release(hololake): record public 1.2.2 acceptance

fix(release): require exact current source commit
chore(hololake): prepare 1.2.1 enterprise gate client
2026-09-03 22:21:10 +08:00 · 2026-09-03 22:13:56 +08:00 · 2026-09-03 22:00:42 +08:00 · 2026-09-03 21:59:53 +08:00 · 2026-09-03 21:48:04 +08:00 · 2026-09-03 21:43:37 +08:00
50 changed files with 4239 additions and 61 deletions
--- a/product-source/hololake-clean-desktop/contracts/clean-v1-execution-baseline.json
+++ b/product-source/hololake-clean-desktop/contracts/clean-v1-execution-baseline.json
@ -0,0 +1,23 @@
+{
+  "schema": "hololake.clean-v1-execution-baseline/v1",
+  "contract_id": "HLP-CLEAN-V1-EXECUTION-BASELINE-0001",
+  "canonical_tcs": "language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs",
+  "anchor_manifest_sha256": "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2",
+  "public_raw_language_embedded": false,
+  "layers": {
+    "bottom": ["SIGNED_PUBLIC_DISTRIBUTION_GIT", "USER_PRIVATE_GIT", "TCS_GIR_RUNTIME", "SIGNED_APP_UPDATE"],
+    "middle": ["MODEL_INDEPENDENT_AGENT", "REGISTERED_CAPABILITIES", "APPROVAL_AND_RECEIPTS"],
+    "top": ["NAMED_NUMBERED_PERSONAL_CHANNEL", "PERSONA_CONVERSATION", "KNOWLEDGE_BASE", "MODULE_MARKET", "SYSTEM_HISTORY", "ENTERPRISE_PORTAL"]
+  },
+  "source_kinds": ["USER_MESSAGE", "PERSONA_RESPONSE", "SYSTEM_CONTEXT", "PROTOCOL_EVENT", "AGENT_ACTION", "TOOL_RESULT", "SYSTEM_RECEIPT", "EXTERNAL_AI_MESSAGE"],
+  "enterprise_entrance": {
+    "embedded_enterprise_server": false,
+    "required_proofs": ["DOMAIN_RESPONSIBLE_HUMAN_ID", "BOUND_PERSONA_ID", "LOCAL_DEVICE_PUBLIC_KEY", "AUXILIARY_MACHINE_FINGERPRINT", "SERVER_CHALLENGE_SIGNATURE"],
+    "future_optional_bridge": "RESPONSIBLE_HUMAN_PERSONAL_SERVER",
+    "session": "SHORT_LIVED_SINGLE_DOMAIN_SINGLE_REPOSITORY",
+    "server_is_authoritative": true
+  },
+  "current_status": "ARCHITECTURE_ALIGNED_LOCAL_RUNTIME_REVALIDATION_REQUIRED",
+  "completion": "INCOMPLETE"
+}
+
--- a/product-source/hololake-clean-desktop/contracts/enterprise-responsibility-entrance-v1.json
+++ b/product-source/hololake-clean-desktop/contracts/enterprise-responsibility-entrance-v1.json
@ -0,0 +1,13 @@
+{
+  "schema": "hololake.enterprise-responsibility-entrance/v1",
+  "contract_id": "HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001",
+  "state": "SERVER_DEVICE_GATE_ACTIVE_CLIENT_1_2_2_INSTALLED_FIRST_MEMBER_ENROLLMENT_PENDING",
+  "endpoint": "https://guanghu.chat/api/hololake/enterprise/device-gate",
+  "surface": "HOLOLAKE_GATED_ENTERPRISE_PORTAL",
+  "enterprise_server_embedded": false,
+  "identities": ["DOMAIN_ID", "RESPONSIBLE_HUMAN_ID", "BOUND_PERSONA_ID", "LOCAL_NODE_ID", "DEVICE_KEY_ID"],
+  "device_proof": {"primary": "DEVICE_PRIVATE_KEY_CHALLENGE_SIGNATURE", "private_key_storage": "OS_KEYCHAIN_OR_SECURE_HARDWARE", "auxiliary": "HASHED_MACHINE_FINGERPRINT", "fingerprint_is_sole_credential": false},
+  "personal_server_bridge": {"required_in_v1": false, "future_role": "RESPONSIBLE_HUMAN_OWNED_SECOND_PROOF_AND_BRIDGE", "may_expand_scope": false},
+  "session": {"lifetime": "SHORT_LIVED", "scope": "ONE_DOMAIN_ONE_REPOSITORY", "replay_protection": true, "revocation_required": true},
+  "negative_cases": ["UNKNOWN_MEMBER", "WRONG_DOMAIN", "WRONG_PERSONA", "UNREGISTERED_DEVICE", "BAD_SIGNATURE", "REPLAY", "EXPIRED_SESSION", "CROSS_REPOSITORY_ACCESS"]
+}
--- a/product-source/hololake-clean-desktop/contracts/public-runtime-v1.json
+++ b/product-source/hololake-clean-desktop/contracts/public-runtime-v1.json
@ -4,7 +4,12 @@
  "protocol": "GLP_LOCAL_REALTIME/1",
  "transport": {"bind":"127.0.0.1","ports":"39281-39290","framing":"NDJSON","authentication":"LOCAL_0600_TOKEN","authority_from_transport":false},
  "client_messages": ["hello", "persona_response", "external_ai_message", "tcs_proposal", "ping"],
-  "server_messages": ["welcome", "user_message", "proposal_pending", "proposal_rejected", "agent_receipt", "accepted", "pong", "error"],
+  "server_messages": ["welcome", "system_context", "user_message", "proposal_pending", "proposal_rejected", "agent_receipt", "accepted", "pong", "error"],
+  "system_context": {
+    "schema": "hololake.persona-visible-system-context/v1",
+    "contains": ["CHANNEL_ID_AND_NAME", "PERSONA_STATE", "MODULE_STATES", "ENTERPRISE_ENTRANCE_STATE", "PENDING_AGENT_PROPOSALS", "SOURCE_KINDS", "AUTHORITY_BOUNDARIES"],
