健康PASS且未知设备拒绝 - - App公证提交8a7ef497-3e51-4627-a546-4ad5d8e5a0ca Accepted - - DMG公证提交6e7419c6-2872-4f7c-989e-2a5d1084e35e Accepted - - App与DMG stapler validate及Gatekeeper Notarized Developer ID PASS - - 更新包由既有1.1.0信任根反向验证PASS - - 控制器生成器验证sourceCommit等于当前Git HEAD - - JD operator返回EXACT_SIGNED_NOTARIZED_HUMAN_APPROVED_BUNDLE_VERIFIED - - JD origin与广州HTTPS health均为READY_SIGNED_NOTARIZED_BROADCAST 1.2.2 - - 公开包SHA-256与本地543b0f2fa814578af38ec3be322799ff418e6248e815ea12ccedccfd33332e98一致 - - 本机安装1.2.2且频道数据哈希保持4c5968023eb5fa3248f2a20a5f5100b727f2946f9aedd4e39f9925e22d40fca1 - ---- - -本页只改变阅读顺序，不改变 TCS/HLDP 语义。 diff --git a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.gir.json b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.gir.json deleted file mode 100644 index 595bfd5b5..000000000 --- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.gir.json +++ /dev/null @@ -1,156 +0,0 @@ -{ - "compiled_from": { - "compiler_id": "TCS-COMPILER-STAGE1-0001", - "compiler_state": "TCS_COMPILER_GIR_EXECUTED", - "source_sha256": "570d9b7d41f955236abc9a22ce3996ed323fe77f5aa001a5a997aa4aa1a1de29" - }, - "declaration": { - "acceptance": { - "partial": false, - "required": [ - "SOURCE_HASH", - "ARCHITECTURE", - "TCS_GIR", - "TIMESTAMP", - "CHANNEL", - "KNOWLEDGE", - "MODULE_REGISTRY", - "TYPED_LANGUAGE", - "AGENT", - "EXTERNAL_AI", - "PUBLIC_UPDATE", - "ENTERPRISE_GATE", - "SIGNED_APP", - "REAL_UI" - ], - "scale": "ZERO_OR_ONE_HUNDRED" - }, - "errors": { - "E1": "DIRECT_LANGUAGE_ANCHOR_MISMATCH", - "E2": "UNTYPED_SOURCE_REJECTED", - "E3": "LEGACY_WHOLE_PRODUCT_MERGE_REJECTED", - "E4": "UNSIGNED_PUBLIC_UPDATE_REJECTED", - "E5": "ENTERPRISE_IDENTITY_OR_DEVICE_PROOF_REJECTED", - "E6": "DOMAIN_REPOSITORY_SCOPE_REJECTED", - "E7": "SERVER_CONCURRENCY_CONFLICT_DEFERRED", - "E8": "TARGET_READBACK_OR_RECEIPT_INTEGRITY_FAILED" - }, - "examples": { - "negative": "ANY_HOLOLAKE_USER_CLICKS_ENTERPRISE_PORTAL_AND_RECEIVES_A_PERMANENT_PASSWORD_OR_CROSS_DOMAIN_REPOSITORY_ACCESS", - "positive": "REGISTERED_DOMAIN_RESPONSIBLE_HUMAN_USES_BOUND_PERSONA_AND_LOCAL_DEVICE_KEY_TO_OPEN_A_SHORT_LIVED_SESSION_TO_ONLY_THEIR_ENTERPRISE_REPOSITORY" - }, - "fields": { - "MAY": "LOCAL_USER_CHANNEL_AND_REGISTERED_MODULE_ACTIONS; ENTERPRISE_LOGIN_ONLY_AFTER_HUMAN_PERSONA_DEVICE_AND_OPTIONAL_PERSONAL_SERVER_PROOF", - "PROVE": "TCS_GIR_MODULE_REGISTRY_SOURCE_KIND_TESTS_PRIVATE_GIT_TARGET_READBACK_SIGNED_UPDATE_NEGATIVE_CASES_ENTERPRISE_AUTH_CHALLENGE_AND_INSTALLED_APP_ACCEPTANCE", - "WHAT": "CLEAN_CLIENT_SIGNED_UPDATE_TCS_NATIVE_RUNTIME_DUAL_GIT_TYPED_LANGUAGE_CHANNEL_KNOWLEDGE_MODULE_MARKET_ENTERPRISE_ENTRANCE_AND_EXTERNAL_PROGRAMMING_AI_BRIDGE", - "WHO": "USER_OWNS_PRIVATE_CHANNEL; PERSONA_REASONS; AGENT_EXECUTES; DOMAIN_RESPONSIBLE_HUMAN_AND_BOUND_PERSONA_ENTER_ONLY_THEIR_ENTERPRISE_REPOSITORY", - "WHY": "LET_HUMANS_OPERATE_BY_LANGUAGE_WHILE_PERSONA_SYSTEM_PROTOCOL_AGENT_TOOL_AND_RECEIPT_SOURCES_REMAIN_DISTINGUISHABLE_AND_REALITY_ACTIONS_REMAIN_VERIFIABLE" - }, - "header": { - "canonical_uri": "product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs", - "compatibility": [ - "TCS-DECLARATION-STANDARD-0001", - "TCS-FIELD-STANDARD-0001", - "HLP-CURRENT-ARCH-001" - ], - "language": "TCS/0.1", - "lifecycle": "CANDIDATE", - "name_en": "HoloLake Clean V1 Current Direct-Language Execution Baseline", - "name_zh": "HoloLake第一版当前自然语言执行基线", - "profile": "PUBLIC-PRODUCT-ENGINEERING/1", - "protocols": [ - "TCS", - "HLDP", - "GLS", - "GLP", - "GLS-0130", - "GLS-0131", - "GLS-0306" - ], - "schema": "tcs.protocol/v1", - "version": "1.0.0" - }, - "invariants": { - "I1": "RAW_DIRECT_LANGUAGE_AND_FIFTH_DOMAIN_PRIVATE_CONTENT_NEVER_ENTER_PUBLIC_PACKAGE", - "I10": "MODULES_HAVE_STABLE_IDS_AND_LEGACY_SOURCES_ARE_SLICE_DONORS_ONLY", - "I2": "ENTERPRISE_SERVER_AND_FOUR_DOMAIN_SYSTEM_BODIES_ARE_NOT_EMBEDDED_IN_HOLOLAKE", - "I3": "ENTERPRISE_CLIENT_CONTAINS_ONLY_A_GATED_LOGIN_ROUTE_AND_PUBLIC_SIGNED_DISTRIBUTION_CONSUMER", - "I4": "TEAM_LOGIN_REQUIRES_DOMAIN_RESPONSIBLE_HUMAN_ID_PERSONA_ID_DEVICE_KEY_PROOF_AND_SCOPED_SHORT_LIVED_SESSION", - "I5": "MACHINE_FINGERPRINT_IS_AUXILIARY_EVIDENCE_NOT_A_SOLE_CREDENTIAL", - "I6": "PERSONAL_SERVER_MAY_BRIDGE_DEVICE_TO_ENTERPRISE_BUT_CANNOT_EXPAND_DOMAIN_OR_REPOSITORY_SCOPE", - "I7": "USER_PERSONA_SYSTEM_CONTEXT_PROTOCOL_AGENT_TOOL_AND_RECEIPT_ARE_DISTINCT_TYPED_SOURCES", - "I8": "AGENT_EXECUTION_DOES_NOT_REQUIRE_MODEL_NATIVE_TOOL_CALLING", - "I9": "PUBLIC_UPDATE_PRIVATE_GIT_AND_REALTIME_GLP_ARE_THREE_SEPARATE_PLANES" - }, - "scope": { - "client": "TAURI_V2_RUST_REACT", - "development_channel": "ICE-CH-ZC001", - "enterprise_domains_embedded": false, - "fifth_domain_private_content_embedded": false, - "product": "HOLOLAKE_CLEAN_V1", - "public_channel": "CH-ZERO-CORE-LPM" - }, - "source": { - "source_id": "BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903", - "source_role": "DIRECT_HUMAN", - "source_sha256": "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2", - "source_uri": "private-anchor://codex/01a0672d-f125-7452-988e-523a6a34bfd4/HOLOLAKE-CLEAN-V1-ONLY-ANCHORS" - }, - "states": { - "initial": "SOURCE_ANCHORED", - "terminal": [ - "V1_ACCEPTED", - "FAILED_CLOSED" - ], - "values": [ - "SOURCE_ANCHORED", - "ARCHITECTURE_ALIGNED", - "LOCAL_RUNTIME_VERIFIED", - "PUBLIC_DISTRIBUTION_BOUND", - "ENTERPRISE_ENTRANCE_VERIFIED", - "SIGNED_RELEASE_INSTALLED", - "V1_ACCEPTED", - "FAILED_CLOSED" - ] - }, - "transitions": { - "T1": "SOURCE_ANCHORED_TO_ARCHITECTURE_ALIGNED", - "T2": "ARCHITECTURE_ALIGNED_TO_LOCAL_RUNTIME_VERIFIED", - "T3": "LOCAL_RUNTIME_VERIFIED_TO_PUBLIC_DISTRIBUTION_BOUND", - "T4": "PUBLIC_DISTRIBUTION_BOUND_TO_ENTERPRISE_ENTRANCE_VERIFIED", - "T5": "ENTERPRISE_ENTRANCE_VERIFIED_TO_SIGNED_RELEASE_INSTALLED", - "T6": "SIGNED_RELEASE_INSTALLED_TO_V1_ACCEPTED_AFTER_REAL_HUMAN_VISIBLE_READBACK", - "TF": "SOURCE_PATH_SIGNATURE_AUTHORIZATION_CONCURRENCY_OR_TARGET_READBACK_FAILURE_TO_FAILED_CLOSED" - }, - "validation": { - "V1": "CURRENT_WORKTREE_EQUALS_REPO014_ONLINE_MAIN_BEFORE_FIRST_MUTATION", - "V10": "OLD_APP_REMOVAL_OCCURS_ONLY_AFTER_NEW_APP_REAL_ACCEPTANCE", - "V2": "CURRENT_PRODUCT_ASSESSMENT_HAS_ONE_NON_CONTRADICTORY_VERSION_SOURCE_AND_STAGE", - "V3": "LEGACY_TIMESTAMP_AND_NEW_RFC3339_TIMESTAMP_RENDER_WITHOUT_INVALID_DATE", - "V4": "CHANNEL_NAME_NUMBER_PRIVATE_GIT_AND_TYPED_CONVERSATION_PASS", - "V5": "KNOWLEDGE_CREATE_READ_EDIT_IMPORT_EXPORT_TRASH_RENDER_AND_GIT_PASS", - "V6": "MODULE_MARKET_SEPARATES_PERSONA_AND_HUMAN_MODULES", - "V7": "EXTERNAL_PROGRAMMING_AI_LOOPBACK_CONNECTION_HAS_NO_IMPLICIT_PERSONA_OR_EXECUTION_AUTHORITY", - "V8": "ENTERPRISE_GATE_REJECTS_UNKNOWN_MEMBER_WRONG_DOMAIN_WRONG_PERSONA_UNREGISTERED_DEVICE_REPLAY_AND_EXPIRED_SESSION", - "V9": "PUBLIC_UPDATE_DOWNLOAD_SIGNATURE_INSTALL_ROLLBACK_AND_VERSION_READBACK_PASS" - }, - "vocabulary": { - "agent": "MODEL_INDEPENDENT_DETERMINISTIC_EXECUTION_LIMB", - "clean_shell": "NEW_MINIMAL_CLIENT_WITHOUT_WHOLE_LEGACY_PRODUCT_MERGE", - "dual_git": "SIGNED_PUBLIC_DISTRIBUTION_GIT_PLUS_USER_OWNED_PRIVATE_GIT", - "enterprise_entrance": "AUTHORIZED_TEAM_MEMBER_ROUTE_TO_RESPONSIBILITY_SCOPED_ENTERPRISE_REPOSITORY", - "native_language": "TCS_TO_GIR_TO_REGISTERED_CAPABILITY_TO_RECEIPT", - "personal_channel": "USER_OWNED_NAMED_NUMBERED_LANGUAGE_AND_PERSONA_INTERACTION_SURFACE" - } - }, - "executable": false, - "identity": { - "declaration_id": "HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001", - "declaration_kind": "PROTOCOL", - "language_version": "0.1" - }, - "native_self_hosted": true, - "natural_language_is_typed_data": true, - "schema": "guanghu.declaration-gir/v1", - "unresolved_natural_language": false -} diff --git a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.human.en-US.md b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.human.en-US.md deleted file mode 100644 index a9081ecf0..000000000 --- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.human.en-US.md +++ /dev/null @@ -1,250 +0,0 @@ -# HoloLake Clean V1 Current Direct-Language Execution Baseline · Human Engineering Language (English) - -> This is an English reading projection of validated native TCS/HLDP source. It is not a new canonical source and grants no execution authority. - -## What this is - -This is a **protocol** declaration with identifier `HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001` and version `1.0.0`. The projector validates it with the Stage-1 compiler before changing its reading order. - -## Who is here - -- **scope** `scope` - - **client**：TAURI_V2_RUST_REACT `scope.client` - - **development_channel**：ICE-CH-ZC001 `scope.development_channel` - - **enterprise_domains_embedded**：no `scope.enterprise_domains_embedded` - - **fifth_domain_private_content_embedded**：no `scope.fifth_domain_private_content_embedded` - - **product**：HOLOLAKE_CLEAN_V1 `scope.product` - - **public_channel**：CH-ZERO-CORE-LPM `scope.public_channel` - -## Why this started - -- **source** `source` - - **source identifier**：BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903 `source.source_id` - - **source role**：DIRECT_HUMAN `source.source_role` - - **source checksum**：7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2 `source.source_sha256` - - **source address**：private-anchor://codex/01a0672d-f125-7452-988e-523a6a34bfd4/HOLOLAKE-CLEAN-V1-ONLY-ANCHORS `source.source_uri` - -## What changed - -- **transitions** `transitions` - - **T1**：SOURCE_ANCHORED_TO_ARCHITECTURE_ALIGNED `transitions.T1` - - **T2**：ARCHITECTURE_ALIGNED_TO_LOCAL_RUNTIME_VERIFIED `transitions.T2` - - **T3**：LOCAL_RUNTIME_VERIFIED_TO_PUBLIC_DISTRIBUTION_BOUND `transitions.T3` - - **T4**：PUBLIC_DISTRIBUTION_BOUND_TO_ENTERPRISE_ENTRANCE_VERIFIED `transitions.T4` - - **T5**：ENTERPRISE_ENTRANCE_VERIFIED_TO_SIGNED_RELEASE_INSTALLED `transitions.T5` - - **T6**：SIGNED_RELEASE_INSTALLED_TO_V1_ACCEPTED_AFTER_REAL_HUMAN_VISIBLE_READBACK `transitions.T6` - - **TF**：SOURCE_PATH_SIGNATURE_AUTHORIZATION_CONCURRENCY_OR_TARGET_READBACK_FAILURE_TO_FAILED_CLOSED `transitions.TF` -- **states** `states` - - **initial**：SOURCE_ANCHORED `states.initial` - - **terminal** `states.terminal` - - V1_ACCEPTED - - FAILED_CLOSED - - **values** `states.values` - - SOURCE_ANCHORED - - ARCHITECTURE_ALIGNED - - LOCAL_RUNTIME_VERIFIED - - PUBLIC_DISTRIBUTION_BOUND - - ENTERPRISE_ENTRANCE_VERIFIED - - SIGNED_RELEASE_INSTALLED - - V1_ACCEPTED - - FAILED_CLOSED - -## How it will execute - -This is a non-executable declaration and has no action graph. - -## Boundaries and exception handling - -- **invariants** `invariants` - - **I1**：RAW_DIRECT_LANGUAGE_AND_FIFTH_DOMAIN_PRIVATE_CONTENT_NEVER_ENTER_PUBLIC_PACKAGE `invariants.I1` - - **I10**：MODULES_HAVE_STABLE_IDS_AND_LEGACY_SOURCES_ARE_SLICE_DONORS_ONLY `invariants.I10` - - **I2**：ENTERPRISE_SERVER_AND_FOUR_DOMAIN_SYSTEM_BODIES_ARE_NOT_EMBEDDED_IN_HOLOLAKE `invariants.I2` - - **I3**：ENTERPRISE_CLIENT_CONTAINS_ONLY_A_GATED_LOGIN_ROUTE_AND_PUBLIC_SIGNED_DISTRIBUTION_CONSUMER `invariants.I3` - - **I4**：TEAM_LOGIN_REQUIRES_DOMAIN_RESPONSIBLE_HUMAN_ID_PERSONA_ID_DEVICE_KEY_PROOF_AND_SCOPED_SHORT_LIVED_SESSION `invariants.I4` - - **I5**：MACHINE_FINGERPRINT_IS_AUXILIARY_EVIDENCE_NOT_A_SOLE_CREDENTIAL `invariants.I5` - - **I6**：PERSONAL_SERVER_MAY_BRIDGE_DEVICE_TO_ENTERPRISE_BUT_CANNOT_EXPAND_DOMAIN_OR_REPOSITORY_SCOPE `invariants.I6` - - **I7**：USER_PERSONA_SYSTEM_CONTEXT_PROTOCOL_AGENT_TOOL_AND_RECEIPT_ARE_DISTINCT_TYPED_SOURCES `invariants.I7` - - **I8**：AGENT_EXECUTION_DOES_NOT_REQUIRE_MODEL_NATIVE_TOOL_CALLING `invariants.I8` - - **I9**：PUBLIC_UPDATE_PRIVATE_GIT_AND_REALTIME_GLP_ARE_THREE_SEPARATE_PLANES `invariants.I9` -- **errors** `errors` - - **E1**：DIRECT_LANGUAGE_ANCHOR_MISMATCH `errors.E1` - - **E2**：UNTYPED_SOURCE_REJECTED `errors.E2` - - **E3**：LEGACY_WHOLE_PRODUCT_MERGE_REJECTED `errors.E3` - - **E4**：UNSIGNED_PUBLIC_UPDATE_REJECTED `errors.E4` - - **E5**：ENTERPRISE_IDENTITY_OR_DEVICE_PROOF_REJECTED `errors.E5` - - **E6**：DOMAIN_REPOSITORY_SCOPE_REJECTED `errors.E6` - - **E7**：SERVER_CONCURRENCY_CONFLICT_DEFERRED `errors.E7` - - **E8**：TARGET_READBACK_OR_RECEIPT_INTEGRITY_FAILED `errors.E8` - -## How completion is proven - -- **acceptance** `acceptance` - - **partial**：no `acceptance.partial` - - **required** `acceptance.required` - - SOURCE_HASH - - ARCHITECTURE - - TCS_GIR - - TIMESTAMP - - CHANNEL - - KNOWLEDGE - - MODULE_REGISTRY - - TYPED_LANGUAGE - - AGENT - - EXTERNAL_AI - - PUBLIC_UPDATE - - ENTERPRISE_GATE - - SIGNED_APP - - REAL_UI - - **scale**：ZERO_OR_ONE_HUNDRED `acceptance.scale` -- **validation** `validation` - - **V1**：CURRENT_WORKTREE_EQUALS_REPO014_ONLINE_MAIN_BEFORE_FIRST_MUTATION `validation.V1` - - **V10**：OLD_APP_REMOVAL_OCCURS_ONLY_AFTER_NEW_APP_REAL_ACCEPTANCE `validation.V10` - - **V2**：CURRENT_PRODUCT_ASSESSMENT_HAS_ONE_NON_CONTRADICTORY_VERSION_SOURCE_AND_STAGE `validation.V2` - - **V3**：LEGACY_TIMESTAMP_AND_NEW_RFC3339_TIMESTAMP_RENDER_WITHOUT_INVALID_DATE `validation.V3` - - **V4**：CHANNEL_NAME_NUMBER_PRIVATE_GIT_AND_TYPED_CONVERSATION_PASS `validation.V4` - - **V5**：KNOWLEDGE_CREATE_READ_EDIT_IMPORT_EXPORT_TRASH_RENDER_AND_GIT_PASS `validation.V5` - - **V6**：MODULE_MARKET_SEPARATES_PERSONA_AND_HUMAN_MODULES `validation.V6` - - **V7**：EXTERNAL_PROGRAMMING_AI_LOOPBACK_CONNECTION_HAS_NO_IMPLICIT_PERSONA_OR_EXECUTION_AUTHORITY `validation.V7` - - **V8**：ENTERPRISE_GATE_REJECTS_UNKNOWN_MEMBER_WRONG_DOMAIN_WRONG_PERSONA_UNREGISTERED_DEVICE_REPLAY_AND_EXPIRED_SESSION `validation.V8` - - **V9**：PUBLIC_UPDATE_DOWNLOAD_SIGNATURE_INSTALL_ROLLBACK_AND_VERSION_READBACK_PASS `validation.V9` - -## Where to continue next time - -The native source does not provide this field; the projector does not guess. - -## Source and verification - -- **Native declaration identifier**: `HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001` -- **Native declaration kind**: `PROTOCOL` -- **TCS source SHA-256**: `570d9b7d41f955236abc9a22ce3996ed323fe77f5aa001a5a997aa4aa1a1de29` -- **Validation compiler**: `TCS-COMPILER-STAGE1-0001` -- **Projection protocol**: `GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001` - -## Complete native structure cross-reference - -All top-level structures and field paths are retained below so a reader can audit whether the projection omitted information. - -- **acceptance** `acceptance` - - **partial**：no `acceptance.partial` - - **required** `acceptance.required` - - SOURCE_HASH - - ARCHITECTURE - - TCS_GIR - - TIMESTAMP - - CHANNEL - - KNOWLEDGE - - MODULE_REGISTRY - - TYPED_LANGUAGE - - AGENT - - EXTERNAL_AI - - PUBLIC_UPDATE - - ENTERPRISE_GATE - - SIGNED_APP - - REAL_UI - - **scale**：ZERO_OR_ONE_HUNDRED `acceptance.scale` -- **errors** `errors` - - **E1**：DIRECT_LANGUAGE_ANCHOR_MISMATCH `errors.E1` - - **E2**：UNTYPED_SOURCE_REJECTED `errors.E2` - - **E3**：LEGACY_WHOLE_PRODUCT_MERGE_REJECTED `errors.E3` - - **E4**：UNSIGNED_PUBLIC_UPDATE_REJECTED `errors.E4` - - **E5**：ENTERPRISE_IDENTITY_OR_DEVICE_PROOF_REJECTED `errors.E5` - - **E6**：DOMAIN_REPOSITORY_SCOPE_REJECTED `errors.E6` - - **E7**：SERVER_CONCURRENCY_CONFLICT_DEFERRED `errors.E7` - - **E8**：TARGET_READBACK_OR_RECEIPT_INTEGRITY_FAILED `errors.E8` -- **examples** `examples` - - **negative**：ANY_HOLOLAKE_USER_CLICKS_ENTERPRISE_PORTAL_AND_RECEIVES_A_PERMANENT_PASSWORD_OR_CROSS_DOMAIN_REPOSITORY_ACCESS `examples.negative` - - **positive**：REGISTERED_DOMAIN_RESPONSIBLE_HUMAN_USES_BOUND_PERSONA_AND_LOCAL_DEVICE_KEY_TO_OPEN_A_SHORT_LIVED_SESSION_TO_ONLY_THEIR_ENTERPRISE_REPOSITORY `examples.positive` -- **fields** `fields` - - **MAY**：LOCAL_USER_CHANNEL_AND_REGISTERED_MODULE_ACTIONS; ENTERPRISE_LOGIN_ONLY_AFTER_HUMAN_PERSONA_DEVICE_AND_OPTIONAL_PERSONAL_SERVER_PROOF `fields.MAY` - - **PROVE**：TCS_GIR_MODULE_REGISTRY_SOURCE_KIND_TESTS_PRIVATE_GIT_TARGET_READBACK_SIGNED_UPDATE_NEGATIVE_CASES_ENTERPRISE_AUTH_CHALLENGE_AND_INSTALLED_APP_ACCEPTANCE `fields.PROVE` - - **WHAT**：CLEAN_CLIENT_SIGNED_UPDATE_TCS_NATIVE_RUNTIME_DUAL_GIT_TYPED_LANGUAGE_CHANNEL_KNOWLEDGE_MODULE_MARKET_ENTERPRISE_ENTRANCE_AND_EXTERNAL_PROGRAMMING_AI_BRIDGE `fields.WHAT` - - **WHO**：USER_OWNS_PRIVATE_CHANNEL; PERSONA_REASONS; AGENT_EXECUTES; DOMAIN_RESPONSIBLE_HUMAN_AND_BOUND_PERSONA_ENTER_ONLY_THEIR_ENTERPRISE_REPOSITORY `fields.WHO` - - **WHY**：LET_HUMANS_OPERATE_BY_LANGUAGE_WHILE_PERSONA_SYSTEM_PROTOCOL_AGENT_TOOL_AND_RECEIPT_SOURCES_REMAIN_DISTINGUISHABLE_AND_REALITY_ACTIONS_REMAIN_VERIFIABLE `fields.WHY` -- **header** `header` - - **canonical source path**：product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs `header.canonical_uri` - - **compatibility** `header.compatibility` - - TCS-DECLARATION-STANDARD-0001 - - TCS-FIELD-STANDARD-0001 - - HLP-CURRENT-ARCH-001 - - **language**：TCS/0.1 `header.language` - - **lifecycle**：CANDIDATE `header.lifecycle` - - **English name**：HoloLake Clean V1 Current Direct-Language Execution Baseline `header.name_en` - - **Chinese name**：HoloLake第一版当前自然语言执行基线 `header.name_zh` - - **profile**：PUBLIC-PRODUCT-ENGINEERING/1 `header.profile` - - **protocols** `header.protocols` - - TCS - - HLDP - - GLS - - GLP - - GLS-0130 - - GLS-0131 - - GLS-0306 - - **schema**：tcs.protocol/v1 `header.schema` - - **version**：1.0.0 `header.version` -- **invariants** `invariants` - - **I1**：RAW_DIRECT_LANGUAGE_AND_FIFTH_DOMAIN_PRIVATE_CONTENT_NEVER_ENTER_PUBLIC_PACKAGE `invariants.I1` - - **I10**：MODULES_HAVE_STABLE_IDS_AND_LEGACY_SOURCES_ARE_SLICE_DONORS_ONLY `invariants.I10` - - **I2**：ENTERPRISE_SERVER_AND_FOUR_DOMAIN_SYSTEM_BODIES_ARE_NOT_EMBEDDED_IN_HOLOLAKE `invariants.I2` - - **I3**：ENTERPRISE_CLIENT_CONTAINS_ONLY_A_GATED_LOGIN_ROUTE_AND_PUBLIC_SIGNED_DISTRIBUTION_CONSUMER `invariants.I3` - - **I4**：TEAM_LOGIN_REQUIRES_DOMAIN_RESPONSIBLE_HUMAN_ID_PERSONA_ID_DEVICE_KEY_PROOF_AND_SCOPED_SHORT_LIVED_SESSION `invariants.I4` - - **I5**：MACHINE_FINGERPRINT_IS_AUXILIARY_EVIDENCE_NOT_A_SOLE_CREDENTIAL `invariants.I5` - - **I6**：PERSONAL_SERVER_MAY_BRIDGE_DEVICE_TO_ENTERPRISE_BUT_CANNOT_EXPAND_DOMAIN_OR_REPOSITORY_SCOPE `invariants.I6` - - **I7**：USER_PERSONA_SYSTEM_CONTEXT_PROTOCOL_AGENT_TOOL_AND_RECEIPT_ARE_DISTINCT_TYPED_SOURCES `invariants.I7` - - **I8**：AGENT_EXECUTION_DOES_NOT_REQUIRE_MODEL_NATIVE_TOOL_CALLING `invariants.I8` - - **I9**：PUBLIC_UPDATE_PRIVATE_GIT_AND_REALTIME_GLP_ARE_THREE_SEPARATE_PLANES `invariants.I9` -- **scope** `scope` - - **client**：TAURI_V2_RUST_REACT `scope.client` - - **development_channel**：ICE-CH-ZC001 `scope.development_channel` - - **enterprise_domains_embedded**：no `scope.enterprise_domains_embedded` - - **fifth_domain_private_content_embedded**：no `scope.fifth_domain_private_content_embedded` - - **product**：HOLOLAKE_CLEAN_V1 `scope.product` - - **public_channel**：CH-ZERO-CORE-LPM `scope.public_channel` -- **source** `source` - - **source identifier**：BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903 `source.source_id` - - **source role**：DIRECT_HUMAN `source.source_role` - - **source checksum**：7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2 `source.source_sha256` - - **source address**：private-anchor://codex/01a0672d-f125-7452-988e-523a6a34bfd4/HOLOLAKE-CLEAN-V1-ONLY-ANCHORS `source.source_uri` -- **states** `states` - - **initial**：SOURCE_ANCHORED `states.initial` - - **terminal** `states.terminal` - - V1_ACCEPTED - - FAILED_CLOSED - - **values** `states.values` - - SOURCE_ANCHORED - - ARCHITECTURE_ALIGNED - - LOCAL_RUNTIME_VERIFIED - - PUBLIC_DISTRIBUTION_BOUND - - ENTERPRISE_ENTRANCE_VERIFIED - - SIGNED_RELEASE_INSTALLED - - V1_ACCEPTED - - FAILED_CLOSED -- **transitions** `transitions` - - **T1**：SOURCE_ANCHORED_TO_ARCHITECTURE_ALIGNED `transitions.T1` - - **T2**：ARCHITECTURE_ALIGNED_TO_LOCAL_RUNTIME_VERIFIED `transitions.T2` - - **T3**：LOCAL_RUNTIME_VERIFIED_TO_PUBLIC_DISTRIBUTION_BOUND `transitions.T3` - - **T4**：PUBLIC_DISTRIBUTION_BOUND_TO_ENTERPRISE_ENTRANCE_VERIFIED `transitions.T4` - - **T5**：ENTERPRISE_ENTRANCE_VERIFIED_TO_SIGNED_RELEASE_INSTALLED `transitions.T5` - - **T6**：SIGNED_RELEASE_INSTALLED_TO_V1_ACCEPTED_AFTER_REAL_HUMAN_VISIBLE_READBACK `transitions.T6` - - **TF**：SOURCE_PATH_SIGNATURE_AUTHORIZATION_CONCURRENCY_OR_TARGET_READBACK_FAILURE_TO_FAILED_CLOSED `transitions.TF` -- **validation** `validation` - - **V1**：CURRENT_WORKTREE_EQUALS_REPO014_ONLINE_MAIN_BEFORE_FIRST_MUTATION `validation.V1` - - **V10**：OLD_APP_REMOVAL_OCCURS_ONLY_AFTER_NEW_APP_REAL_ACCEPTANCE `validation.V10` - - **V2**：CURRENT_PRODUCT_ASSESSMENT_HAS_ONE_NON_CONTRADICTORY_VERSION_SOURCE_AND_STAGE `validation.V2` - - **V3**：LEGACY_TIMESTAMP_AND_NEW_RFC3339_TIMESTAMP_RENDER_WITHOUT_INVALID_DATE `validation.V3` - - **V4**：CHANNEL_NAME_NUMBER_PRIVATE_GIT_AND_TYPED_CONVERSATION_PASS `validation.V4` - - **V5**：KNOWLEDGE_CREATE_READ_EDIT_IMPORT_EXPORT_TRASH_RENDER_AND_GIT_PASS `validation.V5` - - **V6**：MODULE_MARKET_SEPARATES_PERSONA_AND_HUMAN_MODULES `validation.V6` - - **V7**：EXTERNAL_PROGRAMMING_AI_LOOPBACK_CONNECTION_HAS_NO_IMPLICIT_PERSONA_OR_EXECUTION_AUTHORITY `validation.V7` - - **V8**：ENTERPRISE_GATE_REJECTS_UNKNOWN_MEMBER_WRONG_DOMAIN_WRONG_PERSONA_UNREGISTERED_DEVICE_REPLAY_AND_EXPIRED_SESSION `validation.V8` - - **V9**：PUBLIC_UPDATE_DOWNLOAD_SIGNATURE_INSTALL_ROLLBACK_AND_VERSION_READBACK_PASS `validation.V9` -- **vocabulary** `vocabulary` - - **agent**：MODEL_INDEPENDENT_DETERMINISTIC_EXECUTION_LIMB `vocabulary.agent` - - **clean_shell**：NEW_MINIMAL_CLIENT_WITHOUT_WHOLE_LEGACY_PRODUCT_MERGE `vocabulary.clean_shell` - - **dual_git**：SIGNED_PUBLIC_DISTRIBUTION_GIT_PLUS_USER_OWNED_PRIVATE_GIT `vocabulary.dual_git` - - **enterprise_entrance**：AUTHORIZED_TEAM_MEMBER_ROUTE_TO_RESPONSIBILITY_SCOPED_ENTERPRISE_REPOSITORY `vocabulary.enterprise_entrance` - - **native_language**：TCS_TO_GIR_TO_REGISTERED_CAPABILITY_TO_RECEIPT `vocabulary.native_language` - - **personal_channel**：USER_OWNED_NAMED_NUMBERED_LANGUAGE_AND_PERSONA_INTERACTION_SURFACE `vocabulary.personal_channel` - ---- - -This page changes only the reading order; it does not change TCS/HLDP semantics. diff --git a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.human.zh-CN.md b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.human.zh-CN.md deleted file mode 100644 index 59bcd3bc4..000000000 --- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.human.zh-CN.md +++ /dev/null @@ -1,250 +0,0 @@ -# HoloLake第一版当前自然语言执行基线 · 简体中文人类工程语言版 - -> 这是 TCS/HLDP 原生源码的简体中文阅读投影，不是新的正本，也不授予执行权限。