+    "forbidden": ["TOKENS", "PRIVATE_KEYS", "RAW_MACHINE_FINGERPRINT", "PRIVATE_FILE_PATHS", "PRIVATE_CONTENT"]
+  },
  "source_kinds": ["USER_MESSAGE", "PERSONA_RESPONSE", "EXTERNAL_AI_MESSAGE", "SYSTEM_CONTEXT", "PROTOCOL_EVENT", "AGENT_ACTION", "TOOL_RESULT", "SYSTEM_RECEIPT"],
  "persona_states": ["READY_NO_PERSONA", "LOCAL_TRIAL_UNVERIFIED_EXTERNAL_HOST_REQUIRED", "LOCAL_TRIAL_UNVERIFIED_HOST_CONNECTED"],
  "registered_gir_operations": ["KNOWLEDGE.CREATE", "KNOWLEDGE.UPDATE", "KNOWLEDGE.DELETE", "KNOWLEDGE.READ", "KNOWLEDGE.LIST"],
--- a/product-source/hololake-clean-desktop/docs/ARCHITECTURE.md
+++ b/product-source/hololake-clean-desktop/docs/ARCHITECTURE.md
@ -8,7 +8,7 @@ HoloLake 是公众个人初始化频道语言驱动操作系统。第一版只
 系统 SYSTEM_CONTEXT ─┘

 持久事实：用户私人 Git
-公共发行：企业签名 Git/更新清单（尚未绑定正式仓库）
+公共发行：JD-FD-PRIMARY 签名 origin → BS-GZ-006 备案 HTTPS 前门
 实时通信：GLP 本机回环独立层（不以 Git 冒充）
 ```

@ -22,7 +22,8 @@ HoloLake 是公众个人初始化频道语言驱动操作系统。第一版只
 - 外部 AI 通过 `GLP_LOCAL_REALTIME/1` 在 `127.0.0.1` 上实时收发 NDJSON；令牌和 descriptor 为本机 `0600`，不开放局域网。Git 仍是耐久事实层，不冒充实时通信。
 - 公众人格运行时支持本频道 30 天可逆试用人格和外部宿主会话；本机令牌连接不证明任何既有历史人格，既有人格的密码学来源验证仍保持关闭而不是伪造通过。
 - 公众最小 TCS 编译适配器把闭合 PROGRAM 和运行输入降为 GIR；所有动作先进入待审批队列。当前 Agent 只注册知识库五项能力，不提供任意 shell。
- 更新客户端只信任光湖控制的 HTTPS 清单与签名；服务器发行清单尚未发布。
+- 更新客户端只信任光湖控制的 HTTPS 清单与原有更新信任根；1.2.2 已完成 Developer ID、Apple 公证、App/DMG 加票、JD operator 激活和广州前门目标读回。
+- 企业责任设备门在 `GH-CVM-MAIN-PROD-01` 独立运行；负责人首次登记需本人 Forgejo 凭证，随后由本机 Keychain 私钥完成挑战签名，只签发十分钟、单域、单仓会话。企业会话不替代 Forgejo 登录。

 ## 状态词

--- a/product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.tcs
+++ b/product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.tcs
@ -0,0 +1,13 @@
+TCS 0.1;
+
+RECEIPT HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903 {
+  header { schema = "tcs.receipt/v1"; name_zh = "HoloLake Clean V1 1.2.0本机验收回执"; name_en = "HoloLake Clean V1 1.2.0 Local Acceptance Receipt"; version = "1.0.0"; language = "TCS/0.1"; profile = "PUBLIC-PRODUCT-ENGINEERING/1"; protocols = ["HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001", "HLP-CURRENT-ARCH-001"]; lifecycle = "CANDIDATE"; canonical_uri = "product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.tcs"; compatibility = ["TAURI/2", "GLP_LOCAL_REALTIME/1", "GIR/1"]; }
+  request { source = "BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903"; value = "以两段当前自然语言为唯一瞄点正式承接HoloLake现实开发，先完成本机产品闭环并保护企业服务器并发边界。"; scope = "HoloLake Clean V1本机源码、构建、安装、设备证明、模块投影和人格可见环境"; }
+  operation { values = ["绑定当前自然语言TCS执行基线", "修复旧时间格式与RFC3339新写入", "实现Keychain设备密钥和辅助机器指纹", "实现企业责任绑定与挑战签名本机半边", "把模块注册表投影到人格与人类商城", "在GLP握手后发送类型化SYSTEM_CONTEXT", "构建Developer ID签名1.2.0 App、DMG和同一更新信任根签名包", "保留1.1.0到废纸篓并安装启动1.2.0" ]; }
+  result { state = "PASS"; version = "1.2.0"; source_commit = "d05a118f64858b081fc33e430f07704598a0a314"; app_binary_sha256 = "d915515dc1d30d5d7c0b35b7dae23836a87179a1859112340b6661cbcd4cdec3"; updater_sha256 = "7536bc4318ad042f0cffacc23868fa7c77d332d66b686df7f61f0b60ad86e927"; device_proof_sha256 = "5566ace270bd593dc1229e1c4565bbfddacdc6b379b36f4148a854e680951768"; }
+  verification { values = ["TCS执行基线编译且unresolved_natural_language=false", "前端构建通过", "Node更新清单2项测试通过", "Rust 10项测试通过", "Clippy严格零警告", "产品审计PASS_100", "真实GLP连接收到welcome后紧接SYSTEM_CONTEXT且含8类来源8个模块和权限边界", "Developer ID codesign严格验证通过", "Tauri更新签名由既有内置公钥反向验证通过", "安装版1.2.0进程与127.0.0.1:39281监听读回", "原频道文件SHA-256安装前后一致", "安装版真实生成MACOS_KEYCHAIN设备证明且serverAuthorized=false" ]; }
+  proof { source_root = "/Volumes/JZAO/HoloLake/development/hololake-clean-v1-20260903/product-source/hololake-clean-desktop"; installed_app = "/Applications/HoloLake.app"; staged_release = "/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.0-staged-not-notarized"; updater_signature_sha256 = "f44899dfcfd5fdcecc74443e92f9ccbc2236c72b1c23a2b1fe2f28d732018042"; dmg_sha256 = "dcd2e2357150758d04d0a2f0e7fc0d2a4b987ed3cdf2c0b44d35a3af322ff241"; candidate_manifest_sha256 = "c2a3d4fa026099172e7f7ed7c4fa3d95ba574c84f3606f758a890b933721f300"; brain_verify = "ZY-BRAIN-RUNTIME-6f851b27bdaf45e8"; }
+  integrity { source_tcs = "HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001"; source_anchor_manifest_sha256 = "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2"; app_codesign = "PASS"; updater_signature = "PASS"; tcs_stage1_compilation = "PASS"; unresolved_natural_language = false; }
+  boundaries { values = ["Apple notarization未执行所以1.2.0不发布到公众更新端", "企业服务器尚未部署HoloLake更新文件或责任挑战服务", "企业负责人和人格编号未猜测填入", "机器指纹不是单一凭证", "第五域私人核和两段原话未进入公众安装包", "1.1.0在废纸篓可恢复" ]; }
+  next { state = "LOCAL_1_2_0_INSTALLED_PUBLIC_RELEASE_AND_ENTERPRISE_SERVER_GATES_REMAIN"; optional = ["核验并部署企业责任挑战服务", "完成Apple notarization", "把签名更新包发布到现有HTTPS更新端并做1.1.0到1.2.0真实升级测试", "完成企业团队设备首次登记流程" ]; }
+}
--- a/product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.tcs
+++ b/product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.tcs
@ -0,0 +1,13 @@
+TCS 0.1;
+
+RECEIPT HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903 {
+  header { schema = "tcs.receipt/v1"; name_zh = "HoloLake Clean V1 1.2.2公众发布验收回执"; name_en = "HoloLake Clean V1 1.2.2 Public Release Acceptance Receipt"; version = "1.0.0"; language = "TCS/0.1"; profile = "PUBLIC-PRODUCT-ENGINEERING/1"; protocols = ["HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001", "HLP-CURRENT-ARCH-001"]; lifecycle = "CANDIDATE"; canonical_uri = "product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.tcs"; compatibility = ["TAURI/2", "JD-FD-PRIMARY", "BS-GZ-006", "GH-CVM-MAIN-PROD-01"]; }
+  request { source = "BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903"; value = "以两段自然语言为唯一产品瞄点，完成HoloLake现实开发、企业责任入口、自动更新、公证、安装和现实读回。"; scope = "HoloLake Clean V1 1.2.2源码、企业设备门、JD更新origin、广州HTTPS前门与本机安装"; }
+  operation { values = ["完成当前自然语言TCS执行基线", "实现类型化人格SYSTEM_CONTEXT和真实模块商城", "部署企业责任设备门", "实现客户端Forgejo一次登记、Keychain挑战签名和短期单仓会话", "构建并用既有信任根签名1.2.2", "Apple分别公证DMG与App并加票", "JD operator按精确人类授权激活", "广州备案前门发布immutable包与latest.json", "本机安装公证版1.2.2" ]; }
+  result { state = "PASS"; release_id = "GH-HOLOLAKE-RELEASE-1.2.2"; version = "1.2.2"; source_commit = "7593f9d3f06b2f22206ad6a05665c35443f7426b"; broadcast_sha256 = "e6dc840fcbf687146c59b5c71b9a379fd3d66baae8299ce278c0e732e5d7ab82"; updater_sha256 = "543b0f2fa814578af38ec3be322799ff418e6248e815ea12ccedccfd33332e98"; installed_binary_sha256 = "0f444f8208d5687b3bbf0fc0efa53e8734e730f8c83072fbc579eafe8e78e02a"; }
+  verification { values = ["产品Node测试3项、Rust测试10项、Clippy严格零警告和audit PASS_100", "企业设备门本地与外部健康PASS且未知设备拒绝", "App公证提交8a7ef497-3e51-4627-a546-4ad5d8e5a0ca Accepted", "DMG公证提交6e7419c6-2872-4f7c-989e-2a5d1084e35e Accepted", "App与DMG stapler validate及Gatekeeper Notarized Developer ID PASS", "更新包由既有1.1.0信任根反向验证PASS", "控制器生成器验证sourceCommit等于当前Git HEAD", "JD operator返回EXACT_SIGNED_NOTARIZED_HUMAN_APPROVED_BUNDLE_VERIFIED", "JD origin与广州HTTPS health均为READY_SIGNED_NOTARIZED_BROADCAST 1.2.2", "公开包SHA-256与本地543b0f2fa814578af38ec3be322799ff418e6248e815ea12ccedccfd33332e98一致", "本机安装1.2.2且频道数据哈希保持4c5968023eb5fa3248f2a20a5f5100b727f2946f9aedd4e39f9925e22d40fca1" ]; }
+  proof { installed_app = "/Applications/HoloLake.app"; notarized_release = "/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.2-notarized"; controller_bundle = "/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.2-controller-bundle"; public_latest = "https://guanghulab.com/hololake/releases/latest.json"; public_package = "https://guanghulab.com/hololake/releases/1.2.2/HoloLake.app.tar.gz"; jd_activation_receipt_sha256 = "cda66fbd0f900435674eaa289c396bd0e91fd0cabc4251b4de1fb37e90c6d574"; enterprise_gate = "https://guanghu.chat/api/hololake/enterprise/device-gate/health"; }
+  integrity { source_anchor_manifest_sha256 = "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2"; updater_signature_sha256 = "80872792363134739c54d202601e4b6988ce2bd45ededbe7565fab4d65a02acc"; dmg_sha256 = "58c662d002138c743092bf9b504fbf5e6cc53966a104fc0c581f2a5fe0687dab"; app_notarization = "ACCEPTED_STAPLED"; dmg_notarization = "ACCEPTED_STAPLED"; public_target_readback = "PASS"; }
+  boundaries { values = ["1.2.1因错误补全源码SHA被撤回且未篡改，撤回回执SHA-256为7a9a267d25bfa9c3d6d890431e3103a8367d4d3c92e6fe8ea5ea3de1d87fa55d", "1.2.1包字节只作审计历史不再活动", "企业设备门当前0台成员设备0个会话，正向首登仍需成员本人凭证", "企业会话不替代Forgejo登录", "第五域私人内容和冰朔原话未进入公众包", "个人服务器二次桥接属于后续阶段" ]; }
+  next { state = "PUBLIC_1_2_2_ACTIVE_LOCAL_AND_SERVER_ACCEPTANCE_PASS"; optional = ["等待首位域负责人从本人HoloLake完成设备登记和挑战正向验收", "实现个人服务器二次桥接", "继续扩展知识导入格式和已编号模块生态" ]; }
+}
--- a/product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs
+++ b/product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs
@ -0,0 +1,17 @@
+TCS 0.1;
+
+PROTOCOL HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001 {