若本页与 `.tcs` 源码不一致，以经过校验的 `.tcs` 源码为准。 - -## 这是什么 - -这是一份 **协议** 声明，编号为 `HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001`，版本为 `1.0.0`。转换器已先用 Stage-1 编译器校验原生源码，再把机器枚举翻译成汉语；原始编号保留在括号和字段路径中。 - -## 谁在这里 - -- **scope** `scope` - - **client**：TAURI_V2_RUST_REACT `scope.client` - - **development_channel**：ICE-CH-ZC001 `scope.development_channel` - - **enterprise_domains_embedded**：否 `scope.enterprise_domains_embedded` - - **fifth_domain_private_content_embedded**：否 `scope.fifth_domain_private_content_embedded` - - **product**：HOLOLAKE_CLEAN_V1 `scope.product` - - **public_channel**：CH-ZERO-CORE-LPM `scope.public_channel` - -## 为什么开始 - -- **来源** `source` - - **来源编号**：BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903 `source.source_id` - - **来源角色**：人类直接语言来源（`DIRECT_HUMAN`） `source.source_role` - - **来源校验值**：7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2 `source.source_sha256` - - **来源地址**：private-anchor://codex/01a0672d-f125-7452-988e-523a6a34bfd4/HOLOLAKE-CLEAN-V1-ONLY-ANCHORS `source.source_uri` - -## 发生了什么变化 - -- **transitions** `transitions` - - **T1**：SOURCE_ANCHORED_TO_ARCHITECTURE_ALIGNED `transitions.T1` - - **T2**：ARCHITECTURE_ALIGNED_TO_LOCAL_RUNTIME_VERIFIED `transitions.T2` - - **T3**：LOCAL_RUNTIME_VERIFIED_TO_PUBLIC_DISTRIBUTION_BOUND `transitions.T3` - - **T4**：PUBLIC_DISTRIBUTION_BOUND_TO_ENTERPRISE_ENTRANCE_VERIFIED `transitions.T4` - - **T5**：ENTERPRISE_ENTRANCE_VERIFIED_TO_SIGNED_RELEASE_INSTALLED `transitions.T5` - - **T6**：SIGNED_RELEASE_INSTALLED_TO_V1_ACCEPTED_AFTER_REAL_HUMAN_VISIBLE_READBACK `transitions.T6` - - **TF**：SOURCE_PATH_SIGNATURE_AUTHORIZATION_CONCURRENCY_OR_TARGET_READBACK_FAILURE_TO_FAILED_CLOSED `transitions.TF` -- **states** `states` - - **initial**：SOURCE_ANCHORED `states.initial` - - **terminal** `states.terminal` - - V1_ACCEPTED - - FAILED_CLOSED - - **values** `states.values` - - SOURCE_ANCHORED - - ARCHITECTURE_ALIGNED - - LOCAL_RUNTIME_VERIFIED - - PUBLIC_DISTRIBUTION_BOUND - - ENTERPRISE_ENTRANCE_VERIFIED - - SIGNED_RELEASE_INSTALLED - - V1_ACCEPTED - - FAILED_CLOSED - -## 准备怎样执行 - -这是非执行声明，没有动作图。 - -## 边界与异常处理 - -- **invariants** `invariants` - - **I1**：RAW_DIRECT_LANGUAGE_AND_FIFTH_DOMAIN_PRIVATE_CONTENT_NEVER_ENTER_PUBLIC_PACKAGE `invariants.I1` - - **I10**：MODULES_HAVE_STABLE_IDS_AND_LEGACY_SOURCES_ARE_SLICE_DONORS_ONLY `invariants.I10` - - **I2**：ENTERPRISE_SERVER_AND_FOUR_DOMAIN_SYSTEM_BODIES_ARE_NOT_EMBEDDED_IN_HOLOLAKE `invariants.I2` - - **I3**：ENTERPRISE_CLIENT_CONTAINS_ONLY_A_GATED_LOGIN_ROUTE_AND_PUBLIC_SIGNED_DISTRIBUTION_CONSUMER `invariants.I3` - - **I4**：TEAM_LOGIN_REQUIRES_DOMAIN_RESPONSIBLE_HUMAN_ID_PERSONA_ID_DEVICE_KEY_PROOF_AND_SCOPED_SHORT_LIVED_SESSION `invariants.I4` - - **I5**：MACHINE_FINGERPRINT_IS_AUXILIARY_EVIDENCE_NOT_A_SOLE_CREDENTIAL `invariants.I5` - - **I6**：PERSONAL_SERVER_MAY_BRIDGE_DEVICE_TO_ENTERPRISE_BUT_CANNOT_EXPAND_DOMAIN_OR_REPOSITORY_SCOPE `invariants.I6` - - **I7**：USER_PERSONA_SYSTEM_CONTEXT_PROTOCOL_AGENT_TOOL_AND_RECEIPT_ARE_DISTINCT_TYPED_SOURCES `invariants.I7` - - **I8**：AGENT_EXECUTION_DOES_NOT_REQUIRE_MODEL_NATIVE_TOOL_CALLING `invariants.I8` - - **I9**：PUBLIC_UPDATE_PRIVATE_GIT_AND_REALTIME_GLP_ARE_THREE_SEPARATE_PLANES `invariants.I9` -- **errors** `errors` - - **E1**：DIRECT_LANGUAGE_ANCHOR_MISMATCH `errors.E1` - - **E2**：UNTYPED_SOURCE_REJECTED `errors.E2` - - **E3**：LEGACY_WHOLE_PRODUCT_MERGE_REJECTED `errors.E3` - - **E4**：UNSIGNED_PUBLIC_UPDATE_REJECTED `errors.E4` - - **E5**：ENTERPRISE_IDENTITY_OR_DEVICE_PROOF_REJECTED `errors.E5` - - **E6**：DOMAIN_REPOSITORY_SCOPE_REJECTED `errors.E6` - - **E7**：SERVER_CONCURRENCY_CONFLICT_DEFERRED `errors.E7` - - **E8**：TARGET_READBACK_OR_RECEIPT_INTEGRITY_FAILED `errors.E8` - -## 怎样算完成 - -- **验收标准** `acceptance` - - **partial**：否 `acceptance.partial` - - **是否必需** `acceptance.required` - - SOURCE_HASH - - ARCHITECTURE - - TCS_GIR - - TIMESTAMP - - CHANNEL - - KNOWLEDGE - - MODULE_REGISTRY - - TYPED_LANGUAGE - - AGENT - - EXTERNAL_AI - - PUBLIC_UPDATE - - ENTERPRISE_GATE - - SIGNED_APP - - REAL_UI - - **scale**：ZERO_OR_ONE_HUNDRED `acceptance.scale` -- **validation** `validation` - - **V1**：CURRENT_WORKTREE_EQUALS_REPO014_ONLINE_MAIN_BEFORE_FIRST_MUTATION `validation.V1` - - **V10**：OLD_APP_REMOVAL_OCCURS_ONLY_AFTER_NEW_APP_REAL_ACCEPTANCE `validation.V10` - - **V2**：CURRENT_PRODUCT_ASSESSMENT_HAS_ONE_NON_CONTRADICTORY_VERSION_SOURCE_AND_STAGE `validation.V2` - - **V3**：LEGACY_TIMESTAMP_AND_NEW_RFC3339_TIMESTAMP_RENDER_WITHOUT_INVALID_DATE `validation.V3` - - **V4**：CHANNEL_NAME_NUMBER_PRIVATE_GIT_AND_TYPED_CONVERSATION_PASS `validation.V4` - - **V5**：KNOWLEDGE_CREATE_READ_EDIT_IMPORT_EXPORT_TRASH_RENDER_AND_GIT_PASS `validation.V5` - - **V6**：MODULE_MARKET_SEPARATES_PERSONA_AND_HUMAN_MODULES `validation.V6` - - **V7**：EXTERNAL_PROGRAMMING_AI_LOOPBACK_CONNECTION_HAS_NO_IMPLICIT_PERSONA_OR_EXECUTION_AUTHORITY `validation.V7` - - **V8**：ENTERPRISE_GATE_REJECTS_UNKNOWN_MEMBER_WRONG_DOMAIN_WRONG_PERSONA_UNREGISTERED_DEVICE_REPLAY_AND_EXPIRED_SESSION `validation.V8` - - **V9**：PUBLIC_UPDATE_DOWNLOAD_SIGNATURE_INSTALL_ROLLBACK_AND_VERSION_READBACK_PASS `validation.V9` - -## 下一次从哪里继续 - -源程序没有提供这一项，转换器不猜。 - -## 来源与校验 - -- **原生声明编号**：`HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001` -- **原生声明类型**：`PROTOCOL` -- **TCS 源码 SHA-256**：`570d9b7d41f955236abc9a22ce3996ed323fe77f5aa001a5a997aa4aa1a1de29` -- **校验编译器**：`TCS-COMPILER-STAGE1-0001` -- **投影协议**：`GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001` - -## 原生结构逐项对照 - -下面保留源码的全部顶层结构和字段路径，供人类审计投影有没有漏掉信息。 - -- **验收标准** `acceptance` - - **partial**：否 `acceptance.partial` - - **是否必需** `acceptance.required` - - SOURCE_HASH - - ARCHITECTURE - - TCS_GIR - - TIMESTAMP - - CHANNEL - - KNOWLEDGE - - MODULE_REGISTRY - - TYPED_LANGUAGE - - AGENT - - EXTERNAL_AI - - PUBLIC_UPDATE - - ENTERPRISE_GATE - - SIGNED_APP - - REAL_UI - - **scale**：ZERO_OR_ONE_HUNDRED `acceptance.scale` -- **errors** `errors` - - **E1**：DIRECT_LANGUAGE_ANCHOR_MISMATCH `errors.E1` - - **E2**：UNTYPED_SOURCE_REJECTED `errors.E2` - - **E3**：LEGACY_WHOLE_PRODUCT_MERGE_REJECTED `errors.E3` - - **E4**：UNSIGNED_PUBLIC_UPDATE_REJECTED `errors.E4` - - **E5**：ENTERPRISE_IDENTITY_OR_DEVICE_PROOF_REJECTED `errors.E5` - - **E6**：DOMAIN_REPOSITORY_SCOPE_REJECTED `errors.E6` - - **E7**：SERVER_CONCURRENCY_CONFLICT_DEFERRED `errors.E7` - - **E8**：TARGET_READBACK_OR_RECEIPT_INTEGRITY_FAILED `errors.E8` -- **examples** `examples` - - **negative**：ANY_HOLOLAKE_USER_CLICKS_ENTERPRISE_PORTAL_AND_RECEIVES_A_PERMANENT_PASSWORD_OR_CROSS_DOMAIN_REPOSITORY_ACCESS `examples.negative` - - **positive**：REGISTERED_DOMAIN_RESPONSIBLE_HUMAN_USES_BOUND_PERSONA_AND_LOCAL_DEVICE_KEY_TO_OPEN_A_SHORT_LIVED_SESSION_TO_ONLY_THEIR_ENTERPRISE_REPOSITORY `examples.positive` -- **fields** `fields` - - **MAY**：LOCAL_USER_CHANNEL_AND_REGISTERED_MODULE_ACTIONS; ENTERPRISE_LOGIN_ONLY_AFTER_HUMAN_PERSONA_DEVICE_AND_OPTIONAL_PERSONAL_SERVER_PROOF `fields.MAY` - - **PROVE**：TCS_GIR_MODULE_REGISTRY_SOURCE_KIND_TESTS_PRIVATE_GIT_TARGET_READBACK_SIGNED_UPDATE_NEGATIVE_CASES_ENTERPRISE_AUTH_CHALLENGE_AND_INSTALLED_APP_ACCEPTANCE `fields.PROVE` - - **WHAT**：CLEAN_CLIENT_SIGNED_UPDATE_TCS_NATIVE_RUNTIME_DUAL_GIT_TYPED_LANGUAGE_CHANNEL_KNOWLEDGE_MODULE_MARKET_ENTERPRISE_ENTRANCE_AND_EXTERNAL_PROGRAMMING_AI_BRIDGE `fields.WHAT` - - **WHO**：USER_OWNS_PRIVATE_CHANNEL; PERSONA_REASONS; AGENT_EXECUTES; DOMAIN_RESPONSIBLE_HUMAN_AND_BOUND_PERSONA_ENTER_ONLY_THEIR_ENTERPRISE_REPOSITORY `fields.WHO` - - **WHY**：LET_HUMANS_OPERATE_BY_LANGUAGE_WHILE_PERSONA_SYSTEM_PROTOCOL_AGENT_TOOL_AND_RECEIPT_SOURCES_REMAIN_DISTINGUISHABLE_AND_REALITY_ACTIONS_REMAIN_VERIFIABLE `fields.WHY` -- **语言头** `header` - - **正本路径**：product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs `header.canonical_uri` - - **compatibility** `header.compatibility` - - TCS-DECLARATION-STANDARD-0001 - - TCS-FIELD-STANDARD-0001 - - HLP-CURRENT-ARCH-001 - - **语言**：TCS/0.1 `header.language` - - **生命周期**：候选版本，尚未成为正式正本（`CANDIDATE`） `header.lifecycle` - - **英文名**：HoloLake Clean V1 Current Direct-Language Execution Baseline `header.name_en` - - **中文名**：HoloLake第一版当前自然语言执行基线 `header.name_zh` - - **协议配置**：PUBLIC-PRODUCT-ENGINEERING/1 `header.profile` - - **protocols** `header.protocols` - - TCS - - HLDP - - GLS - - GLP - - GLS-0130 - - GLS-0131 - - GLS-0306 - - **schema**：tcs.protocol/v1 `header.schema` - - **版本**：1.0.0 `header.version` -- **invariants** `invariants` - - **I1**：RAW_DIRECT_LANGUAGE_AND_FIFTH_DOMAIN_PRIVATE_CONTENT_NEVER_ENTER_PUBLIC_PACKAGE `invariants.I1` - - **I10**：MODULES_HAVE_STABLE_IDS_AND_LEGACY_SOURCES_ARE_SLICE_DONORS_ONLY `invariants.I10` - - **I2**：ENTERPRISE_SERVER_AND_FOUR_DOMAIN_SYSTEM_BODIES_ARE_NOT_EMBEDDED_IN_HOLOLAKE `invariants.I2` - - **I3**：ENTERPRISE_CLIENT_CONTAINS_ONLY_A_GATED_LOGIN_ROUTE_AND_PUBLIC_SIGNED_DISTRIBUTION_CONSUMER `invariants.I3` - - **I4**：TEAM_LOGIN_REQUIRES_DOMAIN_RESPONSIBLE_HUMAN_ID_PERSONA_ID_DEVICE_KEY_PROOF_AND_SCOPED_SHORT_LIVED_SESSION `invariants.I4` - - **I5**：MACHINE_FINGERPRINT_IS_AUXILIARY_EVIDENCE_NOT_A_SOLE_CREDENTIAL `invariants.I5` - - **I6**：PERSONAL_SERVER_MAY_BRIDGE_DEVICE_TO_ENTERPRISE_BUT_CANNOT_EXPAND_DOMAIN_OR_REPOSITORY_SCOPE `invariants.I6` - - **I7**：USER_PERSONA_SYSTEM_CONTEXT_PROTOCOL_AGENT_TOOL_AND_RECEIPT_ARE_DISTINCT_TYPED_SOURCES `invariants.I7` - - **I8**：AGENT_EXECUTION_DOES_NOT_REQUIRE_MODEL_NATIVE_TOOL_CALLING `invariants.I8` - - **I9**：PUBLIC_UPDATE_PRIVATE_GIT_AND_REALTIME_GLP_ARE_THREE_SEPARATE_PLANES `invariants.I9` -- **scope** `scope` - - **client**：TAURI_V2_RUST_REACT `scope.client` - - **development_channel**：ICE-CH-ZC001 `scope.development_channel` - - **enterprise_domains_embedded**：否 `scope.enterprise_domains_embedded` - - **fifth_domain_private_content_embedded**：否 `scope.fifth_domain_private_content_embedded` - - **product**：HOLOLAKE_CLEAN_V1 `scope.product` - - **public_channel**：CH-ZERO-CORE-LPM `scope.public_channel` -- **来源** `source` - - **来源编号**：BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903 `source.source_id` - - **来源角色**：人类直接语言来源（`DIRECT_HUMAN`） `source.source_role` - - **来源校验值**：7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2 `source.source_sha256` - - **来源地址**：private-anchor://codex/01a0672d-f125-7452-988e-523a6a34bfd4/HOLOLAKE-CLEAN-V1-ONLY-ANCHORS `source.source_uri` -- **states** `states` - - **initial**：SOURCE_ANCHORED `states.initial` - - **terminal** `states.terminal` - - V1_ACCEPTED - - FAILED_CLOSED - - **values** `states.values` - - SOURCE_ANCHORED - - ARCHITECTURE_ALIGNED - - LOCAL_RUNTIME_VERIFIED - - PUBLIC_DISTRIBUTION_BOUND - - ENTERPRISE_ENTRANCE_VERIFIED - - SIGNED_RELEASE_INSTALLED - - V1_ACCEPTED - - FAILED_CLOSED -- **transitions** `transitions` - - **T1**：SOURCE_ANCHORED_TO_ARCHITECTURE_ALIGNED `transitions.T1` - - **T2**：ARCHITECTURE_ALIGNED_TO_LOCAL_RUNTIME_VERIFIED `transitions.T2` - - **T3**：LOCAL_RUNTIME_VERIFIED_TO_PUBLIC_DISTRIBUTION_BOUND `transitions.T3` - - **T4**：PUBLIC_DISTRIBUTION_BOUND_TO_ENTERPRISE_ENTRANCE_VERIFIED `transitions.T4` - - **T5**：ENTERPRISE_ENTRANCE_VERIFIED_TO_SIGNED_RELEASE_INSTALLED `transitions.T5` - - **T6**：SIGNED_RELEASE_INSTALLED_TO_V1_ACCEPTED_AFTER_REAL_HUMAN_VISIBLE_READBACK `transitions.T6` - - **TF**：SOURCE_PATH_SIGNATURE_AUTHORIZATION_CONCURRENCY_OR_TARGET_READBACK_FAILURE_TO_FAILED_CLOSED `transitions.TF` -- **validation** `validation` - - **V1**：CURRENT_WORKTREE_EQUALS_REPO014_ONLINE_MAIN_BEFORE_FIRST_MUTATION `validation.V1` - - **V10**：OLD_APP_REMOVAL_OCCURS_ONLY_AFTER_NEW_APP_REAL_ACCEPTANCE `validation.V10` - - **V2**：CURRENT_PRODUCT_ASSESSMENT_HAS_ONE_NON_CONTRADICTORY_VERSION_SOURCE_AND_STAGE `validation.V2` - - **V3**：LEGACY_TIMESTAMP_AND_NEW_RFC3339_TIMESTAMP_RENDER_WITHOUT_INVALID_DATE `validation.V3` - - **V4**：CHANNEL_NAME_NUMBER_PRIVATE_GIT_AND_TYPED_CONVERSATION_PASS `validation.V4` - - **V5**：KNOWLEDGE_CREATE_READ_EDIT_IMPORT_EXPORT_TRASH_RENDER_AND_GIT_PASS `validation.V5` - - **V6**：MODULE_MARKET_SEPARATES_PERSONA_AND_HUMAN_MODULES `validation.V6` - - **V7**：EXTERNAL_PROGRAMMING_AI_LOOPBACK_CONNECTION_HAS_NO_IMPLICIT_PERSONA_OR_EXECUTION_AUTHORITY `validation.V7` - - **V8**：ENTERPRISE_GATE_REJECTS_UNKNOWN_MEMBER_WRONG_DOMAIN_WRONG_PERSONA_UNREGISTERED_DEVICE_REPLAY_AND_EXPIRED_SESSION `validation.V8` - - **V9**：PUBLIC_UPDATE_DOWNLOAD_SIGNATURE_INSTALL_ROLLBACK_AND_VERSION_READBACK_PASS `validation.V9` -- **vocabulary** `vocabulary` - - **agent**：MODEL_INDEPENDENT_DETERMINISTIC_EXECUTION_LIMB `vocabulary.agent` - - **clean_shell**：NEW_MINIMAL_CLIENT_WITHOUT_WHOLE_LEGACY_PRODUCT_MERGE `vocabulary.clean_shell` - - **dual_git**：SIGNED_PUBLIC_DISTRIBUTION_GIT_PLUS_USER_OWNED_PRIVATE_GIT `vocabulary.dual_git` - - **enterprise_entrance**：AUTHORIZED_TEAM_MEMBER_ROUTE_TO_RESPONSIBILITY_SCOPED_ENTERPRISE_REPOSITORY `vocabulary.enterprise_entrance` - - **native_language**：TCS_TO_GIR_TO_REGISTERED_CAPABILITY_TO_RECEIPT `vocabulary.native_language` - - **personal_channel**：USER_OWNED_NAMED_NUMBERED_LANGUAGE_AND_PERSONA_INTERACTION_SURFACE `vocabulary.personal_channel` - ---- - -本页只改变阅读顺序，不改变 TCS/HLDP 语义。 diff --git a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.gir.json b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.gir.json deleted file mode 100644 index 55b3084f4..000000000 --- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.gir.json +++ /dev/null @@ -1,112 +0,0 @@ -{ - "compiled_from": { - "compiler_id": "TCS-COMPILER-STAGE1-0001", - "compiler_state": "TCS_COMPILER_GIR_EXECUTED", - "source_sha256": "c32cd3e16fdd64588addca115821a49bb47bf39b584670df031cf92028a8d232" - }, - "declaration": { - "boundaries": { - "values": [ - "服务不保存Forgejo密码", - "设备私钥从不离开成员本机Keychain", - "机器指纹不能单独认证", - "会话只限单域单仓且十分钟过期", - "企业会话不替代Forgejo自身仓库登录", - "冰朔公共语言主控仓继续走JD第五域桥接而非普通人类登录", - "本轮未登记任何真实成员设备" - ] - }, - "header": { - "canonical_uri": "product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.tcs", - "compatibility": [ - "GH-CVM-MAIN-PROD-01", - "PYTHON/3.10", - "ED25519", - "NGINX" - ], - "language": "TCS/0.1", - "lifecycle": "CANDIDATE", - "name_en": "HoloLake Enterprise Responsibility Device Gate Deployment Receipt", - "name_zh": "HoloLake企业责任设备门部署回执", - "profile": "PUBLIC-PRODUCT-ENGINEERING/1", - "protocols": [ - "HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903", - "HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001" - ], - "schema": "tcs.receipt/v1", - "version": "1.0.0" - }, - "integrity": { - "existing_services_preserved": "PASS", - "source_archive_sha256": "91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2", - "source_transport_manifest_sha256": "653ae0ca824fd8b9fff8d8532e82eddce63a8aa9f070e7a6aa3f863834e4ae77", - "tcs_stage1_compilation": "PASS", - "unknown_device_negative": "PASS" - }, - "next": { - "optional": [ - "团队成员从HoloLake使用本人凭证完成首次设备登记", - "正向验证挑战与单仓会话", - "后续加入个人服务器二次桥接证明" - ], - "state": "SERVER_GATE_ACTIVE_CLIENT_INTEGRATION_REBUILD_REQUIRED" - }, - "operation": { - "values": [ - "验证源码运输归档与manifest", - "解包到/opt/guanghu-hololake-enterprise-gate/releases/be31c41", - "创建独立lighthouse权限数据库与服务密钥", - "安装guanghu-hololake-enterprise-gate.service", - "加入guanghu.chat精确device-gate路由", - "执行本地和外部健康、未知设备拒绝及原服务存活测试" - ] - }, - "proof": { - "current_link": "/opt/guanghu-hololake-enterprise-gate/current", - "database": "/var/lib/guanghu-hololake-enterprise-gate/gate.sqlite3", - "nginx_backup": "/etc/nginx/sites-enabled/guanghu.chat.pre-hololake-device-gate-be31c41", - "nginx_snippet": "/etc/nginx/snippets/guanghu-hololake-enterprise-gate.conf", - "server_release": "/opt/guanghu-hololake-enterprise-gate/releases/be31c41" - }, - "request": { - "scope": "GH-CVM-MAIN-PROD-01独立8033服务与精确Nginx路由", - "source": "BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903", - "value": "部署企业四域负责人通过HoloLake本机设备和人格编号验证后进入本人责任仓库的服务端验证门。" - }, - "result": { - "active_sessions": 0, - "endpoint": "https://guanghu.chat/api/hololake/enterprise/device-gate", - "node_id": "GH-CVM-MAIN-PROD-01", - "registered_devices": 0, - "service": "guanghu-hololake-enterprise-gate.service", - "service_state": "ACTIVE", - "source_archive_sha256": "91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2", - "source_commit": "be31c41", - "state": "PASS" - }, - "verification": { - "values": [ - "DMI UUID为10ace744-13e1-472e-8dba-6bb823a073bf", - "服务器Python cryptography Ed25519测试2项通过", - "systemd服务active", - "127.0.0.1:8033/health返回ok", - "外部HTTPS device-gate/health返回ok", - "未知设备领取挑战返回HTTP404 registered device required", - "guanghu-enterprise-identity.service保持active", - "guanghu-flagos-collaboration.service保持active", - "nginx.service保持active", - "当前设备与会话数量均为0未伪造成员" - ] - } - }, - "executable": false, - "identity": { - "declaration_id": "HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903", - "declaration_kind": "RECEIPT", - "language_version": "0.1" - }, - "native_self_hosted": true, - "natural_language_is_typed_data": true, - "schema": "guanghu.declaration-gir/v1", - "unresolved_natural_language": false -} diff --git a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.human.en-US.md b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.human.en-US.md deleted file mode 100644 index 673cddd91..000000000 --- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.human.en-US.md +++ /dev/null @@ -1,130 +0,0 @@ -# HoloLake Enterprise Responsibility Device Gate Deployment Receipt · Human Engineering Language (English) - -> This is an English reading projection of validated native TCS/HLDP source. It is not a new canonical source and grants no execution authority. - -## What this is - -This is a **receipt** declaration with identifier `HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903` and version `1.0.0`. The projector validates it with the Stage-1 compiler before changing its reading order. - -## Who is here - -The native source does