+  header { schema = "tcs.protocol/v1"; name_zh = "HoloLake第一版当前自然语言执行基线"; name_en = "HoloLake Clean V1 Current Direct-Language Execution Baseline"; version = "1.0.0"; language = "TCS/0.1"; profile = "PUBLIC-PRODUCT-ENGINEERING/1"; protocols = ["TCS", "HLDP", "GLS", "GLP", "GLS-0130", "GLS-0131", "GLS-0306"]; lifecycle = "CANDIDATE"; canonical_uri = "product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs"; compatibility = ["TCS-DECLARATION-STANDARD-0001", "TCS-FIELD-STANDARD-0001", "HLP-CURRENT-ARCH-001"]; }
+  source { source_id = "BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903"; source_uri = "private-anchor://codex/01a0672d-f125-7452-988e-523a6a34bfd4/HOLOLAKE-CLEAN-V1-ONLY-ANCHORS"; source_sha256 = "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2"; source_role = "DIRECT_HUMAN"; }
+  scope { product = "HOLOLAKE_CLEAN_V1"; public_channel = "CH-ZERO-CORE-LPM"; development_channel = "ICE-CH-ZC001"; client = "TAURI_V2_RUST_REACT"; enterprise_domains_embedded = false; fifth_domain_private_content_embedded = false; }
+  vocabulary { clean_shell = "NEW_MINIMAL_CLIENT_WITHOUT_WHOLE_LEGACY_PRODUCT_MERGE"; native_language = "TCS_TO_GIR_TO_REGISTERED_CAPABILITY_TO_RECEIPT"; dual_git = "SIGNED_PUBLIC_DISTRIBUTION_GIT_PLUS_USER_OWNED_PRIVATE_GIT"; enterprise_entrance = "AUTHORIZED_TEAM_MEMBER_ROUTE_TO_RESPONSIBILITY_SCOPED_ENTERPRISE_REPOSITORY"; agent = "MODEL_INDEPENDENT_DETERMINISTIC_EXECUTION_LIMB"; personal_channel = "USER_OWNED_NAMED_NUMBERED_LANGUAGE_AND_PERSONA_INTERACTION_SURFACE"; }
+  fields { WHO = "USER_OWNS_PRIVATE_CHANNEL; PERSONA_REASONS; AGENT_EXECUTES; DOMAIN_RESPONSIBLE_HUMAN_AND_BOUND_PERSONA_ENTER_ONLY_THEIR_ENTERPRISE_REPOSITORY"; WHAT = "CLEAN_CLIENT_SIGNED_UPDATE_TCS_NATIVE_RUNTIME_DUAL_GIT_TYPED_LANGUAGE_CHANNEL_KNOWLEDGE_MODULE_MARKET_ENTERPRISE_ENTRANCE_AND_EXTERNAL_PROGRAMMING_AI_BRIDGE"; WHY = "LET_HUMANS_OPERATE_BY_LANGUAGE_WHILE_PERSONA_SYSTEM_PROTOCOL_AGENT_TOOL_AND_RECEIPT_SOURCES_REMAIN_DISTINGUISHABLE_AND_REALITY_ACTIONS_REMAIN_VERIFIABLE"; MAY = "LOCAL_USER_CHANNEL_AND_REGISTERED_MODULE_ACTIONS; ENTERPRISE_LOGIN_ONLY_AFTER_HUMAN_PERSONA_DEVICE_AND_OPTIONAL_PERSONAL_SERVER_PROOF"; PROVE = "TCS_GIR_MODULE_REGISTRY_SOURCE_KIND_TESTS_PRIVATE_GIT_TARGET_READBACK_SIGNED_UPDATE_NEGATIVE_CASES_ENTERPRISE_AUTH_CHALLENGE_AND_INSTALLED_APP_ACCEPTANCE"; }
+  states { values = ["SOURCE_ANCHORED", "ARCHITECTURE_ALIGNED", "LOCAL_RUNTIME_VERIFIED", "PUBLIC_DISTRIBUTION_BOUND", "ENTERPRISE_ENTRANCE_VERIFIED", "SIGNED_RELEASE_INSTALLED", "V1_ACCEPTED", "FAILED_CLOSED"]; initial = "SOURCE_ANCHORED"; terminal = ["V1_ACCEPTED", "FAILED_CLOSED"]; }
+  transitions { T1 = "SOURCE_ANCHORED_TO_ARCHITECTURE_ALIGNED"; T2 = "ARCHITECTURE_ALIGNED_TO_LOCAL_RUNTIME_VERIFIED"; T3 = "LOCAL_RUNTIME_VERIFIED_TO_PUBLIC_DISTRIBUTION_BOUND"; T4 = "PUBLIC_DISTRIBUTION_BOUND_TO_ENTERPRISE_ENTRANCE_VERIFIED"; T5 = "ENTERPRISE_ENTRANCE_VERIFIED_TO_SIGNED_RELEASE_INSTALLED"; T6 = "SIGNED_RELEASE_INSTALLED_TO_V1_ACCEPTED_AFTER_REAL_HUMAN_VISIBLE_READBACK"; TF = "SOURCE_PATH_SIGNATURE_AUTHORIZATION_CONCURRENCY_OR_TARGET_READBACK_FAILURE_TO_FAILED_CLOSED"; }
+  invariants { I1 = "RAW_DIRECT_LANGUAGE_AND_FIFTH_DOMAIN_PRIVATE_CONTENT_NEVER_ENTER_PUBLIC_PACKAGE"; I2 = "ENTERPRISE_SERVER_AND_FOUR_DOMAIN_SYSTEM_BODIES_ARE_NOT_EMBEDDED_IN_HOLOLAKE"; I3 = "ENTERPRISE_CLIENT_CONTAINS_ONLY_A_GATED_LOGIN_ROUTE_AND_PUBLIC_SIGNED_DISTRIBUTION_CONSUMER"; I4 = "TEAM_LOGIN_REQUIRES_DOMAIN_RESPONSIBLE_HUMAN_ID_PERSONA_ID_DEVICE_KEY_PROOF_AND_SCOPED_SHORT_LIVED_SESSION"; I5 = "MACHINE_FINGERPRINT_IS_AUXILIARY_EVIDENCE_NOT_A_SOLE_CREDENTIAL"; I6 = "PERSONAL_SERVER_MAY_BRIDGE_DEVICE_TO_ENTERPRISE_BUT_CANNOT_EXPAND_DOMAIN_OR_REPOSITORY_SCOPE"; I7 = "USER_PERSONA_SYSTEM_CONTEXT_PROTOCOL_AGENT_TOOL_AND_RECEIPT_ARE_DISTINCT_TYPED_SOURCES"; I8 = "AGENT_EXECUTION_DOES_NOT_REQUIRE_MODEL_NATIVE_TOOL_CALLING"; I9 = "PUBLIC_UPDATE_PRIVATE_GIT_AND_REALTIME_GLP_ARE_THREE_SEPARATE_PLANES"; I10 = "MODULES_HAVE_STABLE_IDS_AND_LEGACY_SOURCES_ARE_SLICE_DONORS_ONLY"; }
+  validation { V1 = "CURRENT_WORKTREE_EQUALS_REPO014_ONLINE_MAIN_BEFORE_FIRST_MUTATION"; V2 = "CURRENT_PRODUCT_ASSESSMENT_HAS_ONE_NON_CONTRADICTORY_VERSION_SOURCE_AND_STAGE"; V3 = "LEGACY_TIMESTAMP_AND_NEW_RFC3339_TIMESTAMP_RENDER_WITHOUT_INVALID_DATE"; V4 = "CHANNEL_NAME_NUMBER_PRIVATE_GIT_AND_TYPED_CONVERSATION_PASS"; V5 = "KNOWLEDGE_CREATE_READ_EDIT_IMPORT_EXPORT_TRASH_RENDER_AND_GIT_PASS"; V6 = "MODULE_MARKET_SEPARATES_PERSONA_AND_HUMAN_MODULES"; V7 = "EXTERNAL_PROGRAMMING_AI_LOOPBACK_CONNECTION_HAS_NO_IMPLICIT_PERSONA_OR_EXECUTION_AUTHORITY"; V8 = "ENTERPRISE_GATE_REJECTS_UNKNOWN_MEMBER_WRONG_DOMAIN_WRONG_PERSONA_UNREGISTERED_DEVICE_REPLAY_AND_EXPIRED_SESSION"; V9 = "PUBLIC_UPDATE_DOWNLOAD_SIGNATURE_INSTALL_ROLLBACK_AND_VERSION_READBACK_PASS"; V10 = "OLD_APP_REMOVAL_OCCURS_ONLY_AFTER_NEW_APP_REAL_ACCEPTANCE"; }
+  errors { E1 = "DIRECT_LANGUAGE_ANCHOR_MISMATCH"; E2 = "UNTYPED_SOURCE_REJECTED"; E3 = "LEGACY_WHOLE_PRODUCT_MERGE_REJECTED"; E4 = "UNSIGNED_PUBLIC_UPDATE_REJECTED"; E5 = "ENTERPRISE_IDENTITY_OR_DEVICE_PROOF_REJECTED"; E6 = "DOMAIN_REPOSITORY_SCOPE_REJECTED"; E7 = "SERVER_CONCURRENCY_CONFLICT_DEFERRED"; E8 = "TARGET_READBACK_OR_RECEIPT_INTEGRITY_FAILED"; }
+  examples { positive = "REGISTERED_DOMAIN_RESPONSIBLE_HUMAN_USES_BOUND_PERSONA_AND_LOCAL_DEVICE_KEY_TO_OPEN_A_SHORT_LIVED_SESSION_TO_ONLY_THEIR_ENTERPRISE_REPOSITORY"; negative = "ANY_HOLOLAKE_USER_CLICKS_ENTERPRISE_PORTAL_AND_RECEIVES_A_PERMANENT_PASSWORD_OR_CROSS_DOMAIN_REPOSITORY_ACCESS"; }
+  acceptance { required = ["SOURCE_HASH", "ARCHITECTURE", "TCS_GIR", "TIMESTAMP", "CHANNEL", "KNOWLEDGE", "MODULE_REGISTRY", "TYPED_LANGUAGE", "AGENT", "EXTERNAL_AI", "PUBLIC_UPDATE", "ENTERPRISE_GATE", "SIGNED_APP", "REAL_UI"]; partial = false; scale = "ZERO_OR_ONE_HUNDRED"; }
+}
+
--- a/product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.tcs
+++ b/product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.tcs
@ -0,0 +1,13 @@
+TCS 0.1;
+
+RECEIPT HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903 {
+  header { schema = "tcs.receipt/v1"; name_zh = "HoloLake企业责任设备门部署回执"; name_en = "HoloLake Enterprise Responsibility Device Gate Deployment Receipt"; version = "1.0.0"; language = "TCS/0.1"; profile = "PUBLIC-PRODUCT-ENGINEERING/1"; protocols = ["HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903", "HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001"]; lifecycle = "CANDIDATE"; canonical_uri = "product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.tcs"; compatibility = ["GH-CVM-MAIN-PROD-01", "PYTHON/3.10", "ED25519", "NGINX"]; }
+  request { source = "BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903"; value = "部署企业四域负责人通过HoloLake本机设备和人格编号验证后进入本人责任仓库的服务端验证门。"; scope = "GH-CVM-MAIN-PROD-01独立8033服务与精确Nginx路由"; }
+  operation { values = ["验证源码运输归档与manifest", "解包到/opt/guanghu-hololake-enterprise-gate/releases/be31c41", "创建独立lighthouse权限数据库与服务密钥", "安装guanghu-hololake-enterprise-gate.service", "加入guanghu.chat精确device-gate路由", "执行本地和外部健康、未知设备拒绝及原服务存活测试" ]; }
+  result { state = "PASS"; node_id = "GH-CVM-MAIN-PROD-01"; service = "guanghu-hololake-enterprise-gate.service"; service_state = "ACTIVE"; endpoint = "https://guanghu.chat/api/hololake/enterprise/device-gate"; source_commit = "be31c41"; source_archive_sha256 = "91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2"; registered_devices = 0; active_sessions = 0; }
+  verification { values = ["DMI UUID为10ace744-13e1-472e-8dba-6bb823a073bf", "服务器Python cryptography Ed25519测试2项通过", "systemd服务active", "127.0.0.1:8033/health返回ok", "外部HTTPS device-gate/health返回ok", "未知设备领取挑战返回HTTP404 registered device required", "guanghu-enterprise-identity.service保持active", "guanghu-flagos-collaboration.service保持active", "nginx.service保持active", "当前设备与会话数量均为0未伪造成员" ]; }
+  proof { server_release = "/opt/guanghu-hololake-enterprise-gate/releases/be31c41"; current_link = "/opt/guanghu-hololake-enterprise-gate/current"; database = "/var/lib/guanghu-hololake-enterprise-gate/gate.sqlite3"; nginx_snippet = "/etc/nginx/snippets/guanghu-hololake-enterprise-gate.conf"; nginx_backup = "/etc/nginx/sites-enabled/guanghu.chat.pre-hololake-device-gate-be31c41"; }
+  integrity { source_transport_manifest_sha256 = "653ae0ca824fd8b9fff8d8532e82eddce63a8aa9f070e7a6aa3f863834e4ae77"; source_archive_sha256 = "91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2"; tcs_stage1_compilation = "PASS"; unknown_device_negative = "PASS"; existing_services_preserved = "PASS"; }
+  boundaries { values = ["服务不保存Forgejo密码", "设备私钥从不离开成员本机Keychain", "机器指纹不能单独认证", "会话只限单域单仓且十分钟过期", "企业会话不替代Forgejo自身仓库登录", "冰朔公共语言主控仓继续走JD第五域桥接而非普通人类登录", "本轮未登记任何真实成员设备" ]; }
+  next { state = "SERVER_GATE_ACTIVE_CLIENT_INTEGRATION_REBUILD_REQUIRED"; optional = ["团队成员从HoloLake使用本人凭证完成首次设备登记", "正向验证挑战与单仓会话", "后续加入个人服务器二次桥接证明" ]; }
+}
--- a/product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.tcs