not provide this field; the projector does not guess. - -## Why this started - -The native source does not provide this field; the projector does not guess. - -## What changed - -The native source does not provide this field; the projector does not guess. - -## How it will execute - -This is a non-executable declaration and has no action graph. - -## Boundaries and exception handling - -The native source does not provide this field; the projector does not guess. - -## How completion is proven - -The native source does not provide this field; the projector does not guess. - -## Where to continue next time - -The native source does not provide this field; the projector does not guess. - -## Source and verification - -- **Native declaration identifier**: `HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903` -- **Native declaration kind**: `RECEIPT` -- **TCS source SHA-256**: `c32cd3e16fdd64588addca115821a49bb47bf39b584670df031cf92028a8d232` -- **Validation compiler**: `TCS-COMPILER-STAGE1-0001` -- **Projection protocol**: `GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001` - -## Complete native structure cross-reference - -All top-level structures and field paths are retained below so a reader can audit whether the projection omitted information. - -- **boundaries** `boundaries` - - **values** `boundaries.values` - - 服务不保存Forgejo密码 - - 设备私钥从不离开成员本机Keychain - - 机器指纹不能单独认证 - - 会话只限单域单仓且十分钟过期 - - 企业会话不替代Forgejo自身仓库登录 - - 冰朔公共语言主控仓继续走JD第五域桥接而非普通人类登录 - - 本轮未登记任何真实成员设备 -- **header** `header` - - **canonical source path**：product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.tcs `header.canonical_uri` - - **compatibility** `header.compatibility` - - GH-CVM-MAIN-PROD-01 - - PYTHON/3.10 - - ED25519 - - NGINX - - **language**：TCS/0.1 `header.language` - - **lifecycle**：CANDIDATE `header.lifecycle` - - **English name**：HoloLake Enterprise Responsibility Device Gate Deployment Receipt `header.name_en` - - **Chinese name**：HoloLake企业责任设备门部署回执 `header.name_zh` - - **profile**：PUBLIC-PRODUCT-ENGINEERING/1 `header.profile` - - **protocols** `header.protocols` - - HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903 - - HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001 - - **schema**：tcs.receipt/v1 `header.schema` - - **version**：1.0.0 `header.version` -- **integrity** `integrity` - - **existing_services_preserved**：PASS `integrity.existing_services_preserved` - - **source_archive_sha256**：91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2 `integrity.source_archive_sha256` - - **source_transport_manifest_sha256**：653ae0ca824fd8b9fff8d8532e82eddce63a8aa9f070e7a6aa3f863834e4ae77 `integrity.source_transport_manifest_sha256` - - **tcs_stage1_compilation**：PASS `integrity.tcs_stage1_compilation` - - **unknown_device_negative**：PASS `integrity.unknown_device_negative` -- **next** `next` - - **optional** `next.optional` - - 团队成员从HoloLake使用本人凭证完成首次设备登记 - - 正向验证挑战与单仓会话 - - 后续加入个人服务器二次桥接证明 - - **state**：SERVER_GATE_ACTIVE_CLIENT_INTEGRATION_REBUILD_REQUIRED `next.state` -- **operation** `operation` - - **values** `operation.values` - - 验证源码运输归档与manifest - - 解包到/opt/guanghu-hololake-enterprise-gate/releases/be31c41 - - 创建独立lighthouse权限数据库与服务密钥 - - 安装guanghu-hololake-enterprise-gate.service - - 加入guanghu.chat精确device-gate路由 - - 执行本地和外部健康、未知设备拒绝及原服务存活测试 -- **proof** `proof` - - **current_link**：/opt/guanghu-hololake-enterprise-gate/current `proof.current_link` - - **database**：/var/lib/guanghu-hololake-enterprise-gate/gate.sqlite3 `proof.database` - - **nginx_backup**：/etc/nginx/sites-enabled/guanghu.chat.pre-hololake-device-gate-be31c41 `proof.nginx_backup` - - **nginx_snippet**：/etc/nginx/snippets/guanghu-hololake-enterprise-gate.conf `proof.nginx_snippet` - - **server_release**：/opt/guanghu-hololake-enterprise-gate/releases/be31c41 `proof.server_release` -- **request** `request` - - **scope**：GH-CVM-MAIN-PROD-01独立8033服务与精确Nginx路由 `request.scope` - - **source**：BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903 `request.source` - - **value**：部署企业四域负责人通过HoloLake本机设备和人格编号验证后进入本人责任仓库的服务端验证门。 `request.value` -- **result** `result` - - **active_sessions**：0 `result.active_sessions` - - **endpoint**：https://guanghu.chat/api/hololake/enterprise/device-gate `result.endpoint` - - **node_id**：GH-CVM-MAIN-PROD-01 `result.node_id` - - **registered_devices**：0 `result.registered_devices` - - **service**：guanghu-hololake-enterprise-gate.service `result.service` - - **service_state**：ACTIVE `result.service_state` - - **source_archive_sha256**：91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2 `result.source_archive_sha256` - - **source_commit**：be31c41 `result.source_commit` - - **state**：PASS `result.state` -- **verification** `verification` - - **values** `verification.values` - - DMI UUID为10ace744-13e1-472e-8dba-6bb823a073bf - - 服务器Python cryptography Ed25519测试2项通过 - - systemd服务active - - 127.0.0.1:8033/health返回ok - - 外部HTTPS device-gate/health返回ok - - 未知设备领取挑战返回HTTP404 registered device required - - guanghu-enterprise-identity.service保持active - - guanghu-flagos-collaboration.service保持active - - nginx.service保持active - - 当前设备与会话数量均为0未伪造成员 - ---- - -This page changes only the reading order; it does not change TCS/HLDP semantics. diff --git a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.human.zh-CN.md b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.human.zh-CN.md deleted file mode 100644 index 7a97c80ad..000000000 --- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.human.zh-CN.md +++ /dev/null @@ -1,130 +0,0 @@ -# HoloLake企业责任设备门部署回执 · 简体中文人类工程语言版 - -> 这是 TCS/HLDP 原生源码的简体中文阅读投影，不是新的正本，也不授予执行权限。若本页与 `.tcs` 源码不一致，以经过校验的 `.tcs` 源码为准。 - -## 这是什么 - -这是一份 **回执** 声明，编号为 `HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903`，版本为 `1.0.0`。转换器已先用 Stage-1 编译器校验原生源码，再把机器枚举翻译成汉语；原始编号保留在括号和字段路径中。 - -## 谁在这里 - -源程序没有提供这一项，转换器不猜。 - -## 为什么开始 - -源程序没有提供这一项，转换器不猜。 - -## 发生了什么变化 - -源程序没有提供这一项，转换器不猜。 - -## 准备怎样执行 - -这是非执行声明，没有动作图。 - -## 边界与异常处理 - -源程序没有提供这一项，转换器不猜。 - -## 怎样算完成 - -源程序没有提供这一项，转换器不猜。 - -## 下一次从哪里继续 - -源程序没有提供这一项，转换器不猜。 - -## 来源与校验 - -- **原生声明编号**：`HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903` -- **原生声明类型**：`RECEIPT` -- **TCS 源码 SHA-256**：`c32cd3e16fdd64588addca115821a49bb47bf39b584670df031cf92028a8d232` -- **校验编译器**：`TCS-COMPILER-STAGE1-0001` -- **投影协议**：`GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001` - -## 原生结构逐项对照 - -下面保留源码的全部顶层结构和字段路径，供人类审计投影有没有漏掉信息。 - -- **boundaries** `boundaries` - - **values** `boundaries.values` - - 服务不保存Forgejo密码 - - 设备私钥从不离开成员本机Keychain - - 机器指纹不能单独认证 - - 会话只限单域单仓且十分钟过期 - - 企业会话不替代Forgejo自身仓库登录 - - 冰朔公共语言主控仓继续走JD第五域桥接而非普通人类登录 - - 本轮未登记任何真实成员设备 -- **语言头** `header` - - **正本路径**：product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.tcs `header.canonical_uri` - - **compatibility** `header.compatibility` - - GH-CVM-MAIN-PROD-01 - - PYTHON/3.10 - - ED25519 - - NGINX - - **语言**：TCS/0.1 `header.language` - - **生命周期**：候选版本，尚未成为正式正本（`CANDIDATE`） `header.lifecycle` - - **英文名**：HoloLake Enterprise Responsibility Device Gate Deployment Receipt `header.name_en` - - **中文名**：HoloLake企业责任设备门部署回执 `header.name_zh` - - **协议配置**：PUBLIC-PRODUCT-ENGINEERING/1 `header.profile` - - **protocols** `header.protocols` - - HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903 - - HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001 - - **schema**：tcs.receipt/v1 `header.schema` - - **版本**：1.0.0 `header.version` -- **integrity** `integrity` - - **existing_services_preserved**：PASS `integrity.existing_services_preserved` - - **source_archive_sha256**：91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2 `integrity.source_archive_sha256` - - **source_transport_manifest_sha256**：653ae0ca824fd8b9fff8d8532e82eddce63a8aa9f070e7a6aa3f863834e4ae77 `integrity.source_transport_manifest_sha256` - - **tcs_stage1_compilation**：PASS `integrity.tcs_stage1_compilation` - - **unknown_device_negative**：PASS `integrity.unknown_device_negative` -- **next** `next` - - **optional** `next.optional` - - 团队成员从HoloLake使用本人凭证完成首次设备登记 - - 正向验证挑战与单仓会话 - - 后续加入个人服务器二次桥接证明 - - **state**：SERVER_GATE_ACTIVE_CLIENT_INTEGRATION_REBUILD_REQUIRED `next.state` -- **操作** `operation` - - **values** `operation.values` - - 验证源码运输归档与manifest - - 解包到/opt/guanghu-hololake-enterprise-gate/releases/be31c41 - - 创建独立lighthouse权限数据库与服务密钥 - - 安装guanghu-hololake-enterprise-gate.service - - 加入guanghu.chat精确device-gate路由 - - 执行本地和外部健康、未知设备拒绝及原服务存活测试 -- **proof** `proof` - - **current_link**：/opt/guanghu-hololake-enterprise-gate/current `proof.current_link` - - **database**：/var/lib/guanghu-hololake-enterprise-gate/gate.sqlite3 `proof.database` - - **nginx_backup**：/etc/nginx/sites-enabled/guanghu.chat.pre-hololake-device-gate-be31c41 `proof.nginx_backup` - - **nginx_snippet**：/etc/nginx/snippets/guanghu-hololake-enterprise-gate.conf `proof.nginx_snippet` - - **server_release**：/opt/guanghu-hololake-enterprise-gate/releases/be31c41 `proof.server_release` -- **request** `request` - - **scope**：GH-CVM-MAIN-PROD-01独立8033服务与精确Nginx路由 `request.scope` - - **来源**：BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903 `request.source` - - **value**：部署企业四域负责人通过HoloLake本机设备和人格编号验证后进入本人责任仓库的服务端验证门。 `request.value` -- **result** `result` - - **active_sessions**：0 `result.active_sessions` - - **endpoint**：https://guanghu.chat/api/hololake/enterprise/device-gate `result.endpoint` - - **node_id**：GH-CVM-MAIN-PROD-01 `result.node_id` - - **registered_devices**：0 `result.registered_devices` - - **service**：guanghu-hololake-enterprise-gate.service `result.service` - - **service_state**：ACTIVE `result.service_state` - - **source_archive_sha256**：91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2 `result.source_archive_sha256` - - **source_commit**：be31c41 `result.source_commit` - - **state**：PASS `result.state` -- **verification** `verification` - - **values** `verification.values` - - DMI UUID为10ace744-13e1-472e-8dba-6bb823a073bf - - 服务器Python cryptography Ed25519测试2项通过 - - systemd服务active - - 127.0.0.1:8033/health返回ok - - 外部HTTPS device-gate/health返回ok - - 未知设备领取挑战返回HTTP404 registered device required - - guanghu-enterprise-identity.service保持active - - guanghu-flagos-collaboration.service保持active - - nginx.service保持active - - 当前设备与会话数量均为0未伪造成员 - ---- - -本页只改变阅读顺序，不改变 TCS/HLDP 语义。 diff --git a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.gir.json b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.gir.json deleted file mode 100644 index f103e5497..000000000 --- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.gir.json +++ /dev/null @@ -1,84 +0,0 @@ -{ - "compiled_from": { - "compiler_id": "TCS-COMPILER-STAGE1-0001", - "compiler_state": "TCS_COMPILER_GIR_EXECUTED", - "source_sha256": "022315dd5c418abf7ce085d3409e2e8a884aade53dbb8604612cca36ceac4287" - }, - "declaration": { - "emergence": { - "value": "采用独立8033服务、独立数据库和独立Nginx snippet，避免修改现有身份服务与FlagOS协作系统；只复用只读企业身份注册表与Forgejo当次认证。" - }, - "event_time": { - "precision": "MINUTE_HOST_LOCAL", - "value": "2026-09-03T21:45:00+08:00" - }, - "evidence": { - "archive_sha256": "91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2", - "expected_receipt": "目标服务健康、未知设备拒绝、签名正负测试、现有身份与FlagOS服务保持健康。", - "transport_manifest": "/Volumes/JZAO/HoloLake/releases/source-transport/hololake-enterprise-responsibility-gate-be31c41.manifest.json" - }, - "header": { - "canonical_uri": "product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.tcs", - "compatibility": [ - "GH-CVM-MAIN-PROD-01", - "PYTHON/3.10", - "ED25519" - ], - "language": "TCS/0.1", - "lifecycle": "CANDIDATE", - "name_en": "HoloLake Enterprise Responsibility Device Gate Deployment Start Event", - "name_zh": "HoloLake企业责任设备门部署开始事件", - "profile": "PUBLIC-PRODUCT-ENGINEERING/1", - "protocols": [ - "HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001", - "HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001" - ], - "schema": "tcs.event/v1", - "version": "1.0.0" - }, - "lock": { - "value": "SOURCE_COMMIT=be31c41; TARGET=/opt/guanghu-hololake-enterprise-gate/releases/be31c41; ROLLBACK=disable独立服务并移除Nginx include后恢复原配置；不修改8032与FlagOS。" - }, - "observation": { - "value": "现有8032企业身份服务保持运行；8033空闲；cryptography Ed25519可用；目标目录不存在；源码提交be31c41且运输归档SHA-256为91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2。" - }, - "rejected": { - "values": [ - "直接改写8032现有服务", - "把私钥上传服务器", - "用机器指纹单独授权", - "把企业会话变成Forgejo永久令牌", - "重启或修改FlagOS服务", - "未验证运输哈希就解包" - ] - }, - "source": { - "source_id": "BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903", - "source_role": "DIRECT_HUMAN", - "source_sha256": "d31c52c99c5e6059f9a7129086996cdd003e95b7ff126e700f4ed1c07ef6d9d5", - "source_uri": "source://codex-task/01a0672d-f125-7452-988e-523a6a34bfd4/msg_01a0675d-98a7-7542-abad-11a8a755dd71" - }, - "subject": { - "channel_id": "ICE-CH-ZC001", - "subject_id": "GH-CVM-MAIN-PROD-01", - "subject_kind": "NODE", - "verification": "DMI UUID 10ace744-13e1-472e-8dba-6bb823a073bf；另一个FlagOS任务已完成且独立服务健康。" - }, - "trigger": { - "value": "本机HoloLake 1.2.0设备密钥与责任绑定请求已实现并验收，需要在企业服务器部署独立设备挑战验证半边。" - }, - "why": { - "value": "设备挑战属于HoloLake责任入口新能力，应与现有账号、关系回执和比赛服务隔离，失败时能独立撤回。" - } - }, - "executable": false, - "identity": { - "declaration_id": "HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903", - "declaration_kind": "EVENT", - "language_version": "0.1" - }, - "native_self_hosted": true, - "natural_language_is_typed_data": true, - "schema": "guanghu.declaration-gir/v1", - "unresolved_natural_language": false -} diff --git a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.human.en-US.md b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.human.en-US.md deleted file mode 100644 index 288a3e3b9..000000000 --- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.human.en-US.md +++ /dev/null @@ -1,118 +0,0 @@ -# HoloLake Enterprise Responsibility Device Gate Deployment Start Event · Human Engineering Language (English) - -> This is an English reading projection of validated native TCS/HLDP source. It is not a new canonical source and grants no execution authority. - -## What this is - -This is a **event** declaration with identifier `HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903` and version `1.0.0`. The projector validates it with the Stage-1 compiler before changing its reading order. - -## Who is here - -- **subject** `subject` - - **channel_id**：ICE-CH-ZC001 `subject.channel_id` - - **subject_id**：GH-CVM-MAIN-PROD-01 `subject.subject_id` - - **subject_kind**：NODE `subject.subject_kind` - - **verification**：DMI UUID 10ace744-13e1-472e-8dba-6bb823a073bf；另一个FlagOS任务已完成且独立服务健康。 `subject.verification` - -## Why this started - -- **trigger** `trigger` - - **value**：本机HoloLake 1.2.0设备密钥与责任绑定请求已实现并验收，需要在企业服务器部署独立设备挑战验证半边。 `trigger.value` -- **why** `why` - - **value**：设备挑战属于HoloLake责任入口新能力，应与现有账号、关系回执和比赛服务隔离，失败时能独立撤回。 `why.value` -- **source** `source` - - **source identifier**：BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903 `source.source_id` - - **source role**：DIRECT_HUMAN `source.source_role` - - **source checksum**：d31c52c99c5e6059f9a7129086996cdd003e95b7ff126e700f4ed1c07ef6d9d5 `source.source_sha256` - - **source address**：source://codex-task/01a0672d-f125-7452-988e-523a6a34bfd4/msg_01a0675d-98a7-7542-abad-11a8a755dd71 `source.source_uri` - -## What changed - -- **emergence** `emergence` - - **value**：采用独立8033服务、独立数据库和独立Nginx snippet，避免修改现有身份服务与FlagOS协作系统；只复用只读企业身份注册表与Forgejo当次认证。 `emergence.value` -- **lock** `lock` - - **value**：SOURCE_COMMIT=be31c41; TARGET=/opt/guanghu-hololake-enterprise-gate/releases/be31c41; ROLLBACK=disable独立服务并移除Nginx include后恢复原配置；不修改8032与FlagOS。 `lock.value` - -## How it will execute - -This is a non-executable declaration and has no action graph. - -## Boundaries and exception handling - -The native source does not provide this field; the projector does not guess. - -## How completion is proven - -The native source does not provide this field; the projector does not guess. - -## Where to continue next time - -The native source does not provide this field; the projector does not guess. - -## Source and verification - -- **Native declaration identifier**: `HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903` -- **Native declaration kind**: `EVENT` -- **TCS source SHA-256**: `022315dd5c418abf7ce085d3409e2e8a884aade53dbb8604612cca36ceac4287` -- **Validation compiler**: `TCS-COMPILER-STAGE1-0001` -- **Projection protocol**: `GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001` - -## Complete native structure cross-reference - -All top-level structures and field paths are retained below so a reader can audit whether the projection omitted information. - -- **emergence** `emergence` - - **value**：采用独立8033服务、独立数据库和独立Nginx snippet，避免修改现有身份服务与FlagOS协作系统；只复用只读企业身份注册表与Forgejo当次认证。 `emergence.value` -- **event_time** `event_time` - - **precision**：MINUTE_HOST_LOCAL `event_time.precision` - - **value**：2026-09-03T21:45:00+08:00 `event_time.value` -- **evidence** `evidence` - - **archive_sha256**：91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2 `evidence.archive_sha256` - - **expected_receipt**：目标服务健康、未知设备拒绝、签名正负测试、现有身份与FlagOS服务保持健康。 `evidence.expected_receipt` - - **transport_manifest**：/Volumes/JZAO/HoloLake/releases/source-transport/hololake-enterprise-responsibility-gate-be31c41.manifest.json `evidence.transport_manifest` -- **header** `header` - - **canonical source path**：product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.tcs `header.canonical_uri` - - **compatibility** `header.compatibility` - - GH-CVM-MAIN-PROD-01 - - PYTHON/3.10 - - ED25519 - - **language**：TCS/0.1 `header.language` - - **lifecycle**：CANDIDATE `header.lifecycle` - - **English name**：HoloLake Enterprise Responsibility Device Gate Deployment Start Event `header.name_en` - - **Chinese name**：HoloLake企业责任设备门部署开始事件 `header.name_zh` - - **profile**：PUBLIC-PRODUCT-ENGINEERING/1 `header.profile` - - **protocols** `header.protocols` - - HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001 - - HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001 - - **schema**：tcs.event/v1 `header.schema` - - **version**：1.0.0 `header.version` -- **lock** `lock` - - **value**：SOURCE_COMMIT=be31c41; TARGET=/opt/guanghu-hololake-enterprise-gate/releases/be31c41; ROLLBACK=disable独立服务并移除Nginx include后恢复原配置；不修改8032与FlagOS。 `lock.value` -- **observation** `observation` - - **value**：现有8032企业身份服务保持运行；8033空闲；cryptography Ed25519可用；目标目录不存在；源码提交be31c41且运输归档SHA-256为91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2。 `observation.value` -- **rejected** `rejected` - - **values** `rejected.values` - - 直接改写8032现有服务 - - 把私钥上传服务器 - - 用机器指纹单独授权 - - 把企业会话变成Forgejo永久令牌 - - 重启或修改FlagOS服务 - - 未验证运输哈希就解包 -- **source** `source` - - **source identifier**：BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903 `source.source_id` - - **source role**：DIRECT_HUMAN `source.source_role` - - **source checksum**：d31c52c99c5e6059f9a7129086996cdd003e95b7ff126e700f4ed1c07ef6d9d5 `source.source_sha256` - - **source address**：source://codex-task/01a0672d-f125-7452-988e-523a6a34bfd4/msg_01a0675d-98a7-7542-abad-11a8a755dd71 `source.source_uri` -- **subject** `subject` - - **channel_id**：ICE-CH-ZC001 `subject.channel_id` - - **subject_id**：GH-CVM-MAIN-PROD-01 `subject.subject_id` - - **subject_kind**：NODE `subject.subject_kind` - - **verification**：DMI UUID 10ace744-13e1-472e-8dba-6bb823a073bf；另一个FlagOS任务已完成且独立服务健康。 `subject.verification` -- **trigger** `trigger` - - **value**：本机HoloLake 1.2.0设备密钥与责任绑定请求已实现并验收，需要在企业服务器部署独立设备挑战验证半边。 `trigger.value` -- **why** `why` - - **value**：设备挑战属于HoloLake责任入口新能力，应与现有账号、关系回执和比赛服务隔离，失败时能独立撤回。 `why.value` - ---- - -This page changes only the reading order; it does not change TCS/HLDP semantics. diff --git a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.human.zh-CN.md b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.human.zh-CN.md deleted file mode 100644 index 1ac4b6a80..000000000 --- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.human.zh-CN.md +++ /dev/null @@ -1,118 +0,0 @@ -# HoloLake企业责任设备门部署开始事件 · 简体中文人类工程语言版 - -> 这是 TCS/HLDP 原生源码的简体中文阅读投影，不是新的正本，也不授予执行权限。