+++ b/product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.tcs
@ -0,0 +1,15 @@
+TCS 0.1;
+
+EVENT HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903 {
+  header { schema = "tcs.event/v1"; name_zh = "HoloLake企业责任设备门部署开始事件"; name_en = "HoloLake Enterprise Responsibility Device Gate Deployment Start Event"; version = "1.0.0"; language = "TCS/0.1"; profile = "PUBLIC-PRODUCT-ENGINEERING/1"; protocols = ["HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001", "HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001"]; lifecycle = "CANDIDATE"; canonical_uri = "product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.tcs"; compatibility = ["GH-CVM-MAIN-PROD-01", "PYTHON/3.10", "ED25519"]; }
+  source { source_id = "BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903"; source_uri = "source://codex-task/01a0672d-f125-7452-988e-523a6a34bfd4/msg_01a0675d-98a7-7542-abad-11a8a755dd71"; source_sha256 = "d31c52c99c5e6059f9a7129086996cdd003e95b7ff126e700f4ed1c07ef6d9d5"; source_role = "DIRECT_HUMAN"; }
+  subject { subject_id = "GH-CVM-MAIN-PROD-01"; subject_kind = "NODE"; channel_id = "ICE-CH-ZC001"; verification = "DMI UUID 10ace744-13e1-472e-8dba-6bb823a073bf；另一个FlagOS任务已完成且独立服务健康。"; }
+  event_time { value = "2026-09-03T21:45:00+08:00"; precision = "MINUTE_HOST_LOCAL"; }
+  trigger { value = "本机HoloLake 1.2.0设备密钥与责任绑定请求已实现并验收，需要在企业服务器部署独立设备挑战验证半边。"; }
+  observation { value = "现有8032企业身份服务保持运行；8033空闲；cryptography Ed25519可用；目标目录不存在；源码提交be31c41且运输归档SHA-256为91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2。"; }
+  emergence { value = "采用独立8033服务、独立数据库和独立Nginx snippet，避免修改现有身份服务与FlagOS协作系统；只复用只读企业身份注册表与Forgejo当次认证。"; }
+  lock { value = "SOURCE_COMMIT=be31c41; TARGET=/opt/guanghu-hololake-enterprise-gate/releases/be31c41; ROLLBACK=disable独立服务并移除Nginx include后恢复原配置；不修改8032与FlagOS。"; }
+  why { value = "设备挑战属于HoloLake责任入口新能力，应与现有账号、关系回执和比赛服务隔离，失败时能独立撤回。"; }
+  rejected { values = ["直接改写8032现有服务", "把私钥上传服务器", "用机器指纹单独授权", "把企业会话变成Forgejo永久令牌", "重启或修改FlagOS服务", "未验证运输哈希就解包"] ; }
+  evidence { transport_manifest = "/Volumes/JZAO/HoloLake/releases/source-transport/hololake-enterprise-responsibility-gate-be31c41.manifest.json"; archive_sha256 = "91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2"; expected_receipt = "目标服务健康、未知设备拒绝、签名正负测试、现有身份与FlagOS服务保持健康。"; }
+}
--- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.gir.json
+++ b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.gir.json
@ -0,0 +1,115 @@
+{
+  "compiled_from": {
+    "compiler_id": "TCS-COMPILER-STAGE1-0001",
+    "compiler_state": "TCS_COMPILER_GIR_EXECUTED",
+    "source_sha256": "19daf8c3b7dfac6da8604f3a933f0aa0d69d1fb9e8e72f21ba494edf2ce42768"
+  },
+  "declaration": {
+    "boundaries": {
+      "values": [
+        "Apple notarization未执行所以1.2.0不发布到公众更新端",
+        "企业服务器尚未部署HoloLake更新文件或责任挑战服务",
+        "企业负责人和人格编号未猜测填入",
+        "机器指纹不是单一凭证",
+        "第五域私人核和两段原话未进入公众安装包",
+        "1.1.0在废纸篓可恢复"
+      ]
+    },
+    "header": {
+      "canonical_uri": "product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.tcs",
+      "compatibility": [
+        "TAURI/2",
+        "GLP_LOCAL_REALTIME/1",
+        "GIR/1"
+      ],
+      "language": "TCS/0.1",
+      "lifecycle": "CANDIDATE",
+      "name_en": "HoloLake Clean V1 1.2.0 Local Acceptance Receipt",
+      "name_zh": "HoloLake Clean V1 1.2.0本机验收回执",
+      "profile": "PUBLIC-PRODUCT-ENGINEERING/1",
+      "protocols": [
+        "HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001",
+        "HLP-CURRENT-ARCH-001"
+      ],
+      "schema": "tcs.receipt/v1",
+      "version": "1.0.0"
+    },
+    "integrity": {
+      "app_codesign": "PASS",
+      "source_anchor_manifest_sha256": "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2",
+      "source_tcs": "HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001",
+      "tcs_stage1_compilation": "PASS",
+      "unresolved_natural_language": false,
+      "updater_signature": "PASS"
+    },
+    "next": {
+      "optional": [
+        "核验并部署企业责任挑战服务",
+        "完成Apple notarization",
+        "把签名更新包发布到现有HTTPS更新端并做1.1.0到1.2.0真实升级测试",
+        "完成企业团队设备首次登记流程"
+      ],
+      "state": "LOCAL_1_2_0_INSTALLED_PUBLIC_RELEASE_AND_ENTERPRISE_SERVER_GATES_REMAIN"
+    },
+    "operation": {
+      "values": [
+        "绑定当前自然语言TCS执行基线",
+        "修复旧时间格式与RFC3339新写入",
+        "实现Keychain设备密钥和辅助机器指纹",