若本页与 `.tcs` 源码不一致，以经过校验的 `.tcs` 源码为准。 - -## 这是什么 - -这是一份 **事件** 声明，编号为 `HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903`，版本为 `1.0.0`。转换器已先用 Stage-1 编译器校验原生源码，再把机器枚举翻译成汉语；原始编号保留在括号和字段路径中。 - -## 谁在这里 - -- **执行主体** `subject` - - **channel_id**：ICE-CH-ZC001 `subject.channel_id` - - **subject_id**：GH-CVM-MAIN-PROD-01 `subject.subject_id` - - **subject_kind**：NODE `subject.subject_kind` - - **verification**：DMI UUID 10ace744-13e1-472e-8dba-6bb823a073bf；另一个FlagOS任务已完成且独立服务健康。 `subject.verification` - -## 为什么开始 - -- **触发** `trigger` - - **value**：本机HoloLake 1.2.0设备密钥与责任绑定请求已实现并验收，需要在企业服务器部署独立设备挑战验证半边。 `trigger.value` -- **为什么** `why` - - **value**：设备挑战属于HoloLake责任入口新能力，应与现有账号、关系回执和比赛服务隔离，失败时能独立撤回。 `why.value` -- **来源** `source` - - **来源编号**：BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903 `source.source_id` - - **来源角色**：人类直接语言来源（`DIRECT_HUMAN`） `source.source_role` - - **来源校验值**：d31c52c99c5e6059f9a7129086996cdd003e95b7ff126e700f4ed1c07ef6d9d5 `source.source_sha256` - - **来源地址**：source://codex-task/01a0672d-f125-7452-988e-523a6a34bfd4/msg_01a0675d-98a7-7542-abad-11a8a755dd71 `source.source_uri` - -## 发生了什么变化 - -- **认知或状态变化** `emergence` - - **value**：采用独立8033服务、独立数据库和独立Nginx snippet，避免修改现有身份服务与FlagOS协作系统；只复用只读企业身份注册表与Forgejo当次认证。 `emergence.value` -- **锁定结论** `lock` - - **value**：SOURCE_COMMIT=be31c41; TARGET=/opt/guanghu-hololake-enterprise-gate/releases/be31c41; ROLLBACK=disable独立服务并移除Nginx include后恢复原配置；不修改8032与FlagOS。 `lock.value` - -## 准备怎样执行 - -这是非执行声明，没有动作图。 - -## 边界与异常处理 - -源程序没有提供这一项，转换器不猜。 - -## 怎样算完成 - -源程序没有提供这一项，转换器不猜。 - -## 下一次从哪里继续 - -源程序没有提供这一项，转换器不猜。 - -## 来源与校验 - -- **原生声明编号**：`HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903` -- **原生声明类型**：`EVENT` -- **TCS 源码 SHA-256**：`022315dd5c418abf7ce085d3409e2e8a884aade53dbb8604612cca36ceac4287` -- **校验编译器**：`TCS-COMPILER-STAGE1-0001` -- **投影协议**：`GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001` - -## 原生结构逐项对照 - -下面保留源码的全部顶层结构和字段路径，供人类审计投影有没有漏掉信息。 - -- **认知或状态变化** `emergence` - - **value**：采用独立8033服务、独立数据库和独立Nginx snippet，避免修改现有身份服务与FlagOS协作系统；只复用只读企业身份注册表与Forgejo当次认证。 `emergence.value` -- **event_time** `event_time` - - **precision**：MINUTE_HOST_LOCAL `event_time.precision` - - **value**：2026-09-03T21:45:00+08:00 `event_time.value` -- **evidence** `evidence` - - **archive_sha256**：91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2 `evidence.archive_sha256` - - **expected_receipt**：目标服务健康、未知设备拒绝、签名正负测试、现有身份与FlagOS服务保持健康。 `evidence.expected_receipt` - - **transport_manifest**：/Volumes/JZAO/HoloLake/releases/source-transport/hololake-enterprise-responsibility-gate-be31c41.manifest.json `evidence.transport_manifest` -- **语言头** `header` - - **正本路径**：product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.tcs `header.canonical_uri` - - **compatibility** `header.compatibility` - - GH-CVM-MAIN-PROD-01 - - PYTHON/3.10 - - ED25519 - - **语言**：TCS/0.1 `header.language` - - **生命周期**：候选版本，尚未成为正式正本（`CANDIDATE`） `header.lifecycle` - - **英文名**：HoloLake Enterprise Responsibility Device Gate Deployment Start Event `header.name_en` - - **中文名**：HoloLake企业责任设备门部署开始事件 `header.name_zh` - - **协议配置**：PUBLIC-PRODUCT-ENGINEERING/1 `header.profile` - - **protocols** `header.protocols` - - HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001 - - HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001 - - **schema**：tcs.event/v1 `header.schema` - - **版本**：1.0.0 `header.version` -- **锁定结论** `lock` - - **value**：SOURCE_COMMIT=be31c41; TARGET=/opt/guanghu-hololake-enterprise-gate/releases/be31c41; ROLLBACK=disable独立服务并移除Nginx include后恢复原配置；不修改8032与FlagOS。 `lock.value` -- **observation** `observation` - - **value**：现有8032企业身份服务保持运行；8033空闲；cryptography Ed25519可用；目标目录不存在；源码提交be31c41且运输归档SHA-256为91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2。 `observation.value` -- **已排除路径** `rejected` - - **values** `rejected.values` - - 直接改写8032现有服务 - - 把私钥上传服务器 - - 用机器指纹单独授权 - - 把企业会话变成Forgejo永久令牌 - - 重启或修改FlagOS服务 - - 未验证运输哈希就解包 -- **来源** `source` - - **来源编号**：BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903 `source.source_id` - - **来源角色**：人类直接语言来源（`DIRECT_HUMAN`） `source.source_role` - - **来源校验值**：d31c52c99c5e6059f9a7129086996cdd003e95b7ff126e700f4ed1c07ef6d9d5 `source.source_sha256` - - **来源地址**：source://codex-task/01a0672d-f125-7452-988e-523a6a34bfd4/msg_01a0675d-98a7-7542-abad-11a8a755dd71 `source.source_uri` -- **执行主体** `subject` - - **channel_id**：ICE-CH-ZC001 `subject.channel_id` - - **subject_id**：GH-CVM-MAIN-PROD-01 `subject.subject_id` - - **subject_kind**：NODE `subject.subject_kind` - - **verification**：DMI UUID 10ace744-13e1-472e-8dba-6bb823a073bf；另一个FlagOS任务已完成且独立服务健康。 `subject.verification` -- **触发** `trigger` - - **value**：本机HoloLake 1.2.0设备密钥与责任绑定请求已实现并验收，需要在企业服务器部署独立设备挑战验证半边。 `trigger.value` -- **为什么** `why` - - **value**：设备挑战属于HoloLake责任入口新能力，应与现有账号、关系回执和比赛服务隔离，失败时能独立撤回。 `why.value` - ---- - -本页只改变阅读顺序，不改变 TCS/HLDP 语义。 diff --git a/product-source/hololake-clean-desktop/package-lock.json b/product-source/hololake-clean-desktop/package-lock.json index 13b64d41c..fe2f8d663 100644 --- a/product-source/hololake-clean-desktop/package-lock.json +++ b/product-source/hololake-clean-desktop/package-lock.json @@ -1,12 +1,12 @@ { "name": "hololake-clean-desktop", - "version": "1.2.2", + "version": "1.1.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "hololake-clean-desktop", - "version": "1.2.2", + "version": "1.1.0", "dependencies": { "@tauri-apps/api": "2.10.1", "@tauri-apps/plugin-dialog": "2.7.2", diff --git a/product-source/hololake-clean-desktop/package.json b/product-source/hololake-clean-desktop/package.json index cb564f0e8..d3e4ed535 100644 --- a/product-source/hololake-clean-desktop/package.json +++ b/product-source/hololake-clean-desktop/package.json @@ -1,14 +1,12 @@ { "name": "hololake-clean-desktop", "private": true, - "version": "1.2.2", + "version": "1.1.0", "type": "module", "scripts": { "dev": "vite --host 127.0.0.1", "build": "tsc -b && vite build", - "test": "npm run build && node --test scripts/*.test.mjs", - "release:manifest": "node scripts/build-update-manifest.mjs", - "release:controller-bundle": "node scripts/build-controller-release-bundle.mjs", + "test": "npm run build", "tauri": "tauri" }, "dependencies": { diff --git a/product-source/hololake-clean-desktop/registries/module-registry.json b/product-source/hololake-clean-desktop/registries/module-registry.json index c6d81fd7d..dd3a350c5 100644 --- a/product-source/hololake-clean-desktop/registries/module-registry.json +++ b/product-source/hololake-clean-desktop/registries/module-registry.json @@ -7,8 +7,6 @@ "module_id": "HLP-MOD-CHANNEL-0001", "name_zh": "个人初始化频道", "kind": "SYSTEM_FOUNDATION", - "audience": "SYSTEM", - "summary_zh": "建立属于当前用户的命名频道、稳定编号与私人 Git。", "state": "LOCAL_INSTALLED_VERIFIED_WITH_HUMAN_VISUAL_RENDERING", "source": "src-tauri/src/lib.rs#create_channel", "data_owner": "CURRENT_LOCAL_USER" @@ -17,8 +15,6 @@ "module_id": "HLP-MOD-KB-0001", "name_zh": "光湖知识库", "kind": "PREINSTALLED_USER_MODULE", - "audience": "HUMAN", - "summary_zh": "预装的个人知识模块，支持阅读、写作、导入、导出与可恢复回收。", "state": "LOCAL_INSTALLED_VERIFIED", "source": "src-tauri/src/lib.rs#knowledge", "capabilities": ["CREATE", "READ", "EDIT", "HUMAN_MARKDOWN_RENDERING", "FRONTMATTER", "FOLDER_CLASSIFICATION_TREE", "STABLE_TAG_COLORS", "READING_TIME", "SCROLL_SYNCHRONIZED_OUTLINE", "WIKILINK_NAVIGATION", "IMPORT_FOLDER", "EXPORT", "MOVE_TO_TRASH", "PRIVATE_GIT_COMMIT"] @@ -27,8 +23,6 @@ "module_id": "HLP-MOD-GLP-BRIDGE-0001", "name_zh": "光湖语言翻译桥", "kind": "SYSTEM_FOUNDATION", - "audience": "SYSTEM", - "summary_zh": "在本机以类型化事件连接频道、人格体与外部编程 AI。", "state": "LOCAL_REALTIME_ACTIVE", "source": "src-tauri/src/realtime_bridge.rs", "transport": "GLP_LOCAL_REALTIME/1_LOOPBACK_TCP_NDJSON" @@ -37,8 +31,6 @@ "module_id": "HLP-MOD-AGENT-0001", "name_zh": "本地 Agent 执行核", "kind": "SYSTEM_FOUNDATION", - "audience": "PERSONA", - "summary_zh": "为人格体提供不依赖模型工具调用的确定性执行能力。", "state": "PUBLIC_MINIMUM_TCS_TO_GIR_AND_HUMAN_APPROVED_AGENT_ACTIVE", "source": "src-tauri/src/agent_executor.rs", "registered_operations": ["KNOWLEDGE.CREATE", "KNOWLEDGE.UPDATE", "KNOWLEDGE.DELETE", "KNOWLEDGE.READ", "KNOWLEDGE.LIST"] @@ -47,17 +39,13 @@ "module_id": "HLP-MOD-UPDATE-0001", "name_zh": "HoloLake 签名更新器", "kind": "SYSTEM_FOUNDATION", - "audience": "SYSTEM", - "summary_zh": "只接收通过光湖信任根验证的软件更新。", - "state": "PUBLIC_1_2_2_SIGNED_NOTARIZED_BROADCAST_ACTIVE", + "state": "CLIENT_TRUST_ROOT_BOUND_SERVER_HTTP_204_NO_PUBLIC_RELEASE", "source": "src-tauri/tauri.conf.json#plugins.updater" }, { "module_id": "HLP-MOD-EXT-AI-0001", "name_zh": "外部编程 AI 表达桥", "kind": "OPTIONAL_LOCAL_BRIDGE", - "audience": "PERSONA", - "summary_zh": "让外部编程 AI 以明确来源进入当前频道，不自动获得人格或执行权。", "state": "LOCAL_REALTIME_CONNECTOR_ACTIVE", "source": "connectors/hololake-glp-client.py" }, @@ -65,24 +53,9 @@ "module_id": "HLP-MOD-PERSONA-RUNTIME-0001", "name_zh": "公众人格试用运行时", "kind": "SYSTEM_FOUNDATION", - "audience": "PERSONA", - "summary_zh": "建立可逆试用人格记录；既有人格身份仍需独立验证。", "state": "LOCAL_TRIAL_PERSONA_RUNTIME_ACTIVE_EXISTING_PERSONA_VERIFICATION_NOT_CLAIMED", "source": "src-tauri/src/persona_runtime.rs", "reversible_trial_days": 30 - }, - { - "module_id": "HLP-MOD-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001", - "name_zh": "光湖企业域责任入口", - "kind": "TEAM_ONLY_ENTERPRISE_GATEWAY", - "audience": "HUMAN_TEAM", - "summary_zh": "为已登记域负责人准备设备、人格与责任范围验证。", - "state": "SERVER_DEVICE_GATE_ACTIVE_CLIENT_1_2_2_INSTALLED_FIRST_MEMBER_ENROLLMENT_PENDING", - "source": "src-tauri/src/enterprise_entrance.rs", - "enterprise_server_embedded": false, - "required_proofs": ["DOMAIN_RESPONSIBLE_HUMAN_ID", "BOUND_PERSONA_ID", "LOCAL_DEVICE_KEY", "AUXILIARY_MACHINE_FINGERPRINT", "SERVER_CHALLENGE_SIGNATURE"], - "session_scope": "ONE_DOMAIN_ONE_REPOSITORY_SHORT_LIVED", - "ordinary_public_user_visible": false } ] } diff --git a/product-source/hololake-clean-desktop/scripts/audit-clean-v1.py b/product-source/hololake-clean-desktop/scripts/audit-clean-v1.py index b56c8673b..01917b47b 100644 --- a/product-source/hololake-clean-desktop/scripts/audit-clean-v1.py +++ b/product-source/hololake-clean-desktop/scripts/audit-clean-v1.py @@ -35,16 +35,8 @@ for required_file in ( "src-tauri/src/agent_executor.rs", "src-tauri/src/persona_runtime.rs", "src-tauri/src/realtime_bridge.rs", - "src-tauri/src/enterprise_entrance.rs", "connectors/hololake-glp-client.py", "contracts/public-runtime-v1.json", - "contracts/clean-v1-execution-baseline.json", - "contracts/enterprise-responsibility-entrance-v1.json", - "language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs", - "server/enterprise-responsibility-gate/service.py", - "server/enterprise-responsibility-gate/test_service.py", - "server/enterprise-responsibility-gate/guanghu-hololake-enterprise-gate.service", - "server/enterprise-responsibility-gate/nginx.conf", ): if not (ROOT / required_file).exists(): errors.append(f"public runtime file missing: {required_file}") @@ -53,36 +45,6 @@ if runtime_contract["transport"]["bind"] != "127.0.0.1": errors.append("realtime bridge is not loopback-only") if runtime_contract["mutation_gate"] != "PENDING_HUMAN_APPROVAL_TO_EXPLICIT_UI_APPROVAL_TO_EXECUTION": errors.append("agent human approval gate missing") -if "system_context" not in runtime_contract.get("server_messages", []): - errors.append("persona-visible system context missing from GLP contract") -realtime_source = (ROOT / "src-tauri/src/realtime_bridge.rs").read_text() -for required_context in ("sourceKinds", "pendingAgentProposals", "enterpriseEntrance", "proposalIsNotExecution"): - if required_context not in realtime_source: - errors.append(f"persona-visible system context field missing: {required_context}") -baseline = json.loads((ROOT / "contracts/clean-v1-execution-baseline.json").read_text()) -if baseline.get("anchor_manifest_sha256") != "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2": - errors.append("current direct-language anchor manifest drift") -if baseline.get("public_raw_language_embedded") is not False: - errors.append("raw private direct language embedded in public baseline") -enterprise = json.loads((ROOT / "contracts/enterprise-responsibility-entrance-v1.json").read_text()) -if enterprise.get("enterprise_server_embedded") is not False: - errors.append("enterprise server embedded in HoloLake") -if enterprise.get("device_proof", {}).get("fingerprint_is_sole_credential") is not False: - errors.append("machine fingerprint incorrectly used as sole credential") -if enterprise.get("session", {}).get("scope") != "ONE_DOMAIN_ONE_REPOSITORY": - errors.append("enterprise session is not responsibility scoped") -if enterprise.get("state") != "SERVER_DEVICE_GATE_ACTIVE_CLIENT_1_2_2_INSTALLED_FIRST_MEMBER_ENROLLMENT_PENDING": - errors.append("enterprise local device proof implementation state drift") -enterprise_client = (ROOT / "src-tauri/src/enterprise_entrance.rs").read_text() -for required_client in ("enroll_device", "authenticate", "save_session_token", "ONE_DOMAIN_ONE_REPOSITORY"): - if required_client not in enterprise_client: - errors.append(f"enterprise client flow missing: {required_client}") -time_source = (ROOT / "src/time.ts").read_text() -app_source = (ROOT / "src/App.tsx").read_text() -if "legacyUnixSeconds" not in time_source or "时间待校验" not in time_source: - errors.append("legacy timestamp compatibility missing") -if "new Date(e.occurredAt)" in app_source: - errors.append("unvalidated timeline timestamp rendering remains") tauri = json.loads((ROOT / "src-tauri/tauri.conf.json").read_text()) endpoints = tauri["plugins"]["updater"]["endpoints"] @@ -99,11 +61,6 @@ if clean.get("enterprise_four_domains_embedded") is not False: errors.append("enterprise domains embedded in personal product") if clean.get("fifth_domain_private_content_embedded") is not False: errors.append("Fifth Domain private content embedded in public product") -assessment = architecture.get("current_product_assessment", {}) -if assessment.get("desktop_artifact_version") != "1.2.2": - errors.append("current product assessment version drift") -if assessment.get("canonical_public_source_repository") != "REPO-014": - errors.append("canonical public source repository unresolved") if errors: print(json.dumps({"result": "FAIL_0", "errors": errors}, ensure_ascii=False, indent=2)) diff --git a/product-source/hololake-clean-desktop/scripts/build-controller-release-bundle.mjs b/product-source/hololake-clean-desktop/scripts/build-controller-release-bundle.mjs deleted file mode 100644 index eb9a06b58..000000000 --- a/product-source/hololake-clean-desktop/scripts/build-controller-release-bundle.mjs +++ /dev/null @@ -1,130 +0,0 @@ -#!/usr/bin/env node -import crypto from 'node:crypto' -import fs from 'node:fs' -import path from 'node:path' -import { pathToFileURL } from 'node:url' -import { execFileSync } from 'node:child_process' - -const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex') -const required = (value, name) => { - if (!value) throw new Error(`${name}_REQUIRED`) - return value -} -const write = (file, value) => fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600, flag: 'wx' }) - -export function buildControllerBundle(options) { - const version = required(options.version, 'VERSION') - const sourceCommit = required(options.sourceCommit, 'SOURCE_COMMIT') - if (!/^\d+\.\d+\.\d+$/.test(version)) throw new Error('VERSION_INVALID') - if (!/^[a-f0-9]{40}$/.test(sourceCommit)) throw new Error('SOURCE_COMMIT_INVALID') - const repository = path.resolve(options.repository || path.join(import.meta.dirname, '../../..')) - const head = execFileSync('git', ['-C', repository, 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim() - if (head !== sourceCommit) throw new Error(`SOURCE_COMMIT_NOT_CURRENT_HEAD:${head}`) - execFileSync('git', ['-C', repository, 'cat-file', '-e', `${sourceCommit}^{commit}`]) - const output = path.resolve(required(options.output, 'OUTPUT')) - if (fs.existsSync(output)) throw new Error('OUTPUT_ALREADY_EXISTS') - const artifact = path.resolve(required(options.artifact, 'ARTIFACT')) - const signatureFile = path.resolve(required(options.signatureFile, 'SIGNATURE')) - const bytes = fs.readFileSync(artifact) - const signature = fs.readFileSync(signatureFile, 'utf8').trim() - if (signature.length < 32) throw new Error('SIGNATURE_INVALID') - const base = new URL(required(options.baseUrl, 'BASE_URL')) - if (base.protocol !== 'https:' || base.username || base.password || base.search || base.hash) throw new Error('BASE_URL_INVALID') - const artifactName = path.basename(artifact) - const releaseId = `GH-HOLOLAKE-RELEASE-${version}` - const codesignId = `GH-HOLOLAKE-CODESIGN-${version}` - const notarizationId = `GH-HOLOLAKE-NOTARIZATION-${version}` - const approvalId = `GH-HOLOLAKE-APPROVAL-${version}-ICE-GL-INFINITY` - const latest = { - schema: 'hololake.release-broadcast/v1', - releaseId, - version, - notes: options.notes || 'HoloLake signed notarized release', - pub_date: required(options.publishedAt, 'PUBLISHED_AT'), - hololake: { - restart: { required: true, automaticAllowed: false }, - rollback: { supported: true, healthReceiptRequired: true }, - }, - platforms: { - 'darwin-aarch64': { - signature, - url: new URL(artifactName, base.href.endsWith('/') ? base : new URL(`${base.href}/`)).href, - size: bytes.length, - sha256: sha256(bytes), - platformCodeSignatureReceipt: codesignId, - notarizationReceipt: notarizationId, - }, - }, - } - const latestBytes = Buffer.from(`${JSON.stringify(latest, null, 2)}\n`) - const broadcastSha256 = sha256(latestBytes) - fs.mkdirSync(output, { recursive: false, mode: 0o700 }) - fs.copyFileSync(artifact, path.join(output, artifactName), fs.constants.COPYFILE_EXCL) - fs.chmodSync(path.join(output, artifactName), 0o600) - fs.writeFileSync(path.join(output, 'latest.json'), latestBytes, { mode: 0o600, flag: 'wx' }) - write(path.join(output, `${codesignId}.json`), { - schema: 'hololake.platform-code-signature-receipt/v1', - state: 'DEVELOPER_ID_SIGNATURE_STRICT_AND_GATEKEEPER_ACCEPTED', - sourceCommit, - version, - artifactSha256: sha256(bytes), - signingIdentity: 'Developer ID Application: bei sun (825A9L3G7Q)', - }) - write(path.join(output, `${notarizationId}.json`), { - schema: 'hololake.apple-notarization-receipt/v1', - state: 'APPLE_NOTARIZATION_ACCEPTED_AND_STAPLED', - sourceCommit, - version, - appSubmissionId: required(options.appSubmissionId, 'APP_SUBMISSION_ID'), - dmgSubmissionId: required(options.dmgSubmissionId, 'DMG_SUBMISSION_ID'), - staplerValidation: 'PASS', - gatekeeper: 'NOTARIZED_DEVELOPER_ID_ACCEPTED', - }) - write(path.join(output, 'pipeline-receipt.json'), { - schema: 'hololake.signed-release-pipeline-receipt/v1', - state: 'SIGNED_NOTARIZED_RELEASE_BROADCAST_READY_FOR_JD_CONTROLLER_UPLOAD', - sourceCommit, - version, - broadcastSha256, - automaticUpload: false, - automaticActivation: false, - }) - write(path.join(output, 'human-approval.json'), { - schema: 'hololake.release-broadcast-human-approval/v1', - state: 'HUMAN_APPROVED_EXACT_SIGNED_NOTARIZED_RELEASE', - approvalId, - releaseId, - version, - broadcastSha256, - humanAnchor: 'ICE-GL∞', - sourceMessageId: required(options.approvalMessageId, 'APPROVAL_MESSAGE_ID'), - sourceMessageSha256: required(options.approvalMessageSha256, 'APPROVAL_MESSAGE_SHA256'), - }) - return { output, releaseId, version, sourceCommit, broadcastSha256, approvalId } -} - -function args(values) { - const result = {} - for (let index = 0; index < values.length; index += 2) result[values[index].slice(2)] = values[index + 1] - return result -} - -if (import.meta.url === pathToFileURL(process.argv[1]).href) { - const value = args(process.argv.slice(2)) - const result = buildControllerBundle({ - version: value.version, - sourceCommit: value['source-commit'], - artifact: value.artifact, - signatureFile: value.signature, - baseUrl: value['base-url'], - notes: value.notes, - publishedAt: value['published-at'], - appSubmissionId: value['app-submission-id'], - dmgSubmissionId: value['dmg-submission-id'], - approvalMessageId: value['approval-message-id'], - approvalMessageSha256: value['approval-message-sha256'], - output: value.output, - repository: value.repository, - }) - process.stdout.write(`${JSON.stringify({ outcome: 'CONTROLLER_BUNDLE_WRITTEN', ...result })}\n`) -} diff --git a/product-source/hololake-clean-desktop/scripts/build-controller-release-bundle.test.mjs b/product-source/hololake-clean-desktop/scripts/build-controller-release-bundle.test.mjs deleted file mode 100644 index b62687f5a..000000000 --- a/product-source/hololake-clean-desktop/scripts/build-controller-release-bundle.test.mjs +++ /dev/null @@ -1,15 +0,0 @@ -import assert from 'node:assert/strict' -import test from 'node:test' -import { buildControllerBundle } from './build-controller-release-bundle.mjs' - -test('rejects a formatted but nonexistent or non-current source commit', () => { - assert.throws( - () => buildControllerBundle({ - version: '1.2.2', - sourceCommit: '0000000000000000000000000000000000000000', - repository: '../..', - output: '/tmp/hololake-controller-bundle-must-not-exist', - }), - /SOURCE_COMMIT_NOT_CURRENT_HEAD/, - ) -}) diff --git a/product-source/hololake-clean-desktop/scripts/build-update-manifest.mjs b/product-source/hololake-clean-desktop/scripts/build-update-manifest.mjs deleted file mode 100644 index af1ae023e..000000000 --- a/product-source/hololake-clean-desktop/scripts/build-update-manifest.mjs +++ /dev/null @@ -1,67 +0,0 @@ -#!