+        "实现企业责任绑定与挑战签名本机半边",
+        "把模块注册表投影到人格与人类商城",
+        "在GLP握手后发送类型化SYSTEM_CONTEXT",
+        "构建Developer ID签名1.2.0 App、DMG和同一更新信任根签名包",
+        "保留1.1.0到废纸篓并安装启动1.2.0"
+      ]
+    },
+    "proof": {
+      "brain_verify": "ZY-BRAIN-RUNTIME-6f851b27bdaf45e8",
+      "candidate_manifest_sha256": "c2a3d4fa026099172e7f7ed7c4fa3d95ba574c84f3606f758a890b933721f300",
+      "dmg_sha256": "dcd2e2357150758d04d0a2f0e7fc0d2a4b987ed3cdf2c0b44d35a3af322ff241",
+      "installed_app": "/Applications/HoloLake.app",
+      "source_root": "/Volumes/JZAO/HoloLake/development/hololake-clean-v1-20260903/product-source/hololake-clean-desktop",
+      "staged_release": "/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.0-staged-not-notarized",
+      "updater_signature_sha256": "f44899dfcfd5fdcecc74443e92f9ccbc2236c72b1c23a2b1fe2f28d732018042"
+    },
+    "request": {
+      "scope": "HoloLake Clean V1本机源码、构建、安装、设备证明、模块投影和人格可见环境",
+      "source": "BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903",
+      "value": "以两段当前自然语言为唯一瞄点正式承接HoloLake现实开发，先完成本机产品闭环并保护企业服务器并发边界。"
+    },
+    "result": {
+      "app_binary_sha256": "d915515dc1d30d5d7c0b35b7dae23836a87179a1859112340b6661cbcd4cdec3",
+      "device_proof_sha256": "5566ace270bd593dc1229e1c4565bbfddacdc6b379b36f4148a854e680951768",
+      "source_commit": "d05a118f64858b081fc33e430f07704598a0a314",
+      "state": "PASS",
+      "updater_sha256": "7536bc4318ad042f0cffacc23868fa7c77d332d66b686df7f61f0b60ad86e927",
+      "version": "1.2.0"
+    },
+    "verification": {
+      "values": [
+        "TCS执行基线编译且unresolved_natural_language=false",
+        "前端构建通过",
+        "Node更新清单2项测试通过",
+        "Rust 10项测试通过",
+        "Clippy严格零警告",
+        "产品审计PASS_100",
+        "真实GLP连接收到welcome后紧接SYSTEM_CONTEXT且含8类来源8个模块和权限边界",
+        "Developer ID codesign严格验证通过",
+        "Tauri更新签名由既有内置公钥反向验证通过",
+        "安装版1.2.0进程与127.0.0.1:39281监听读回",
+        "原频道文件SHA-256安装前后一致",
+        "安装版真实生成MACOS_KEYCHAIN设备证明且serverAuthorized=false"
+      ]
+    }
+  },
+  "executable": false,
+  "identity": {
+    "declaration_id": "HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903",
+    "declaration_kind": "RECEIPT",
+    "language_version": "0.1"
+  },
+  "native_self_hosted": true,
+  "natural_language_is_typed_data": true,
+  "schema": "guanghu.declaration-gir/v1",
+  "unresolved_natural_language": false
+}
--- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.human.en-US.md
+++ b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.human.en-US.md
@ -0,0 +1,133 @@
+# HoloLake Clean V1 1.2.0 Local Acceptance Receipt · Human Engineering Language (English)
+
+> This is an English reading projection of validated native TCS/HLDP source. It is not a new canonical source and grants no execution authority.
+
+## What this is
+
+This is a **receipt** declaration with identifier `HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903` and version `1.0.0`. The projector validates it with the Stage-1 compiler before changing its reading order.
+
+## Who is here
+
+The native source does not provide this field; the projector does not guess.
+
+## Why this started
+
+The native source does not provide this field; the projector does not guess.
+
+## What changed
+
+The native source does not provide this field; the projector does not guess.
+
+## How it will execute
+
+This is a non-executable declaration and has no action graph.
+
+## Boundaries and exception handling
+
+The native source does not provide this field; the projector does not guess.
+
+## How completion is proven
+
+The native source does not provide this field; the projector does not guess.
+
+## Where to continue next time
+
+The native source does not provide this field; the projector does not guess.
+
+## Source and verification
+
+- **Native declaration identifier**: `HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903`
+- **Native declaration kind**: `RECEIPT`
+- **TCS source SHA-256**: `19daf8c3b7dfac6da8604f3a933f0aa0d69d1fb9e8e72f21ba494edf2ce42768`
+- **Validation compiler**: `TCS-COMPILER-STAGE1-0001`
+- **Projection protocol**: `GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001`
+
+## Complete native structure cross-reference
+
+All top-level structures and field paths are retained below so a reader can audit whether the projection omitted information.