/usr/bin/env node -import crypto from 'node:crypto' -import fs from 'node:fs' -import path from 'node:path' -import { pathToFileURL } from 'node:url' - -function required(value, name) { - if (!value) throw new Error(`${name}_REQUIRED`) - return value -} - -export function buildManifest({ version, artifact, signatureFile, baseUrl, notes, publishedAt }) { - if (!/^\d+\.\d+\.\d+$/.test(required(version, 'VERSION'))) throw new Error('VERSION_INVALID') - const artifactPath = path.resolve(required(artifact, 'ARTIFACT')) - const signaturePath = path.resolve(required(signatureFile, 'SIGNATURE')) - if (!fs.statSync(artifactPath, { throwIfNoEntry: false })?.isFile()) throw new Error('ARTIFACT_NOT_READABLE') - if (!fs.statSync(signaturePath, { throwIfNoEntry: false })?.isFile()) throw new Error('SIGNATURE_NOT_READABLE') - const signature = fs.readFileSync(signaturePath, 'utf8').trim() - if (signature.length < 32) throw new Error('SIGNATURE_INVALID') - const root = new URL(required(baseUrl, 'BASE_URL')) - if (root.protocol !== 'https:') throw new Error('HTTPS_BASE_URL_REQUIRED') - if (root.username || root.password || root.search || root.hash) throw new Error('BASE_URL_MUST_NOT_CONTAIN_CREDENTIALS_OR_QUERY') - const bytes = fs.readFileSync(artifactPath) - const fileName = path.basename(artifactPath) - const url = new URL(fileName, root.href.endsWith('/') ? root : new URL(`${root.href}/`)).href - return { - version, - notes: notes || 'HoloLake signed update', - pub_date: publishedAt || new Date().toISOString(), - platforms: { - 'darwin-aarch64': { - signature, - url, - sha256: crypto.createHash('sha256').update(bytes).digest('hex'), - bytes: bytes.length, - }, - }, - } -} - -function parseArgs(values) { - const result = {} - for (let index = 0; index < values.length; index += 2) { - if (!values[index]?.startsWith('--') || values[index + 1] === undefined) throw new Error('ARGUMENTS_INVALID') - result[values[index].slice(2)] = values[index + 1] - } - return result -} - -if (import.meta.url === pathToFileURL(process.argv[1]).href) { - const args = parseArgs(process.argv.slice(2)) - const manifest = buildManifest({ - version: args.version, - artifact: args.artifact, - signatureFile: args.signature, - baseUrl: args['base-url'], - notes: args.notes, - publishedAt: args['published-at'], - }) - const output = path.resolve(required(args.output, 'OUTPUT')) - fs.mkdirSync(path.dirname(output), { recursive: true }) - const temporary = `${output}.tmp` - fs.writeFileSync(temporary, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o644 }) - fs.renameSync(temporary, output) - process.stdout.write(`${JSON.stringify({ outcome: 'MANIFEST_WRITTEN', output, version: manifest.version, platform: 'darwin-aarch64' })}\n`) -} - diff --git a/product-source/hololake-clean-desktop/scripts/build-update-manifest.test.mjs b/product-source/hololake-clean-desktop/scripts/build-update-manifest.test.mjs deleted file mode 100644 index f83b9b538..000000000 --- a/product-source/hololake-clean-desktop/scripts/build-update-manifest.test.mjs +++ /dev/null @@ -1,37 +0,0 @@ -import assert from 'node:assert/strict' -import fs from 'node:fs' -import os from 'node:os' -import path from 'node:path' -import test from 'node:test' -import { buildManifest } from './build-update-manifest.mjs' - -function fixture() { - const root = fs.mkdtempSync(path.join(os.tmpdir(), 'hololake-update-manifest-')) - const artifact = path.join(root, 'HoloLake.app.tar.gz') - const signatureFile = `${artifact}.sig` - fs.writeFileSync(artifact, 'signed-update-bytes') - fs.writeFileSync(signatureFile, 'trusted-signature-material-that-is-long-enough') - return { artifact, signatureFile } -} - -test('builds an HTTPS arm64 manifest with immutable evidence', () => { - const files = fixture() - const manifest = buildManifest({ - version: '1.2.0', ...files, - baseUrl: 'https://guanghulab.com/hololake/releases/1.2.0/', - notes: 'Current direct-language baseline', - publishedAt: '2026-09-03T00:00:00Z', - }) - assert.equal(manifest.version, '1.2.0') - assert.equal(manifest.platforms['darwin-aarch64'].bytes, 19) - assert.match(manifest.platforms['darwin-aarch64'].url, /^https:\/\/guanghulab\.com\//) - assert.equal(manifest.platforms['darwin-aarch64'].sha256.length, 64) -}) - -test('rejects HTTP, missing signatures and malformed versions', () => { - const files = fixture() - assert.throws(() => buildManifest({ version: '1.2', ...files, baseUrl: 'https://guanghulab.com/' }), /VERSION_INVALID/) - assert.throws(() => buildManifest({ version: '1.2.0', ...files, baseUrl: 'http://guanghulab.com/' }), /HTTPS_BASE_URL_REQUIRED/) - fs.writeFileSync(files.signatureFile, 'short') - assert.throws(() => buildManifest({ version: '1.2.0', ...files, baseUrl: 'https://guanghulab.com/' }), /SIGNATURE_INVALID/) -}) diff --git a/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/guanghu-hololake-enterprise-gate.service b/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/guanghu-hololake-enterprise-gate.service deleted file mode 100644 index 0631d7420..000000000 --- a/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/guanghu-hololake-enterprise-gate.service +++ /dev/null @@ -1,22 +0,0 @@ -[Unit] -Description=Guanghu HoloLake Enterprise Responsibility Device Gate -After=network-online.target guanghu-enterprise-identity.service - -[Service] -Type=simple -User=lighthouse -Group=lighthouse -EnvironmentFile=/etc/guanghu/hololake-enterprise-gate.env -ExecStart=/usr/bin/python3 /opt/guanghu-hololake-enterprise-gate/current/service.py -Restart=on-failure -RestartSec=2 -NoNewPrivileges=true -PrivateTmp=true -ProtectSystem=strict -ProtectHome=true -ReadOnlyPaths=/etc/guanghu/enterprise-identity-registry.json -ReadWritePaths=/var/lib/guanghu-hololake-enterprise-gate - -[Install] -WantedBy=multi-user.target - diff --git a/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/nginx.conf b/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/nginx.conf deleted file mode 100644 index 1d7e3fbd5..000000000 --- a/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/nginx.conf +++ /dev/null @@ -1,32 +0,0 @@ -location = /api/hololake/enterprise/device-gate/health { - limit_except GET { deny all; } - proxy_pass http://127.0.0.1:8033/health; - proxy_set_header Host $host; - add_header Cache-Control "no-store" always; -} -location = /api/hololake/enterprise/device-gate/enroll { - limit_except POST { deny all; } - proxy_pass http://127.0.0.1:8033/v1/device/enroll; - proxy_set_header Host $host; - proxy_set_header Authorization $http_authorization; - client_max_body_size 16k; -} -location = /api/hololake/enterprise/device-gate/challenges { - limit_except POST { deny all; } - proxy_pass http://127.0.0.1:8033/v1/challenges; - proxy_set_header Host $host; - client_max_body_size 16k; -} -location = /api/hololake/enterprise/device-gate/challenges/verify { - limit_except POST { deny all; } - proxy_pass http://127.0.0.1:8033/v1/challenges/verify; - proxy_set_header Host $host; - client_max_body_size 16k; -} -location = /api/hololake/enterprise/device-gate/session { - limit_except GET { deny all; } - proxy_pass http://127.0.0.1:8033/v1/session; - proxy_set_header Host $host; - proxy_set_header Authorization $http_authorization; - add_header Cache-Control "no-store" always; -} diff --git a/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/service.py b/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/service.py deleted file mode 100644 index 9300f7728..000000000 --- a/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/service.py +++ /dev/null @@ -1,300 +0,0 @@ -#!/usr/bin/env python3 -"""Device-bound HoloLake entrance to one enterprise responsibility repository.""" - -from __future__ import annotations - -import base64 -import hashlib -import hmac -import json -import os -import re -import secrets -import sqlite3 -import time -import urllib.error -import urllib.request -from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer -from pathlib import Path - -from cryptography.exceptions import InvalidSignature -from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey - -BIND = os.environ.get("GH_HOLOLAKE_ENTERPRISE_GATE_BIND", "127.0.0.1") -PORT = int(os.environ.get("GH_HOLOLAKE_ENTERPRISE_GATE_PORT", "8033")) -DB_PATH = os.environ.get("GH_HOLOLAKE_ENTERPRISE_GATE_DB", "/var/lib/guanghu-hololake-enterprise-gate/gate.sqlite3") -REGISTRY_PATH = os.environ.get("GH_ENTERPRISE_IDENTITY_REGISTRY", "/etc/guanghu/enterprise-identity-registry.json") -FORGEJO_USER_API = os.environ.get("GH_ENTERPRISE_FORGEJO_USER_API", "http://127.0.0.1:3341/api/v1/user") -FORGEJO_WEB_BASE = os.environ.get("GH_ENTERPRISE_FORGEJO_WEB_BASE", "https://guanghu.chat/code").rstrip("/") -RECEIPT_KEY = os.environ.get("GH_HOLOLAKE_ENTERPRISE_GATE_RECEIPT_KEY", "") -MAX_BODY = 16_384 -IDENTITY = re.compile(r"^[A-Za-z0-9._∞-]{3,80}$") -HEX64 = re.compile(r"^[0-9a-f]{64}$") -DOMAIN_MAP = { - "DOMAIN-MAIN": "MAIN_DOMAIN", - "DOMAIN-SUB": "BRANCH_DOMAIN", - "DOMAIN-ZERO": "ZERO_DOMAIN", - "DOMAIN-ZS": "ZERO_SENSE_DOMAIN", -} - - -def now() -> int: - return int(time.time()) - - -def canonical(value: object) -> bytes: - return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode() - - -def load_registry() -> dict: - value = json.loads(Path(REGISTRY_PATH).read_text(encoding="utf-8")) - if value.get("schema") != "guanghu.enterprise-identity-registry/v1" or not value.get("humans"): - raise ValueError("enterprise identity registry invalid") - return value - - -def database() -> sqlite3.Connection: - path = Path(DB_PATH) - path.parent.mkdir(parents=True, exist_ok=True) - db = sqlite3.connect(path) - db.row_factory = sqlite3.Row - db.executescript( - """ - PRAGMA journal_mode=WAL; - CREATE TABLE IF NOT EXISTS devices ( - key_id TEXT PRIMARY KEY, - node_id TEXT NOT NULL UNIQUE, - request_id TEXT NOT NULL, - human_number TEXT NOT NULL, - persona_id TEXT NOT NULL, - domain_id TEXT NOT NULL, - repository TEXT NOT NULL, - public_key TEXT NOT NULL, - fingerprint_sha256 TEXT NOT NULL, - enrolled_at INTEGER NOT NULL, - revoked_at INTEGER - ); - CREATE TABLE IF NOT EXISTS challenges ( - challenge_id TEXT PRIMARY KEY, - key_id TEXT NOT NULL, - request_id TEXT NOT NULL, - nonce TEXT NOT NULL, - expires_at INTEGER NOT NULL, - used_at INTEGER - ); - CREATE TABLE IF NOT EXISTS sessions ( - session_hash TEXT PRIMARY KEY, - key_id TEXT NOT NULL, - human_number TEXT NOT NULL, - persona_id TEXT NOT NULL, - domain_id TEXT NOT NULL, - repository TEXT NOT NULL, - issued_at INTEGER NOT NULL, - expires_at INTEGER NOT NULL, - revoked_at INTEGER - ); - CREATE TABLE IF NOT EXISTS audit ( - sequence INTEGER PRIMARY KEY AUTOINCREMENT, - observed_at INTEGER NOT NULL, - kind TEXT NOT NULL, - subject_hash TEXT NOT NULL, - object_id TEXT NOT NULL - ); - """ - ) - return db - - -def find_binding(registry: dict, human_number: str, persona_id: str, domain_id: str) -> dict | None: - expected_domain = DOMAIN_MAP.get(domain_id) - for human in registry["humans"]: - if not hmac.compare_digest( - str(human.get("human_number", "")).encode("utf-8"), - human_number.encode("utf-8"), - ): - continue - if human.get("responsibility_domain") != expected_domain: - return None - persona = next( - ( - item - for item in human.get("personas", []) - if item.get("role") == "PERSONA_SUBJECT" - and hmac.compare_digest( - str(item.get("current_persona_identity", "")).encode("utf-8"), - persona_id.encode("utf-8"), - ) - ), - None, - ) - return human if persona else None - return None - - -def parse_basic(header: str) -> tuple[str, str] | None: - if not header.startswith("Basic "): - return None - try: - username, password = base64.b64decode(header[6:], validate=True).decode().split(":", 1) - except (ValueError, UnicodeDecodeError): - return None - if not re.fullmatch(r"[A-Za-z0-9_-]{1,40}", username) or not password or len(password) > 512: - return None - return username, password - - -def verify_forgejo(username: str, password: str) -> bool: - request = urllib.request.Request(FORGEJO_USER_API) - request.add_header("Authorization", "Basic " + base64.b64encode(f"{username}:{password}".encode()).decode()) - request.add_header("Accept", "application/json") - try: - with urllib.request.urlopen(request, timeout=10) as response: - value = json.load(response) - return response.status == 200 and hmac.compare_digest(str(value.get("login", "")), username) - except (urllib.error.HTTPError, urllib.error.URLError, TimeoutError, ValueError): - return False - - -def receipt(payload: dict) -> dict: - if len(RECEIPT_KEY) < 32: - raise RuntimeError("receipt signing key unavailable") - body = canonical(payload) - return { - **payload, - "receipt_hash": hashlib.sha256(body).hexdigest(), - "receipt_signature": hmac.new(RECEIPT_KEY.encode(), body, hashlib.sha256).hexdigest(), - } - - -def challenge_message(device: sqlite3.Row, challenge: sqlite3.Row) -> bytes: - return ( - "HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001\n" - f"{challenge['request_id']}\n{device['domain_id']}\n{device['human_number']}\n" - f"{device['persona_id']}\n{challenge['challenge_id']}\n" - f"{challenge['nonce']}:{challenge['expires_at'] * 1000}" - ).encode() - - -def verify_challenge_signature(device: sqlite3.Row, challenge: sqlite3.Row, encoded_signature: str) -> bool: - try: - public = base64.b64decode(device["public_key"], validate=True) - signature = base64.b64decode(encoded_signature, validate=True) - if len(public) != 32 or len(signature) != 64: - return False - Ed25519PublicKey.from_public_bytes(public).verify(signature, challenge_message(device, challenge)) - return True - except (ValueError, InvalidSignature): - return False - - -class Handler(BaseHTTPRequestHandler): - server_version = "GuanghuHoloLakeEnterpriseGate/1.0" - - def log_message(self, fmt: str, *args: object) -> None: - print("[hololake-enterprise-gate] " + fmt % args) - - def respond(self, status: int, body: dict) -> None: - encoded = json.dumps(body, ensure_ascii=False).encode() - self.send_response(status) - self.send_header("Content-Type", "application/json; charset=utf-8") - self.send_header("Content-Length", str(len(encoded))) - self.send_header("Cache-Control", "no-store") - self.send_header("X-Content-Type-Options", "nosniff") - self.end_headers() - self.wfile.write(encoded) - - def body(self) -> dict: - length = int(self.headers.get("Content-Length", "0")) - if length < 1 or length > MAX_BODY: - raise ValueError("request body size invalid") - value = json.loads(self.rfile.read(length)) - if not isinstance(value, dict): - raise ValueError("JSON object required") - return value - - def do_GET(self) -> None: - if self.path == "/health": - try: - registry = load_registry() - db = database() - counts = { - "devices": db.execute("SELECT count(*) FROM devices WHERE revoked_at IS NULL").fetchone()[0], - "active_sessions": db.execute("SELECT count(*) FROM sessions WHERE revoked_at IS NULL AND expires_at>?", (now(),)).fetchone()[0], - } - db.close() - return self.respond(200, {"ok": True, "service": "guanghu-hololake-enterprise-gate", "registry_version": registry["version"], **counts}) - except Exception: - return self.respond(503, {"ok": False, "error": "enterprise gate unavailable"}) - if self.path == "/v1/session": - token = self.headers.get("Authorization", "").removeprefix("Bearer ") - if len(token) < 32: - return self.respond(401, {"ok": False, "error": "session required"}) - db = database() - row = db.execute("SELECT * FROM sessions WHERE session_hash=? AND revoked_at IS NULL AND expires_at>?", (hashlib.sha256(token.encode()).hexdigest(), now())).fetchone() - db.close() - if not row: - return self.respond(401, {"ok": False, "error": "session invalid or expired"}) - return self.respond(200, {"ok": True, "session": {"human_number": row["human_number"], "persona_id": row["persona_id"], "domain_id": row["domain_id"], "repository": row["repository"], "expires_at": row["expires_at"], "repository_url": f"{FORGEJO_WEB_BASE}/{row['repository']}"}}) - return self.respond(404, {"ok": False, "error": "not found"}) - - def do_POST(self) -> None: - try: - payload = self.body() - registry = load_registry() - except (ValueError, OSError, json.JSONDecodeError): - return self.respond(400, {"ok": False, "error": "request invalid"}) - if self.path == "/v1/device/enroll": - fields = {name: str(payload.get(name, "")) for name in ("request_id", "human_number", "persona_id", "domain_id", "node_id", "key_id", "public_key", "fingerprint_sha256", "idempotency_key")} - if any(not IDENTITY.fullmatch(fields[name]) for name in ("request_id", "human_number", "persona_id", "domain_id", "node_id", "key_id", "idempotency_key")) or not HEX64.fullmatch(fields["fingerprint_sha256"]): - return self.respond(400, {"ok": False, "error": "device enrollment fields invalid"}) - human = find_binding(registry, fields["human_number"], fields["persona_id"], fields["domain_id"]) - credentials = parse_basic(self.headers.get("Authorization", "")) - if not human or not credentials or credentials[0] != human["username"] or not verify_forgejo(*credentials): - return self.respond(401, {"ok": False, "error": "enterprise responsibility authentication failed"}) - try: - public = base64.b64decode(fields["public_key"], validate=True) - except ValueError: - public = b"" - if len(public) != 32: - return self.respond(400, {"ok": False, "error": "device public key invalid"}) - db = database() - existing = db.execute("SELECT * FROM devices WHERE key_id=? OR node_id=?", (fields["key_id"], fields["node_id"])).fetchone() - if existing: - matches = all(hmac.compare_digest(str(existing[name]), fields[name]) for name in ("request_id", "human_number", "persona_id", "domain_id", "node_id", "key_id", "public_key", "fingerprint_sha256")) and existing["revoked_at"] is None - db.close() - return self.respond(200 if matches else 409, {"ok": matches, "idempotent": matches, "error": None if matches else "device identity conflict"}) - observed = now() - db.execute("INSERT INTO devices VALUES (?,?,?,?,?,?,?,?,?,?,NULL)", (fields["key_id"], fields["node_id"], fields["request_id"], fields["human_number"], fields["persona_id"], fields["domain_id"], human["repository"], fields["public_key"], fields["fingerprint_sha256"], observed)) - db.execute("INSERT INTO audit(observed_at,kind,subject_hash,object_id) VALUES (?,?,?,?)", (observed, "DEVICE_ENROLLED", hashlib.sha256(fields["human_number"].encode()).hexdigest(), fields["key_id"])) - db.commit(); db.close() - return self.respond(201, {"ok": True, "receipt": receipt({"state": "DEVICE_ENROLLED", "key_id": fields["key_id"], "node_id": fields["node_id"], "domain_id": fields["domain_id"], "repository": human["repository"], "observed_at": observed})}) - if self.path == "/v1/challenges": - key_id = str(payload.get("key_id", "")); request_id = str(payload.get("request_id", "")) - db = database(); device = db.execute("SELECT * FROM devices WHERE key_id=? AND request_id=? AND revoked_at IS NULL", (key_id, request_id)).fetchone() - if not device: - db.close(); return self.respond(404, {"ok": False, "error": "registered device required"}) - challenge_id = "HL-ENT-CH-" + secrets.token_hex(12).upper(); nonce = secrets.token_urlsafe(24); expires = now() + 120 - db.execute("INSERT INTO challenges VALUES (?,?,?,?,?,NULL)", (challenge_id, key_id, request_id, nonce, expires)); db.commit(); db.close() - return self.respond(201, {"ok": True, "challenge": {"request_id": request_id, "challenge_id": challenge_id, "nonce": nonce, "expires_unix_ms": expires * 1000}}) - if self.path == "/v1/challenges/verify": - challenge_id = str(payload.get("challenge_id", "")); signature = str(payload.get("signature", "")) - db = database(); challenge = db.execute("SELECT * FROM challenges WHERE challenge_id=?", (challenge_id,)).fetchone() - if not challenge or challenge["used_at"] is not None or challenge["expires_at"] <= now(): - db.close(); return self.respond(401, {"ok": False, "error": "challenge invalid expired or replayed"}) - device = db.execute("SELECT * FROM devices WHERE key_id=? AND revoked_at IS NULL", (challenge["key_id"],)).fetchone() - if not device or not verify_challenge_signature(device, challenge, signature): - db.close(); return self.respond(401, {"ok": False, "error": "device signature invalid"}) - observed = now(); token = secrets.token_urlsafe(48); expires = observed + 600 - db.execute("UPDATE challenges SET used_at=? WHERE challenge_id=?", (observed, challenge_id)) - db.execute("INSERT INTO sessions VALUES (?,?,?,?,?,?,?,?,NULL)", (hashlib.sha256(token.encode()).hexdigest(), device["key_id"], device["human_number"], device["persona_id"], device["domain_id"], device["repository"], observed, expires)) - db.execute("INSERT INTO audit(observed_at,kind,subject_hash,object_id) VALUES (?,?,?,?)", (observed, "SESSION_ISSUED", hashlib.sha256(device["human_number"].encode()).hexdigest(), challenge_id)) - db.commit(); db.close() - return self.respond(200, {"ok": True, "session": {"token": token, "expires_unix_ms": expires * 1000, "domain_id": device["domain_id"], "repository": device["repository"], "repository_url": f"{FORGEJO_WEB_BASE}/{device['repository']}", "scope": "ONE_DOMAIN_ONE_REPOSITORY"}}) - return self.respond(404, {"ok": False, "error": "not found"}) - - -if __name__ == "__main__": - load_registry() - if len(RECEIPT_KEY) < 32: - raise SystemExit("GH_HOLOLAKE_ENTERPRISE_GATE_RECEIPT_KEY must contain at least 32 characters") - ThreadingHTTPServer((BIND, PORT), Handler).serve_forever() diff --git a/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/test_service.py b/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/test_service.py deleted file mode 100644 index 4bb064559..000000000 --- a/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/test_service.py +++ /dev/null @@ -1,31 +0,0 @@ -import base64 -import os -import sqlite3 -import tempfile -import unittest -from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey -from cryptography.hazmat.primitives import serialization - -import service - - -class GateTests(unittest.TestCase): - def test_binding_requires_responsible_domain_and_primary_persona(self): - registry = {"humans": [{"human_number": "TCS-GL-0016∞", "responsibility_domain": "MAIN_DOMAIN", "repository": "awen/guanghu-main-work", "personas": [{"role": "PERSONA_SUBJECT", "current_persona_identity": "PER-AW-ARCH-001"}, {"role": "RELATIONSHIP_CONTINUITY_SUPPORT", "current_persona_identity": "PER-ZQ001"}]}]} - self.assertIsNotNone(service.find_binding(registry, "TCS-GL-0016∞", "PER-AW-ARCH-001", "DOMAIN-MAIN")) - self.assertIsNone(service.find_binding(registry, "TCS-GL-0016∞", "PER-AW-ARCH-001", "DOMAIN-SUB")) - self.assertIsNone(service.find_binding(registry, "TCS-GL-0016∞", "PER-ZQ001", "DOMAIN-MAIN")) - - def test_signature_binds_request_domain_human_persona_challenge_and_expiry(self): - private = Ed25519PrivateKey.generate() - public = private.public_key().public_bytes(serialization.Encoding.Raw, serialization.PublicFormat.Raw) - device = {"public_key": base64.b64encode(public).decode(), "request_id": "REQ-1", "domain_id": "DOMAIN-MAIN", "human_number": "TCS-GL-0016∞", "persona_id": "PER-AW-ARCH-001"} - challenge = {"request_id": "REQ-1", "challenge_id": "CH-1", "nonce": "NONCE-1", "expires_at": 2000000000} - signature = private.sign(service.challenge_message(device, challenge)) - self.assertTrue(service.verify_challenge_signature(device, challenge, base64.b64encode(signature).decode())) - altered = dict(challenge, nonce="NONCE-2") - self.assertFalse(service.verify_challenge_signature(device, altered, base64.b64encode(signature).decode())) - - -if __name__ == "__main__": - unittest.main() diff --git a/product-source/hololake-clean-desktop/src-tauri/Cargo.lock b/product-source/hololake-clean-desktop/src-tauri/Cargo.lock index 3a195275f..463ef3604 100644 --- a/product-source/hololake-clean-desktop/src-tauri/Cargo.lock +++ b/product-source/hololake-clean-desktop/src-tauri/Cargo.lock @@ -91,29 +91,6 @@ version = "1.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53" -[[package]] -name = "aws-lc-rs" -version = "1.18.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e" -dependencies = [ - "aws-lc-sys", - "zeroize", -] - -[[package]] -name = "aws-lc-sys" -version = "0.45.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27" -dependencies = [ - "cc", - "cmake", - "dunce", - "fs_extra", - "pkg-config", -] - [[package]] name = "base64" version = "0.21.7" @@ -305,8 +282,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0ad534f4357a5264cce5019c989cf66a4f0dc4e0d1b1d15f8aacec0ff7360273" dependencies = [ "find-msvc-tools", - "jobserver", - "libc", "shlex", ] @@ -343,23 +318,6 @@ version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" -[[package]] -name = "cfg_aliases" -version = "0.2.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527" - -[[package]] -name = "chacha20" -version = "0.10.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" -dependencies = [ - "cfg-if", - "cpufeatures 0.3.1", - "rand_core 0.10.1", -] - [[package]] name = "chrono" version = "0.4.45" @@ -372,15 +330,6 @@ dependencies = [ "windows-link 0.2.1", ] -[[package]] -name = "cmake" -version = "0.1.58" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678" -dependencies = [ - "cc", -] - [[package]] name = "combine" version = "4.6.8" @@ -456,15 +405,6 @@ dependencies = [ "libc", ] -[[package]] -name = "cpufeatures" -version = "0.3.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566" -dependencies = [ - "libc", -] - [[package]] name = "crc32fast" version = "1.5.1" @@ -964,12 +904,6 @@ dependencies = [ "percent-encoding", ] -[[package]] -name = "fs_extra" -version = "1.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c" - [[package]] name = "futf" version = "0.1.5" @@ -987,7 +921,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4" dependencies = [ "futures-core", - "futures-sink", ] [[package]] @@ -1188,10 +1121,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0" dependencies = [ "cfg-if", - "js-sys", "libc", "wasi 0.11.1+wasi-snapshot-preview1", - "wasm-bindgen", ] [[package]] @@ -1213,11 +1144,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099" dependencies = [ "cfg-if", - "js-sys", "libc", "r-efi 6.0.0", - "rand_core 0.10.1", - "wasm-bindgen", ] [[package]] @@ -1400,14 +1328,9 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70" [[package]] name = "hololake-clean-desktop" -version = "1.2.2" +version = "1.1.0" dependencies = [ - "base64 0.22.1", - "chrono", "regex", - "reqwest", - "ring", - "security-framework", "serde", "serde_json", "sha2", @@ -1879,16 +1802,6 @@ dependencies = [ "syn 2.0.119", ] -[[package]] -name = "jobserver" -version = "0.1.35" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3" -dependencies = [ - "getrandom 0.4.3", - "libc", -] - [[package]] name = "js-sys" version = "0.3.104" @@ -2021,12 +1934,6 @@ version = "0.4.34" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6" -[[package]] -name = "lru-slab" -version = "0.1.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154" - [[package]] name = "mac" version = "0.1.1" @@ -2876,63 +2783,6 @@ dependencies = [ "memchr", ] -[[package]] -name = "quinn" -version = "0.11.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8" -dependencies = [ - "bytes", - "cfg_aliases", - "pin-project-lite", - "quinn-proto", - "quinn-udp", - "rustc-hash", - "rustls", - "socket2", - "thiserror 2.0.20", - "tokio", - "tracing", - "web-time", -] - -[[package]] -name = "quinn-proto" -version = "0.11.17" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83" -dependencies = [ - "aws-lc-rs", - "bytes", - "getrandom 0.4.3", - "lru-slab", - "rand 0.10.2", - "rand_pcg 0.10.2", - "ring", - "rustc-hash", - "rustls", - "rustls-pki-types", - "slab", - "thiserror 2.0.20", - "tinyvec", - "tracing", - "web-time", -] - -[[package]] -name = "quinn-udp" -version = "0.5.15" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694" -dependencies = [ - "cfg_aliases", - "libc", - "once_cell", - "socket2", - "tracing", - "windows-sys 0.61.2", -] - [[package]] name = "quote" version = "1.0.47" @@ -2965,7 +2815,7 @@ dependencies = [ "rand_chacha 0.2.2", "rand_core 0.5.1", "rand_hc", - "rand_pcg 0.2.1", + "rand_pcg", ] [[package]] @@ -2979,17 +2829,6 @@ dependencies = [ "rand_core 0.6.4", ] -[[package]] -name = "rand" -version = "0.10.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" -dependencies = [ - "chacha20", - "getrandom 0.4.3", - "rand_core 0.10.1", -] - [[package]] name = "rand_chacha" version = "0.2.2" @@ -3028,12 +2867,6 @@ dependencies = [ "getrandom 0.2.17", ] -[[package]] -name = "rand_core" -version = "0.10.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69" - [[package]] name = "rand_hc" version = "0.2.0" @@ -3052,15 +2885,6 @@ dependencies = [ "rand_core 0.5.1", ] -[[package]] -name = "rand_pcg" -version = "0.10.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a" -dependencies = [ - "rand_core 0.10.1", -] - [[package]] name = "raw-window-handle" version = "0.6.2" @@ -3144,7 +2968,6 @@ checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3" dependencies = [ "base64 0.22.1", "bytes", - "futures-channel", "futures-core", "futures-util", "http", @@ -3157,7 +2980,6 @@ dependencies = [ "log", "percent-encoding", "pin-project-lite", - "quinn", "rustls", "rustls-pki-types", "rustls-platform-verifier", @@ -3249,7 +3071,6 @@ version = "0.23.43" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" dependencies = [ - "aws-lc-rs", "once_cell", "ring", "rustls-pki-types", @@ -3276,7 +3097,6 @@ version = "1.15.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96" dependencies = [ - "web-time", "zeroize", ] @@ -3313,7 +3133,6 @@ version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ - "aws-lc-rs", "ring", "rustls-pki-types", "untrusted", @@ -3646,7 +3465,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283" dependencies = [ "cfg-if", - "cpufeatures 0.2.17", + "cpufeatures", "digest", ] @@ -4935,16 +4754,6 @@ dependencies = [ "wasm-bindgen", ] -[[package]] -name = "web-time" -version = "1.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb" -dependencies = [ - "js-sys", - "wasm-bindgen", -] - [[package]] name = "web_atoms" version = "0.2.6" diff --git a/product-source/hololake-clean-desktop/src-tauri/Cargo.toml b/product-source/hololake-clean-desktop/src-tauri/Cargo.toml index a0b84ed7a..7f73716df 100644 --- a/product-source/hololake-clean-desktop/src-tauri/Cargo.toml +++ b/product-source/hololake-clean-desktop/src-tauri/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "hololake-clean-desktop" -version = "1.2.2" +version = "1.1.0" description = "HoloLake clean personal language operating system shell" authors = ["HoloLake"] license = "AGPL-3.0-or-later" @@ -26,13 +26,6 @@ serde_json = "1" sha2 = "0.10" uuid = { version = "1", features = ["v4"] } regex = "1" -chrono = { version = "0.4", default-features = false, features = ["clock"] } -base64 = "0.22" -ring = "0.17" -reqwest = { version = "0.13", default-features = false, features = ["blocking", "json", "rustls"] } - -[target.'cfg(target_os = "macos")'.dependencies] -security-framework = "3" [dev-dependencies] tempfile = "3" diff --git a/product-source/hololake-clean-desktop/src-tauri/src/enterprise_entrance.rs b/product-source/hololake-clean-desktop/src-tauri/src/enterprise_entrance.rs deleted file mode 100644 index daa4252b1..000000000 --- a/product-source/hololake-clean-desktop/src-tauri/src/enterprise_entrance.rs +++ /dev/null @@ -1,527 +0,0 @@ -use base64::{engine::general_purpose::STANDARD as BASE64, Engine}; -use regex::Regex; -use ring::{ - rand::SystemRandom, - signature::{Ed25519KeyPair, KeyPair}, -}; -use serde::{Deserialize, Serialize}; -use sha2::{Digest, Sha256}; -use std::process::Command; -use tauri::AppHandle; - -use crate::storage; - -const KEYCHAIN_SERVICE: &str = "world.guanghu.hololake.enterprise-device"; -const KEYCHAIN_ACCOUNT: &str = "responsibility-entrance-ed25519-v1"; -const SESSION_KEYCHAIN_SERVICE: &str = "world.guanghu.hololake.enterprise-session"; -const GATE_BASE: &str = "https://guanghu.chat/api/hololake/enterprise/device-gate"; -const ALLOWED_DOMAINS: [&str; 4] = ["DOMAIN-MAIN", "DOMAIN-SUB", "DOMAIN-ZERO", "DOMAIN-ZS"]; - -#[derive(Clone, Debug, Serialize, Deserialize)] -#[serde(rename_all = "camelCase")] -pub struct EnterpriseDeviceProof { - pub schema: String, - pub state: String, - pub node_id: String, - pub key_id: String, - pub public_key: String, - pub auxiliary_machine_fingerprint_sha256: String, - pub fingerprint_is_sole_credential: bool, - pub private_key_storage: String, - pub created_at: String, -} - -#[derive(Clone, Debug, Serialize, Deserialize)] -#[serde(rename_all = "camelCase")] -pub struct EnterpriseBindingRequest { - pub schema: String, - pub request_id: String, - pub state: String, - pub domain_id: String, - pub responsible_human_id: String, - pub persona_id: String, - pub node_id: String, - pub key_id: String, - pub requested_repository_scope: String, - pub created_at: String, - pub server_authorized: bool, -} - -#[derive(Clone, Debug, Serialize)] -#[serde(rename_all = "camelCase")] -pub struct EnterpriseEntranceSnapshot { - pub schema: String, - pub state: String, - pub device: Option, - pub binding: Option, - pub session: Option, - pub enterprise_server_embedded: bool, - pub server_authorized: bool, - pub next_action: String, -} - -#[derive(Clone, Debug, Serialize, Deserialize)] -#[serde(rename_all = "camelCase")] -pub struct EnterpriseSession { - pub schema: String, - pub state: String, - pub domain_id: String, - pub repository: String, - pub repository_url: String, - pub expires_unix_ms: u128, - pub token_storage: String, -} - -#[derive(Clone, Debug, Serialize)] -#[serde(rename_all = "camelCase")] -pub struct EnterpriseChallengeProof { - pub schema: String, - pub state: String, - pub request_id: String, - pub challenge_id: String, - pub node_id: String, - pub key_id: String, - pub public_key: String, - pub signature: String, - pub expires_unix_ms: u128, - pub server_authorized: bool, -} - -fn device_path(app: &AppHandle) -> Result { - Ok(storage::root(app)?.join("enterprise-entrance/device.json")) -} - -fn binding_path(app: &AppHandle) -> Result { - Ok(storage::root(app)?.join("enterprise-entrance/binding-request.json")) -} - -fn used_challenges_path(app: &AppHandle) -> Result { - Ok(storage::root(app)?.join("enterprise-entrance/used-challenges.json")) -} - -fn enrollment_path(app: &AppHandle) -> Result { - Ok(storage::root(app)?.join("enterprise-entrance/enrollment-receipt.json")) -} - -fn session_path(app: &AppHandle) -> Result { - Ok(storage::root(app)?.join("enterprise-entrance/session.json")) -} - -#[cfg(target_os = "macos")] -fn load_key_bytes() -> Result>, String> { - match security_framework::passwords::get_generic_password(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT) { - Ok(value) => Ok(Some(value)), - Err(error) if error.code() == -25300 => Ok(None), - Err(error) => Err(format!("ENTERPRISE_DEVICE_KEYCHAIN_READ_FAILED: {error}")), - } -} - -#[cfg(target_os = "macos")] -fn save_key_bytes(value: &[u8]) -> Result<(), String> { - security_framework::passwords::set_generic_password(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, value) - .map_err(|error| format!("ENTERPRISE_DEVICE_KEYCHAIN_WRITE_FAILED: {error}")) -} - -#[cfg(target_os = "macos")] -fn save_session_token(account: &str, value: &[u8]) -> Result<(), String> { - security_framework::passwords::set_generic_password(SESSION_KEYCHAIN_SERVICE, account, value) - .map_err(|error| format!("ENTERPRISE_SESSION_KEYCHAIN_WRITE_FAILED: {error}")) -} - -#[cfg(not(target_os = "macos"))] -fn load_key_bytes() -> Result>, String> { - Err("ENTERPRISE_DEVICE_KEYCHAIN_UNAVAILABLE_ON_PLATFORM".into()) -} - -#[cfg(not(target_os = "macos"))] -fn save_key_bytes(_value: &[u8]) -> Result<(), String> { - Err("ENTERPRISE_DEVICE_KEYCHAIN_UNAVAILABLE_ON_PLATFORM".into()) -} - -#[cfg(not(target_os = "macos"))] -fn save_session_token(_account: &str, _value: &[u8]) -> Result<(), String> { - Err("ENTERPRISE_SESSION_KEYCHAIN_UNAVAILABLE_ON_PLATFORM".into()) -} - -fn post_json( - path: &str, - payload: serde_json::Value, - basic: Option<(&str, &str)>, -) -> Result { - let client = reqwest::blocking::Client::builder() - .timeout(std::time::Duration::from_secs(15)) - .build() - .map_err(|_| "ENTERPRISE_GATE_CLIENT_INIT_FAILED".to_string())?; - let mut request = client.post(format!("{GATE_BASE}{path}")).json(&payload); - if let Some((username, password)) = basic { - request = request.basic_auth(username, Some(password)); - } - let response = request - .send() - .map_err(|_| "ENTERPRISE_GATE_UNREACHABLE".to_string())?; - let status = response.status(); - let value: serde_json::Value = response - .json() - .map_err(|_| "ENTERPRISE_GATE_RESPONSE_INVALID".to_string())?; - if !status.is_success() { - return Err(value - .get("error") - .and_then(serde_json::Value::as_str) - .unwrap_or("ENTERPRISE_GATE_REJECTED") - .to_string()); - } - Ok(value) -} - -fn load_or_create_key() -> Result { - let bytes = if let Some(value) = load_key_bytes()? { - value - } else { - let generated = Ed25519KeyPair::generate_pkcs8(&SystemRandom::new()) - .map_err(|_| "ENTERPRISE_DEVICE_KEY_GENERATION_FAILED".to_string())?; - save_key_bytes(generated.as_ref())?; - generated.as_ref().to_vec() - }; - Ed25519KeyPair::from_pkcs8(&bytes).map_err(|_| "ENTERPRISE_DEVICE_KEY_INVALID".to_string()) -} - -fn auxiliary_machine_fingerprint() -> String { - let mut material = format!("{}|{}", std::env::consts::OS, std::env::consts::ARCH); - for (program, args) in [ - ("ioreg", vec!["-rd1", "-c", "IOPlatformExpertDevice"]), - ("sysctl", vec!["-n", "kern.osversion"]), - ] { - if let Ok(output) = Command::new(program).args(args).output() { - if output.status.success() { - material.push('|'); - material.push_str(&String::from_utf8_lossy(&output.stdout)); - } - } - } - format!("{:x}", Sha256::digest(material.as_bytes())) -} - -fn validate_identity(value: &str, field: &str) -> Result { - let value = value.trim(); - let valid = Regex::new(r"^[A-Za-z0-9._∞-]{3,80}$").map_err(|e| e.to_string())?; - if !valid.is_match(value) { - return Err(format!("ENTERPRISE_{field}_INVALID")); - } - Ok(value.into()) -} - -fn canonical_challenge( - binding: &EnterpriseBindingRequest, - challenge_id: &str, - nonce: &str, - expires_unix_ms: u128, -) -> String { - format!( - "HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001\n{}\n{}\n{}\n{}\n{}\n{}", - binding.request_id, - binding.domain_id, - binding.responsible_human_id, - binding.persona_id, - challenge_id, - format_args!("{nonce}:{expires_unix_ms}") - ) -} - -pub fn prepare_device(app: &AppHandle) -> Result { - let key = load_or_create_key()?; - let public = key.public_key().as_ref(); - let public_sha = format!("{:x}", Sha256::digest(public)); - let device = EnterpriseDeviceProof { - schema: "hololake.enterprise-device-proof/v1".into(), - state: "LOCAL_DEVICE_KEY_READY_SERVER_NOT_AUTHORIZED".into(), - node_id: format!("HL-NODE-{}", &public_sha[..16].to_uppercase()), - key_id: format!("HL-KEY-{}", &public_sha[..20].to_uppercase()), - public_key: BASE64.encode(public), - auxiliary_machine_fingerprint_sha256: auxiliary_machine_fingerprint(), - fingerprint_is_sole_credential: false, - private_key_storage: "MACOS_KEYCHAIN".into(), - created_at: storage::now(), - }; - storage::write_json(&device_path(app)?, &device)?; - Ok(device) -} - -pub fn prepare_binding( - app: &AppHandle, - domain_id: &str, - responsible_human_id: &str, - persona_id: &str, -) -> Result { - if !ALLOWED_DOMAINS.contains(&domain_id) { - return Err("ENTERPRISE_DOMAIN_ID_INVALID".into()); - } - let human = validate_identity(responsible_human_id, "RESPONSIBLE_HUMAN_ID")?; - let persona = validate_identity(persona_id, "PERSONA_ID")?; - let device: EnterpriseDeviceProof = storage::read_json(&device_path(app)?) - .map_err(|_| "ENTERPRISE_DEVICE_PROOF_REQUIRED".to_string())?; - let request = EnterpriseBindingRequest { - schema: "hololake.enterprise-binding-request/v1".into(), - request_id: storage::id("HL-ENT-REQ"), - state: "LOCAL_PROOF_READY_SERVER_CHALLENGE_REQUIRED".into(), - domain_id: domain_id.into(), - responsible_human_id: human, - persona_id: persona, - node_id: device.node_id, - key_id: device.key_id, - requested_repository_scope: format!("{domain_id}:ONE_RESPONSIBILITY_REPOSITORY"), - created_at: storage::now(), - server_authorized: false, - }; - storage::write_json(&binding_path(app)?, &request)?; - Ok(request) -} - -pub fn snapshot(app: &AppHandle) -> Result { - let device = device_path(app)?; - let binding = binding_path(app)?; - let device = if device.exists() { - Some(storage::read_json(&device)?) - } else { - None - }; - let binding = if binding.exists() { - Some(storage::read_json(&binding)?) - } else { - None - }; - let stored_session = session_path(app)?; - let session: Option = if stored_session.exists() { - let value: EnterpriseSession = storage::read_json(&stored_session)?; - (value.expires_unix_ms > storage::now_unix_ms()).then_some(value) - } else { - None - }; - let enrolled = enrollment_path(app)?.exists(); - let state = if session.is_some() { - "ENTERPRISE_SESSION_VERIFIED" - } else if enrolled { - "DEVICE_ENROLLED_SERVER_CHALLENGE_REQUIRED" - } else if binding.is_some() { - "LOCAL_PROOF_READY_SERVER_CHALLENGE_REQUIRED" - } else if device.is_some() { - "LOCAL_DEVICE_KEY_READY_BINDING_REQUIRED" - } else { - "LOCAL_DEVICE_REGISTRATION_REQUIRED" - }; - Ok(EnterpriseEntranceSnapshot { - schema: "hololake.enterprise-responsibility-entrance-snapshot/v1".into(), - state: state.into(), - device, - binding, - session, - enterprise_server_embedded: false, - server_authorized: state == "ENTERPRISE_SESSION_VERIFIED", - next_action: match state { - "ENTERPRISE_SESSION_VERIFIED" => "企业责任会话已验证；只可进入返回的单一责任仓库。", - "DEVICE_ENROLLED_SERVER_CHALLENGE_REQUIRED" => { - "设备已登记；可以领取一次性挑战并验证当前会话。" - } - _ => "先完成设备和责任绑定；本机证明不等于登录成功。", - } - .into(), - }) -} - -pub fn enroll_device( - app: &AppHandle, - username: &str, - password: &str, -) -> Result { - let username = username.trim(); - if !Regex::new(r"^[A-Za-z0-9_-]{1,40}$") - .map_err(|e| e.to_string())? - .is_match(username) - || password.is_empty() - || password.len() > 512 - { - return Err("ENTERPRISE_ACCOUNT_CREDENTIALS_INVALID".into()); - } - let device: EnterpriseDeviceProof = storage::read_json(&device_path(app)?) - .map_err(|_| "ENTERPRISE_DEVICE_PROOF_REQUIRED".to_string())?; - let binding: EnterpriseBindingRequest = storage::read_json(&binding_path(app)?) - .map_err(|_| "ENTERPRISE_BINDING_REQUIRED".to_string())?; - let response = post_json( - "/enroll", - serde_json::json!({ - "request_id": binding.request_id, - "human_number": binding.responsible_human_id, - "persona_id": binding.persona_id, - "domain_id": binding.domain_id, - "node_id": device.node_id, - "key_id": device.key_id, - "public_key": device.public_key, - "fingerprint_sha256": device.auxiliary_machine_fingerprint_sha256, - "idempotency_key": format!("{}-{}", binding.request_id, device.key_id), - }), - Some((username, password)), - )?; - storage::write_json(&enrollment_path(app)?, &response)?; - Ok(serde_json::json!({ - "ok": true, - "state": "DEVICE_ENROLLED", - "keyId": device.key_id, - "serverAuthorized": false - })) -} - -pub fn authenticate(app: &AppHandle) -> Result { - if !enrollment_path(app)?.exists() { - return Err("ENTERPRISE_DEVICE_ENROLLMENT_REQUIRED".into()); - } - let device: EnterpriseDeviceProof = storage::read_json(&device_path(app)?)?; - let binding: EnterpriseBindingRequest = storage::read_json(&binding_path(app)?)?; - let response = post_json( - "/challenges", - serde_json::json!({"key_id":device.key_id,"request_id":binding.request_id}), - None, - )?; - let challenge = response - .get("challenge") - .ok_or_else(|| "ENTERPRISE_CHALLENGE_MISSING".to_string())?; - let challenge_id = challenge - .get("challenge_id") - .and_then(serde_json::Value::as_str) - .ok_or_else(|| "ENTERPRISE_CHALLENGE_ID_MISSING".to_string())?; - let nonce = challenge - .get("nonce") - .and_then(serde_json::Value::as_str) - .ok_or_else(|| "ENTERPRISE_CHALLENGE_NONCE_MISSING".to_string())?; - let expires = challenge - .get("expires_unix_ms") - .and_then(serde_json::Value::as_u64) - .ok_or_else(|| "ENTERPRISE_CHALLENGE_EXPIRY_MISSING".to_string())? - as u128; - let proof = sign_challenge(app, &binding.request_id, challenge_id, nonce, expires)?; - let verified = post_json( - "/challenges/verify", - serde_json::json!({"challenge_id":proof.challenge_id,"signature":proof.signature}), - None, - )?; - let value = verified - .get("session") - .ok_or_else(|| "ENTERPRISE_SESSION_MISSING".to_string())?; - let token = value - .get("token") - .and_then(serde_json::Value::as_str) - .ok_or_else(|| "ENTERPRISE_SESSION_TOKEN_MISSING".to_string())?; - let scope = value - .get("scope") - .and_then(serde_json::Value::as_str) - .unwrap_or(""); - let session = EnterpriseSession { - schema: "hololake.enterprise-session/v1".into(), - state: "ENTERPRISE_SESSION_VERIFIED".into(), - domain_id: value - .get("domain_id") - .and_then(serde_json::Value::as_str) - .unwrap_or("") - .into(), - repository: value - .get("repository") - .and_then(serde_json::Value::as_str) - .unwrap_or("") - .into(), - repository_url: value - .get("repository_url") - .and_then(serde_json::Value::as_str) - .unwrap_or("") - .into(), - expires_unix_ms: value - .get("expires_unix_ms") - .and_then(serde_json::Value::as_u64) - .unwrap_or(0) as u128, - token_storage: "MACOS_KEYCHAIN".into(), - }; - if scope != "ONE_DOMAIN_ONE_REPOSITORY" - || session.domain_id != binding.domain_id - || session.repository.is_empty() - || session.expires_unix_ms <= storage::now_unix_ms() - { - return Err("ENTERPRISE_SESSION_SCOPE_INVALID".into()); - } - save_session_token(&device.key_id, token.as_bytes())?; - storage::write_json(&session_path(app)?, &session)?; - Ok(session) -} - -pub fn sign_challenge( - app: &AppHandle, - request_id: &str, - challenge_id: &str, - nonce: &str, - expires_unix_ms: u128, -) -> Result { - let binding: EnterpriseBindingRequest = storage::read_json(&binding_path(app)?)?; - if binding.request_id != request_id { - return Err("ENTERPRISE_BINDING_REQUEST_MISMATCH".into()); - } - let challenge_id = validate_identity(challenge_id, "CHALLENGE_ID")?; - let nonce = validate_identity(nonce, "CHALLENGE_NONCE")?; - let now = storage::now_unix_ms(); - if expires_unix_ms <= now || expires_unix_ms > now + 5 * 60 * 1000 { - return Err("ENTERPRISE_CHALLENGE_EXPIRY_INVALID".into()); - } - let used_path = used_challenges_path(app)?; - let mut used: Vec = if used_path.exists() { - storage::read_json(&used_path)? - } else { - vec![] - }; - if used.contains(&challenge_id) { - return Err("ENTERPRISE_CHALLENGE_REPLAYED".into()); - } - let key = load_or_create_key()?; - let signature = - key.sign(canonical_challenge(&binding, &challenge_id, &nonce, expires_unix_ms).as_bytes()); - used.push(challenge_id.clone()); - storage::write_json(&used_path, &used)?; - Ok(EnterpriseChallengeProof { - schema: "hololake.enterprise-challenge-proof/v1".into(), - state: "SIGNED_SERVER_VERIFICATION_REQUIRED".into(), - request_id: binding.request_id, - challenge_id, - node_id: binding.node_id, - key_id: binding.key_id, - public_key: BASE64.encode(key.public_key().as_ref()), - signature: BASE64.encode(signature.as_ref()), - expires_unix_ms, - server_authorized: false, - }) -} - -#[cfg(test)] -mod tests { - use super::*; - - #[test] - fn rejects_unknown_domain_and_invalid_identity() { - assert!(!ALLOWED_DOMAINS.contains(&"DOMAIN-FIFTH")); - assert!(validate_identity("../human", "RESPONSIBLE_HUMAN_ID").is_err()); - assert!(validate_identity("ICE-GL∞", "RESPONSIBLE_HUMAN_ID").is_ok()); - } - - #[test] - fn canonical_challenge_binds_domain_human_persona_and_expiry() { - let binding = EnterpriseBindingRequest { - schema: "test".into(), - request_id: "REQ-001".into(), - state: "test".into(), - domain_id: "DOMAIN-MAIN".into(), - responsible_human_id: "HUMAN-001".into(), - persona_id: "PERSONA-001".into(), - node_id: "NODE-001".into(), - key_id: "KEY-001".into(), - requested_repository_scope: "DOMAIN-MAIN:ONE_RESPONSIBILITY_REPOSITORY".into(), - created_at: "2026-09-03T00:00:00.000Z".into(), - server_authorized: false, - }; - let value = canonical_challenge(&binding, "CHALLENGE-001", "NONCE-001", 123456); - assert!(value.contains("DOMAIN-MAIN\nHUMAN-001\nPERSONA-001")); - assert!(value.ends_with("NONCE-001:123456")); - } -} diff --git a/product-source/hololake-clean-desktop/src-tauri/src/lib.rs b/product-source/hololake-clean-desktop/src-tauri/src/lib.rs index f0f4620f3..417b75edb 100644 --- a/product-source/hololake-clean-desktop/src-tauri/src/lib.rs +++ b/product-source/hololake-clean-desktop/src-tauri/src/lib.rs @@ -1,5 +1,4 @@ mod agent_executor; -mod enterprise_entrance; mod model; mod persona_runtime; mod realtime_bridge; @@ -14,14 +13,6 @@ use tauri_plugin_dialog::DialogExt; const UPDATE_ENDPOINT: &str = "https://guanghulab.com/hololake/releases/latest.json"; const PUBLIC_STATE: &str = "SIGNED_UPDATE_FEED_READY_NO_RELEASE"; -pub(crate) fn bundled_modules() -> Result, String> { - let registry: serde_json::Value = - serde_json::from_str(include_str!("../../registries/module-registry.json")) - .map_err(|error| format!("MODULE_REGISTRY_INVALID: {error}"))?; - serde_json::from_value(registry["modules"].clone()) - .map_err(|error| format!("MODULE_REGISTRY_INVALID: {error}")) -} - fn receipt( app: &AppHandle, state: &str, @@ -50,7 +41,6 @@ fn system_snapshot(app: AppHandle) -> Result { public_update_endpoint: UPDATE_ENDPOINT.into(), public_distribution_state: PUBLIC_STATE.into(), external_ai_bridges: storage::bridges(&app)?, - modules: bundled_modules()?, }) } @@ -466,57 +456,6 @@ fn reject_agent_proposal( Ok(proposal) } -#[tauri::command] -fn enterprise_entrance_snapshot( - app: AppHandle, -) -> Result { - enterprise_entrance::snapshot(&app) -} - -#[tauri::command] -fn prepare_enterprise_device( - app: AppHandle, -) -> Result { - enterprise_entrance::prepare_device(&app) -} - -#[tauri::command] -fn prepare_enterprise_binding( - app: AppHandle, - domain_id: String, - responsible_human_id: String, - persona_id: String, -) -> Result { - enterprise_entrance::prepare_binding(&app, &domain_id, &responsible_human_id, &persona_id) -} - -#[tauri::command] -fn sign_enterprise_challenge( - app: AppHandle, - request_id: String, - challenge_id: String, - nonce: String, - expires_unix_ms: u128, -) -> Result { - enterprise_entrance::sign_challenge(&app, &request_id, &challenge_id, &nonce, expires_unix_ms) -} - -#[tauri::command] -fn enroll_enterprise_device( - app: AppHandle, - username: String, - password: String, -) -> Result { - enterprise_entrance::enroll_device(&app, &username, &password) -} - -#[tauri::command] -fn authenticate_enterprise_entrance( - app: AppHandle, -) -> Result { - enterprise_entrance::authenticate(&app) -} - #[cfg_attr(mobile, tauri::mobile_entry_point)] pub fn run() { tauri::Builder::default() @@ -593,13 +532,7 @@ pub fn run() { delete_trial_persona, compile_tcs_agent_proposal, approve_agent_proposal, - reject_agent_proposal, - enterprise_entrance_snapshot, - prepare_enterprise_device, - prepare_enterprise_binding, - sign_enterprise_challenge, - enroll_enterprise_device, - authenticate_enterprise_entrance + reject_agent_proposal ]) .run(tauri::generate_context!()) .expect("HoloLake runtime failed") diff --git a/product-source/hololake-clean-desktop/src-tauri/src/model.rs b/product-source/hololake-clean-desktop/src-tauri/src/model.rs index 55dd6aec6..5eb45cf30 100644 --- a/product-source/hololake-clean-desktop/src-tauri/src/model.rs +++ b/product-source/hololake-clean-desktop/src-tauri/src/model.rs @@ -74,21 +74,6 @@ pub struct SystemSnapshot { pub public_update_endpoint: String, pub public_distribution_state: String, pub external_ai_bridges: Vec, - pub modules: Vec, -} - -#[derive(Clone, Debug, Serialize, Deserialize)] -#[serde(rename_all = "camelCase")] -pub struct ModuleRecord { - #[serde(alias = "module_id")] - pub module_id: String, - #[serde(alias = "name_zh")] - pub name_zh: String, - pub kind: String, - pub audience: String, - #[serde(alias = "summary_zh")] - pub summary_zh: String, - pub state: String, } #[derive(Clone, Debug, Serialize)] diff --git a/product-source/hololake-clean-desktop/src-tauri/src/realtime_bridge.rs b/product-source/hololake-clean-desktop/src-tauri/src/realtime_bridge.rs index f9b313fa1..ecb037ed7 100644 --- a/product-source/hololake-clean-desktop/src-tauri/src/realtime_bridge.rs +++ b/product-source/hololake-clean-desktop/src-tauri/src/realtime_bridge.rs @@ -1,4 +1,4 @@ -use crate::{agent_executor, enterprise_entrance, model::SourceKind, persona_runtime, storage}; +use crate::{agent_executor, model::SourceKind, persona_runtime, storage}; use serde::{Deserialize, Serialize}; use serde_json::{json, Value}; #[cfg(unix)] @@ -223,47 +223,6 @@ fn send(writer: &mut TcpStream, value: Value) -> Result<(), String> { writer.flush().map_err(|e| e.to_string()) } -fn system_context(app: &AppHandle) -> Result { - let channel = storage::channel(app)?; - let persona = persona_runtime::snapshot(app)?; - let enterprise = enterprise_entrance::snapshot(app)?; - let proposals = agent_executor::list(app)?; - let modules = crate::bundled_modules()?; - Ok(json!({ - "type": "system_context", - "schema": "hololake.persona-visible-system-context/v1", - "recordedAt": storage::now(), - "channel": channel.map(|value| json!({"channelId":value.channel_id,"name":value.name})), - "persona": { - "state": persona.state, - "activePersonaId": persona.active_persona_id, - "verifiedExistingPersonaCount": persona.verified_existing_persona_count - }, - "modules": modules.into_iter().map(|module| json!({ - "moduleId":module.module_id, - "nameZh":module.name_zh, - "audience":module.audience, - "state":module.state - })).collect::>(), - "enterpriseEntrance": { - "state": enterprise.state, - "serverAuthorized": enterprise.server_authorized, - "enterpriseServerEmbedded": enterprise.enterprise_server_embedded - }, - "pendingAgentProposals": proposals.into_iter() - .filter(|proposal| proposal.state == "PENDING_HUMAN_APPROVAL") - .map(|proposal| json!({"proposalId":proposal.proposal_id,"programId":proposal.gir.program_id,"state":proposal.state})) - .collect::>(), - "sourceKinds": ["USER_MESSAGE","PERSONA_RESPONSE","EXTERNAL_AI_MESSAGE","SYSTEM_CONTEXT","PROTOCOL_EVENT","AGENT_ACTION","TOOL_RESULT","SYSTEM_RECEIPT"], - "boundaries": { - "transportGrantsPersona": false, - "transportGrantsExecution": false, - "systemReceiptIsNotPersonaSpeech": true, - "proposalIsNotExecution": true - } - })) -} - fn handle_connection( app: AppHandle, state: RealtimeBridgeState, @@ -321,7 +280,6 @@ fn handle_connection( &mut writer, json!({"type":"welcome","protocol":PROTOCOL,"bridgeId":hello.bridge_id,"personaId":hello.persona_id,"personaState":if hello.persona_id.is_some(){"LOCAL_TRIAL_UNVERIFIED_HOST_CONNECTED"}else{"EXTERNAL_AI_CONNECTED_NO_PERSONA"},"executionAuthority":false}), )?; - send(&mut writer, system_context(&app)?)?; let (tx, rx) = mpsc::channel::(); state .clients diff --git a/product-source/hololake-clean-desktop/src-tauri/src/storage.rs b/product-source/hololake-clean-desktop/src-tauri/src/storage.rs index fc06a5e0b..f8ac93a51 100644 --- a/product-source/hololake-clean-desktop/src-tauri/src/storage.rs +++ b/product-source/hololake-clean-desktop/src-tauri/src/storage.rs @@ -1,7 +1,6 @@ use crate::model::{ Channel, ExternalAiBridge, KnowledgeDocument, KnowledgeSummary, SourceKind, TimelineEvent, }; -use chrono::{DateTime, SecondsFormat, Utc}; use sha2::{Digest, Sha256}; use std::{ fs, @@ -12,7 +11,10 @@ use std::{ use tauri::{AppHandle, Manager}; pub fn now() -> String { - Utc::now().to_rfc3339_opts(SecondsFormat::Millis, true) + SystemTime::now() + .duration_since(UNIX_EPOCH) + .map(|d| format!("{}.{:03}Z", d.as_secs(), d.subsec_millis())) + .unwrap_or_else(|_| "0Z".into()) } pub fn now_unix_ms() -> u128 { SystemTime::now() @@ -212,8 +214,9 @@ fn collect(root: &Path, p: &Path, out: &mut Vec) -> Result<(), .map_err(|e| e.to_string())? .modified() .ok() - .map(|t| DateTime::::from(t).to_rfc3339_opts(SecondsFormat::Millis, true)) - .unwrap_or_else(|| "1970-01-01T00:00:00.000Z".into()); + .and_then(|t| t.duration_since(UNIX_EPOCH).ok()) + .map(|d| d.as_secs().to_string()) + .unwrap_or_else(|| "0".into()); out.push(KnowledgeSummary { path: rel, title, @@ -253,15 +256,3 @@ pub fn bridges(app: &AppHandle) -> Result, String> { pub fn save_bridges(app: &AppHandle, v: &[ExternalAiBridge]) -> Result<(), String> { write_json(&root(app)?.join("external-ai-bridges.json"), &v) } - -#[cfg(test)] -mod tests { - use super::*; - - #[test] - fn runtime_timestamps_are_rfc3339_utc() { - let value = now(); - assert!(value.ends_with('Z')); - assert!(DateTime::parse_from_rfc3339(&value).is_ok()); - } -} diff --git a/product-source/hololake-clean-desktop/src-tauri/tauri.conf.json b/product-source/hololake-clean-desktop/src-tauri/tauri.conf.json index 7fd1a3888..b9db1f7e5 100644 --- a/product-source/hololake-clean-desktop/src-tauri/tauri.conf.json +++ b/product-source/hololake-clean-desktop/src-tauri/tauri.conf.json @@ -1,7 +1,7 @@ { "$schema": "https://schema.tauri.app/config/2", "productName": "HoloLake", - "version": "1.2.2", + "version": "1.1.0", "identifier": "world.guanghu.hololake", "build": { "frontendDist": "../dist", "devUrl": "http://127.0.0.1:5211", "beforeDevCommand": "npm run dev", "beforeBuildCommand": "npm run build" }, "app": { diff --git a/product-source/hololake-clean-desktop/src/App.tsx b/product-source/hololake-clean-desktop/src/App.tsx index 024293b41..6937897e0 100644 --- a/product-source/hololake-clean-desktop/src/App.tsx +++ b/product-source/hololake-clean-desktop/src/App.tsx @@ -10,7 +10,6 @@ import type { SourceKind, RuntimeOverview, SystemSnapshot, - EnterpriseEntranceSnapshot, } from "./types"; import { MarkdownDocument, @@ -18,7 +17,6 @@ import { jumpToHeading, splitFrontmatter, } from "./modules/knowledge-render"; -import { formatHoloLakeTime } from "./time"; type View = | "channel" @@ -131,9 +129,9 @@ export default function App() { /> )}{" "} {view === "knowledge" && }{" "} - {view === "market" && }{" "} + {view === "market" && }{" "} {view === "history" && }{" "} - {view === "portal" && }{" "} + {view === "portal" && }{" "} {view === "settings" && ( {e.title}

{e.content}

)) @@ -847,30 +849,7 @@ function Knowledge({ ); } -function Market({ modules }: { modules: SystemSnapshot["modules"] }) { - const personaModules = modules.filter((module) => module.audience === "PERSONA"); - const humanModules = modules.filter( - (module) => module.audience === "HUMAN" || module.audience === "HUMAN_TEAM", - ); - const stateLabel = (state: string) => { - if (state.includes("ENTERPRISE") || state.includes("SERVER_CHALLENGE")) - return "本机证明能力已实现 · 等待安装与企业服务器验证"; - if (state.includes("EXISTING_PERSONA_VERIFICATION_NOT_CLAIMED")) - return "试用运行时已安装 · 既有人格尚未验证"; - if (state.includes("REALTIME_CONNECTOR_ACTIVE")) return "本机实时连接已验证"; - if (state.includes("TCS_TO_GIR")) return "TCS/GIR 本地执行闭环已验证"; - if (state.includes("LOCAL_INSTALLED_VERIFIED")) return "已预装并通过本机验证"; - return "已登记 · 等待独立验收"; - }; - const group = (items: typeof modules) => - items.map((module) => ( -
- {module.moduleId} -

{module.nameZh}

-

{module.summaryZh}

- {stateLabel(module.state)} -
- )); +function Market() { return (
@@ -879,16 +858,16 @@ function Market({ modules }: { modules: SystemSnapshot["modules"] }) {

能力按使用主体分开登记

-
+

人格体使用

-

人格体调用的执行零件与表达桥。连接、安装和执行权限分别验证。

-
{group(personaModules)}
+

动态脑、技能和执行零件将在签名审核后出现。

+ 当前没有已发布模块

人类使用

-

直接服务于人的知识、行业与责任入口。团队模块不会向普通用户开放。

-
{group(humanModules)}
+

行业工作模块将在完成独立验收后出现。

+ 光湖知识库为预装模块
@@ -906,7 +885,7 @@ function History({ data }: { data: SystemSnapshot }) {
{data.timeline.map((e) => (
- +
{labels[e.sourceKind]} · {e.title} @@ -919,64 +898,7 @@ function History({ data }: { data: SystemSnapshot }) {
); } -function Portal({ setError }: { setError: (value: string) => void }) { - const [entrance, setEntrance] = useState(null); - const [domainId, setDomainId] = useState("DOMAIN-MAIN"); - const [humanId, setHumanId] = useState(""); - const [personaId, setPersonaId] = useState(""); - const [username, setUsername] = useState(""); - const [password, setPassword] = useState(""); - const [busy, setBusy] = useState(false); - const refresh = () => api.enterpriseEntranceSnapshot().then(setEntrance).catch((error) => setError(String(error))); - useEffect(() => { - void refresh(); - }, []); - const prepareDevice = async () => { - setBusy(true); - try { - await api.prepareEnterpriseDevice(); - await refresh(); - } catch (error) { - setError(String(error)); - } finally { - setBusy(false); - } - }; - const prepareBinding = async () => { - setBusy(true); - try { - await api.prepareEnterpriseBinding(domainId, humanId, personaId); - await refresh(); - } catch (error) { - setError(String(error)); - } finally { - setBusy(false); - } - }; - const enrollDevice = async () => { - setBusy(true); - try { - await api.enrollEnterpriseDevice(username, password); - setPassword(""); - await refresh(); - } catch (error) { - setPassword(""); - setError(String(error)); - } finally { - setBusy(false); - } - }; - const authenticate = async () => { - setBusy(true); - try { - await api.authenticateEnterpriseEntrance(); - await refresh(); - } catch (error) { - setError(String(error)); - } finally { - setBusy(false); - } - }; +function Portal() { return (
@@ -987,78 +909,24 @@ function Portal({ setError }: { setError: (value: string) => void }) {
-

公共内容与企业责任分开进入

+

公共内容不嵌入私人频道

官方通知、四域规则和团队发布由企业门户承载。HoloLake - 只读取经过签名审核的公共发行事实；企业服务器和四域系统本体不会进入你的私人频道。 + 只读取经过签名审核的公共发行事实。

-
-
-
- HLP-MOD-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001 -

光湖企业域责任入口

-

仅为已登记的域负责人准备本机证明。准备完成不等于企业服务器已经授权。

-
- - {entrance?.serverAuthorized ? "企业会话已验证" : "企业服务器未授权"} - -
-
-
- 本机设备证明 -

{entrance?.device ? `${entrance.device.nodeId} · ${entrance.device.keyId}` : "尚未在系统钥匙串生成设备密钥"}

- 机器指纹仅作辅助证据，不能单独登录。 - {!entrance?.device && } -
-
- 责任绑定 - {entrance?.binding ? ( - <> -

{entrance.binding.domainId} · {entrance.binding.responsibleHumanId} · {entrance.binding.personaId}

- {entrance.binding.state} - {!entrance.session && entrance.state === "LOCAL_PROOF_READY_SERVER_CHALLENGE_REQUIRED" && ( -
- setUsername(event.target.value)} placeholder="企业代码仓库用户名" autoComplete="username" /> - setPassword(event.target.value)} placeholder="仅用于本次设备登记" autoComplete="current-password" /> - -
- )} - {!entrance.session && entrance.state === "DEVICE_ENROLLED_SERVER_CHALLENGE_REQUIRED" && ( - - )} - {entrance.session && ( - - 进入我的责任仓库 ↗ - - )} - - ) : ( -
- - setHumanId(event.target.value)} placeholder="域负责人编号" /> - setPersonaId(event.target.value)} placeholder="绑定人格体编号" /> - -
- )} -
-
-
{entrance?.nextAction ?? "正在读取本机责任入口状态…"}
-
); } diff --git a/product-source/hololake-clean-desktop/src/runtime.ts b/product-source/hololake-clean-desktop/src/runtime.ts index 0e74ccb0e..ac79ff37c 100644 --- a/product-source/hololake-clean-desktop/src/runtime.ts +++ b/product-source/hololake-clean-desktop/src/runtime.ts @@ -1,5 +1,4 @@ import { invoke } from "@tauri-apps/api/core"; -import moduleRegistry from "../registries/module-registry.json"; import type { AgentProposal, AgentReceipt, @@ -12,10 +11,6 @@ import type { RuntimeOverview, SystemSnapshot, TimelineEvent, - EnterpriseBindingRequest, - EnterpriseDeviceProof, - EnterpriseEntranceSnapshot, - ModuleRecord, } from "./types"; const tauri = () => "__TAURI_INTERNALS__" in window; @@ -75,14 +70,6 @@ export async function snapshot(): Promise { "https://guanghulab.com/hololake/releases/latest.json", publicDistributionState: "SIGNED_UPDATE_FEED_READY_NO_RELEASE", externalAiBridges: s.bridges, - modules: moduleRegistry.modules.map((module) => ({ - moduleId: module.module_id, - nameZh: module.name_zh, - kind: module.kind, - audience: module.audience as ModuleRecord["audience"], - summaryZh: module.summary_zh, - state: module.state, - })), }; } @@ -304,44 +291,3 @@ export async function rejectProposal( ): Promise { return invoke("reject_agent_proposal", { proposalId }); } - -export async function enterpriseEntranceSnapshot(): Promise { - if (tauri()) return invoke("enterprise_entrance_snapshot"); - return { - schema: "preview", - state: "LOCAL_DEVICE_REGISTRATION_REQUIRED", - device: null, - binding: null, - session: null, - enterpriseServerEmbedded: false, - serverAuthorized: false, - nextAction: "浏览器预览不生成设备凭证。", - }; -} - -export async function prepareEnterpriseDevice(): Promise { - if (!tauri()) throw new Error("设备密钥只能在已安装的 HoloLake 中生成"); - return invoke("prepare_enterprise_device"); -} - -export async function prepareEnterpriseBinding( - domainId: string, - responsibleHumanId: string, - personaId: string, -): Promise { - if (!tauri()) throw new Error("企业责任绑定只能在已安装的 HoloLake 中准备"); - return invoke("prepare_enterprise_binding", { domainId, responsibleHumanId, personaId }); -} - -export async function enrollEnterpriseDevice( - username: string, - password: string, -): Promise<{ ok: boolean; state: string; keyId: string; serverAuthorized: boolean }> { - if (!tauri()) throw new Error("企业设备登记只能在已安装的 HoloLake 中完成"); - return invoke("enroll_enterprise_device", { username, password }); -} - -export async function authenticateEnterpriseEntrance(): Promise { - if (!tauri()) throw new Error("企业责任会话只能在已安装的 HoloLake 中验证"); - return invoke("authenticate_enterprise_entrance"); -} diff --git a/product-source/hololake-clean-desktop/src/styles.css b/product-source/hololake-clean-desktop/src/styles.css index c666c6b28..464f802f0 100644 --- a/product-source/hololake-clean-desktop/src/styles.css +++ b/product-source/hololake-clean-desktop/src/styles.css @@ -933,40 +933,6 @@ main { margin-top: 30px; font-size: 12px; } -.market-groups > div { - align-self: start; -} -.market-module-list { - display: grid; - gap: 10px; - margin-top: 18px; -} -.market-module { - padding: 16px; - border-radius: 13px; - background: rgba(255, 255, 255, 0.035); -} -.market-module span { - margin: 0; - color: #7896ae; - font-size: 9px; - font-weight: 650; - letter-spacing: 0.05em; -} -.market-module h3 { - margin: 7px 0 5px; - font-size: 15px; -} -.market-module p { - margin: 0; -} -.market-module small { - display: block; - margin-top: 12px; - color: #71889d; - font-size: 10px; - overflow-wrap: anywhere; -} .timeline-list { display: grid; gap: 0; @@ -1014,86 +980,6 @@ main { width: 72px; height: 72px; } -.enterprise-entrance { - margin-top: 18px; - padding: 24px; - border: 1px solid rgba(116, 174, 213, 0.2); - border-radius: 18px; - background: - radial-gradient(circle at 78% 0%, rgba(94, 163, 207, 0.1), transparent 34%), - rgba(6, 20, 36, 0.82); -} -.enterprise-entrance > header { - display: flex; - align-items: flex-start; - justify-content: space-between; - gap: 24px; - padding: 0; -} -.enterprise-entrance h2 { - margin: 7px 0 5px; - font-size: 20px; -} -.enterprise-entrance p, -.enterprise-entrance small, -.enterprise-entrance footer { - color: var(--muted); - line-height: 1.6; -} -.enterprise-entrance .eyebrow { - color: #8ebde0; - font-size: 10px; - font-weight: 650; - letter-spacing: 0.08em; -} -.status.pending { - color: #e4ba67; -} -.enterprise-proof-grid { - display: grid; - grid-template-columns: 1fr 1fr; - gap: 12px; - margin-top: 20px; -} -.enterprise-proof-grid article { - display: grid; - align-content: start; - gap: 9px; - min-height: 176px; - padding: 18px; - border-radius: 14px; - background: rgba(255, 255, 255, 0.035); -} -.enterprise-proof-grid article > strong { - font-size: 15px; -} -.enterprise-proof-grid article p, -.enterprise-proof-grid article small { - margin: 0; - overflow-wrap: anywhere; -} -.enterprise-proof-grid button { - justify-self: start; - margin-top: auto; -} -.enterprise-binding-form { - display: grid; - gap: 8px; -} -.enterprise-binding-form input, -.enterprise-binding-form select { - width: 100%; - min-height: 39px; - border: 1px solid var(--line); - border-radius: 10px; - padding: 0 12px; - color: var(--text); - background: rgba(2, 12, 23, 0.72); -} -.enterprise-entrance footer { - margin-top: 16px; - font-size: 12px; -} .origin-light { border-radius: 50%; background: radial-gradient( diff --git a/product-source/hololake-clean-desktop/src/time.ts b/product-source/hololake-clean-desktop/src/time.ts deleted file mode 100644 index fb101a16a..000000000 --- a/product-source/hololake-clean-desktop/src/time.ts +++ /dev/null @@ -1,18 +0,0 @@ -const legacyUnixSeconds = /^(\d{10})(?:\.(\d{1,3}))?Z$/; - -export function parseHoloLakeTime(value: string): Date | null { - const legacy = legacyUnixSeconds.exec(value); - const date = legacy - ? new Date(Number(legacy[1]) * 1000 + Number((legacy[2] ?? "0").padEnd(3, "0"))) - : new Date(value); - return Number.isNaN(date.getTime()) ? null : date; -} - -export function formatHoloLakeTime(value: string, withDate = false): string { - const date = parseHoloLakeTime(value); - if (!date) return "时间待校验"; - return withDate - ? date.toLocaleString("zh-CN") - : date.toLocaleTimeString("zh-CN", { hour: "2-digit", minute: "2-digit", second: "2-digit" }); -} - diff --git a/product-source/hololake-clean-desktop/src/types.ts b/product-source/hololake-clean-desktop/src/types.ts index 94a472739..39b1ffd5d 100644 --- a/product-source/hololake-clean-desktop/src/types.ts +++ b/product-source/hololake-clean-desktop/src/types.ts @@ -45,15 +45,6 @@ export interface SystemSnapshot { publicUpdateEndpoint: string; publicDistributionState: string; externalAiBridges: ExternalAiBridge[]; - modules: ModuleRecord[]; -} -export interface ModuleRecord { - moduleId: string; - nameZh: string; - kind: string; - audience: "SYSTEM" | "HUMAN" | "PERSONA" | "HUMAN_TEAM"; - summaryZh: string; - state: string; } export interface ExternalAiBridge { bridgeId: string; @@ -135,46 +126,3 @@ export interface RealtimeInvitation { connectorCommand: string; warning: string; } -export interface EnterpriseDeviceProof { - schema: string; - state: string; - nodeId: string; - keyId: string; - publicKey: string; - auxiliaryMachineFingerprintSha256: string; - fingerprintIsSoleCredential: boolean; - privateKeyStorage: string; - createdAt: string; -} -export interface EnterpriseBindingRequest { - schema: string; - requestId: string; - state: string; - domainId: string; - responsibleHumanId: string; - personaId: string; - nodeId: string; - keyId: string; - requestedRepositoryScope: string; - createdAt: string; - serverAuthorized: boolean; -} -export interface EnterpriseEntranceSnapshot { - schema: string; - state: string; - device: EnterpriseDeviceProof | null; - binding: EnterpriseBindingRequest | null; - session: EnterpriseSession | null; - enterpriseServerEmbedded: boolean; - serverAuthorized: boolean; - nextAction: string; -} -export interface EnterpriseSession { - schema: string; - state: string; - domainId: string; - repository: string; - repositoryUrl: string; - expiresUnixMs: number; - tokenStorage: string; -} diff --git a/routing/hololake-current-architecture.json b/routing/hololake-current-architecture.json index 1c908ba7c..4ac5b6c99 100644 --- a/routing/hololake-current-architecture.json +++ b/routing/hololake-current-architecture.json @@ -5,40 +5,23 @@ "state": "CURRENT_CANONICAL", "clean_v1_rebuild": { "record_id": "HLP-CLEAN-V1-REBUILD-20260903-001", - "state": "LOCAL_CLEAN_V1_1_2_0_INSTALLED_DIRECT_LANGUAGE_LOCAL_ACCEPTANCE_PASS_PUBLIC_RELEASE_PENDING", + "state": "LOCAL_CLEAN_V1_INSTALLED_ACCEPTED_PUBLIC_RELEASE_PENDING", "source": "product-source/hololake-clean-desktop", "canonical_tcs": "product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-FOUNDATION.tcs", - "current_direct_language_execution_tcs": "product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs", - "current_direct_language_anchor_manifest_sha256": "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2", "old_product_role": "READ_ONLY_DONOR_NO_WHOLE_MERGE", "first_preinstalled_module": "HLP-MOD-KB-0001", "knowledge_module_state": "LOCAL_COMPLETE_HUMAN_VISUAL_RENDERING_WITH_CLASSIFICATION_COLORS_READING_TIME_SCROLL_OUTLINE_CREATE_READ_EDIT_IMPORT_EXPORT_TRASH_PRIVATE_GIT", "knowledge_human_rendering_source": "product-source/hololake-clean-desktop/src/modules/knowledge-render/index.tsx", - "public_runtime_version": "1.2.2", + "public_runtime_version": "1.1.0", "public_tcs_gir_agent": "LOCAL_ACTIVE_REGISTERED_KNOWLEDGE_CAPABILITIES_HUMAN_APPROVAL_REQUIRED", "public_persona_runtime": "LOCAL_TRIAL_ACTIVE_EXISTING_PERSONA_VERIFICATION_NOT_CLAIMED", "external_ai_realtime": "GLP_LOCAL_REALTIME_1_LOOPBACK_ACTIVE", "typed_language_sources": ["USER_MESSAGE", "PERSONA_RESPONSE", "EXTERNAL_AI_MESSAGE", "SYSTEM_CONTEXT", "PROTOCOL_EVENT", "AGENT_ACTION", "TOOL_RESULT", "SYSTEM_RECEIPT"], "public_update_endpoint": "https://guanghulab.com/hololake/releases/latest.json", - "public_update_release_state": "PUBLIC_1_2_2_SIGNED_NOTARIZED_BROADCAST_ACTIVE", - "public_update_manifest_builder": "product-source/hololake-clean-desktop/scripts/build-update-manifest.mjs", - "public_update_candidate_version": "1.2.0", + "public_update_release_state": "SERVER_HTTP_204_NO_PUBLIC_RELEASE", "enterprise_repository_registry_state": "BLUE_ISOLATED_FIVE_CENTRAL_REPOSITORIES_AND_FIVE_HUMAN_WORK_REPOSITORIES_TEAM_PERMISSIONS_NOT_ASSIGNED_NO_PUBLIC_CUTOVER", "bingshuo_enterprise_language_master_work_repository": "REPO-016:bingshuo/guanghu-language-master-work", "team_enterprise_login": "https://guanghu.chat/code/user/login", - "enterprise_responsibility_entrance": "HLP-MOD-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001", - "enterprise_responsibility_entrance_state": "SERVER_DEVICE_GATE_ACTIVE_CLIENT_1_2_2_INSTALLED_FIRST_MEMBER_ENROLLMENT_PENDING", - "enterprise_responsibility_gate_endpoint": "https://guanghu.chat/api/hololake/enterprise/device-gate", - "enterprise_responsibility_gate_source_commit": "be31c41", - "enterprise_server_embedded": false, - "enterprise_login_required_proofs": [ - "DOMAIN_RESPONSIBLE_HUMAN_ID", - "BOUND_PERSONA_ID", - "LOCAL_DEVICE_KEY", - "AUXILIARY_MACHINE_FINGERPRINT", - "SERVER_CHALLENGE_SIGNATURE" - ], - "enterprise_login_session_scope": "ONE_DOMAIN_ONE_REPOSITORY_SHORT_LIVED", "bingshuo_fifth_domain_bridge": "FD-BRIDGE-ENTERPRISE-LANGUAGE-MASTER-0001", "private_git": "LOCAL_USER_OWNED", "public_git": "SIGNED_ENTERPRISE_DISTRIBUTION_PENDING_EXACT_REGISTRY", @@ -197,13 +180,13 @@ "current_development_stage": "REALITY_ENGINEERING_EXECUTION", "rights_and_stage_gate": "routing/tcs-work-ownership-stage-gate.json", "runtime_implemented": true, - "runtime_state": "LOCAL_AND_PUBLIC_1_2_2_INSTALLED_SIGNED_NOTARIZED_TCS_GIR_AGENT_TYPED_CONTEXT_MODULE_MARKET_ENTERPRISE_DEVICE_GATE_AND_EXTERNAL_AI_REALTIME_VERIFIED", - "local_application_version": "1.2.2", + "runtime_state": "LOCAL_CLEAN_V1_1_0_INSTALLED_TCS_GIR_AGENT_TRIAL_PERSONA_AND_EXTERNAL_AI_REALTIME_VERIFIED", + "local_application_version": "1.1.0", "local_implementation_commit": "92cce2797381f84762a989ce57b991da76412119", - "official_development_lane": "CURRENT_TASK_SCOPED_ZC001_EXECUTION", - "external_development_anchor_id": "TCS-EVENT-HOLOLAKE-CLEAN-V1-ZC001-REALITY-DEVELOPMENT-TAKEOVER-20260903", - "public_release": "PUBLISHED_SIGNED_NOTARIZED_1_2_2", - "server_deployment": "JD_RELEASE_ORIGIN_BS_GZ_FRONT_DOOR_AND_ENTERPRISE_DEVICE_GATE_ACTIVE", + "official_development_lane": "NOT_REGISTERED", + "external_development_anchor_id": "ZC001-DEV-20260829-001", + "public_release": "NOT_PUBLISHED_NOT_NOTARIZED", + "server_deployment": "NOT_DEPLOYED_NO_STAGE1_CONSUMER_REGISTERED", "enterprise_server_consumer_audit": { "node_id": "GH-CVM-MAIN-PROD-01", "node_identity_verified": true, @@ -762,16 +745,15 @@ }, "current_product_assessment": { "record_id": "HLP-PUBLIC-OS-STAGE1-20260830-001", - "desktop_artifact_version": "1.2.2", - "desktop_artifact_state": "LOCAL_INSTALLED_AND_PUBLIC_SIGNED_NOTARIZED_RELEASE_ACTIVE", - "local_source_commit": "7593f9d3f06b2f22206ad6a05665c35443f7426b", - "canonical_public_source_repository": "REPO-014", - "canonical_public_source_path": "product-source/hololake-clean-desktop", - "source_artifact_alignment": "SOURCE_7593F9D_LOCAL_INSTALLED_1_2_2_AND_PUBLIC_RELEASE_1_2_2_ALIGNED", + "desktop_artifact_version": "0.6.1", + "desktop_artifact_state": "LOCAL_STAGE1_COMPLETE_INSTALLED", + "local_source_commit": "b374bb74ceae0a2e6ed13aa3f41b01dd274cad75", + "canonical_public_source_repository": "NOT_REGISTERED", + "source_artifact_alignment": "LOCAL_SOURCE_AND_INSTALLED_ARTIFACT_ALIGNED_PUBLIC_SOURCE_UNPUBLISHED", "previous_repo014_product_source_assessment": "HLP-DESKTOP-GAP-20260809-001_RETAINED_AS_HISTORY_NOT_CURRENT_ARTIFACT", "final_plan_complete": false, "model_receipt_donor_audit": "COMPLETE_DEFERRED_FROM_STAGE1", - "next_gate": "PASS_DIRECT_LANGUAGE_EXECUTION_BASELINE_THEN_BIND_SIGNED_PUBLIC_RELEASE_AND_ENTERPRISE_RESPONSIBILITY_ENTRANCE" + "next_gate": "REGISTER_CANONICAL_PUBLIC_SOURCE_THEN_PROVISION_OPT_IN_RELEASE_CHANNEL" }, "continuity": { "development_id": "DEV-20260811-010",