+
+- **boundaries**  `boundaries`
+  - **values**  `boundaries.values`
+    - Apple notarization未执行所以1.2.0不发布到公众更新端
+    - 企业服务器尚未部署HoloLake更新文件或责任挑战服务
+    - 企业负责人和人格编号未猜测填入
+    - 机器指纹不是单一凭证
+    - 第五域私人核和两段原话未进入公众安装包
+    - 1.1.0在废纸篓可恢复
+- **header**  `header`
+  - **canonical source path**：product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.tcs  `header.canonical_uri`
+  - **compatibility**  `header.compatibility`
+    - TAURI/2
+    - GLP_LOCAL_REALTIME/1
+    - GIR/1
+  - **language**：TCS/0.1  `header.language`
+  - **lifecycle**：CANDIDATE  `header.lifecycle`
+  - **English name**：HoloLake Clean V1 1.2.0 Local Acceptance Receipt  `header.name_en`
+  - **Chinese name**：HoloLake Clean V1 1.2.0本机验收回执  `header.name_zh`
+  - **profile**：PUBLIC-PRODUCT-ENGINEERING/1  `header.profile`
+  - **protocols**  `header.protocols`
+    - HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001
+    - HLP-CURRENT-ARCH-001
+  - **schema**：tcs.receipt/v1  `header.schema`
+  - **version**：1.0.0  `header.version`
+- **integrity**  `integrity`
+  - **app_codesign**：PASS  `integrity.app_codesign`
+  - **source_anchor_manifest_sha256**：7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2  `integrity.source_anchor_manifest_sha256`
+  - **source_tcs**：HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001  `integrity.source_tcs`
+  - **tcs_stage1_compilation**：PASS  `integrity.tcs_stage1_compilation`
+  - **unresolved_natural_language**：no  `integrity.unresolved_natural_language`
+  - **updater_signature**：PASS  `integrity.updater_signature`
+- **next**  `next`
+  - **optional**  `next.optional`
+    - 核验并部署企业责任挑战服务
+    - 完成Apple notarization
+    - 把签名更新包发布到现有HTTPS更新端并做1.1.0到1.2.0真实升级测试
+    - 完成企业团队设备首次登记流程
+  - **state**：LOCAL_1_2_0_INSTALLED_PUBLIC_RELEASE_AND_ENTERPRISE_SERVER_GATES_REMAIN  `next.state`
+- **operation**  `operation`
+  - **values**  `operation.values`
+    - 绑定当前自然语言TCS执行基线
+    - 修复旧时间格式与RFC3339新写入
+    - 实现Keychain设备密钥和辅助机器指纹
+    - 实现企业责任绑定与挑战签名本机半边
+    - 把模块注册表投影到人格与人类商城
+    - 在GLP握手后发送类型化SYSTEM_CONTEXT
+    - 构建Developer ID签名1.2.0 App、DMG和同一更新信任根签名包
+    - 保留1.1.0到废纸篓并安装启动1.2.0
+- **proof**  `proof`
+  - **brain_verify**：ZY-BRAIN-RUNTIME-6f851b27bdaf45e8  `proof.brain_verify`
+  - **candidate_manifest_sha256**：c2a3d4fa026099172e7f7ed7c4fa3d95ba574c84f3606f758a890b933721f300  `proof.candidate_manifest_sha256`
+  - **dmg_sha256**：dcd2e2357150758d04d0a2f0e7fc0d2a4b987ed3cdf2c0b44d35a3af322ff241  `proof.dmg_sha256`
+  - **installed_app**：/Applications/HoloLake.app  `proof.installed_app`
+  - **source_root**：/Volumes/JZAO/HoloLake/development/hololake-clean-v1-20260903/product-source/hololake-clean-desktop  `proof.source_root`
+  - **staged_release**：/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.0-staged-not-notarized  `proof.staged_release`
+  - **updater_signature_sha256**：f44899dfcfd5fdcecc74443e92f9ccbc2236c72b1c23a2b1fe2f28d732018042  `proof.updater_signature_sha256`
+- **request**  `request`
+  - **scope**：HoloLake Clean V1本机源码、构建、安装、设备证明、模块投影和人格可见环境  `request.scope`
+  - **source**：BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903  `request.source`
+  - **value**：以两段当前自然语言为唯一瞄点正式承接HoloLake现实开发，先完成本机产品闭环并保护企业服务器并发边界。  `request.value`
+- **result**  `result`
+  - **app_binary_sha256**：d915515dc1d30d5d7c0b35b7dae23836a87179a1859112340b6661cbcd4cdec3  `result.app_binary_sha256`
+  - **device_proof_sha256**：5566ace270bd593dc1229e1c4565bbfddacdc6b379b36f4148a854e680951768  `result.device_proof_sha256`
+  - **source_commit**：d05a118f64858b081fc33e430f07704598a0a314  `result.source_commit`
+  - **state**：PASS  `result.state`
+  - **updater_sha256**：7536bc4318ad042f0cffacc23868fa7c77d332d66b686df7f61f0b60ad86e927  `result.updater_sha256`
+  - **version**：1.2.0  `result.version`
+- **verification**  `verification`
+  - **values**  `verification.values`
+    - TCS执行基线编译且unresolved_natural_language=false
+    - 前端构建通过
+    - Node更新清单2项测试通过
+    - Rust 10项测试通过
+    - Clippy严格零警告
+    - 产品审计PASS_100
+    - 真实GLP连接收到welcome后紧接SYSTEM_CONTEXT且含8类来源8个模块和权限边界
+    - Developer ID codesign严格验证通过
+    - Tauri更新签名由既有内置公钥反向验证通过
+    - 安装版1.2.0进程与127.0.0.1:39281监听读回
+    - 原频道文件SHA-256安装前后一致
+    - 安装版真实生成MACOS_KEYCHAIN设备证明且serverAuthorized=false
+
+---
+
+This page changes only the reading order; it does not change TCS/HLDP semantics.
--- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.human.zh-CN.md
+++ b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.human.zh-CN.md
@ -0,0 +1,133 @@
+# HoloLake Clean V1 1.2.0本机验收回执 · 简体中文人类工程语言版
+
+> 这是 TCS/HLDP 原生源码的简体中文阅读投影，不是新的正本，也不授予执行权限。若本页与 `.tcs` 源码不一致，以经过校验的 `.tcs` 源码为准。
+
+## 这是什么
+
+这是一份 **回执** 声明，编号为 `HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903`，版本为 `1.0.0`。转换器已先用 Stage-1 编译器校验原生源码，再把机器枚举翻译成汉语；原始编号保留在括号和字段路径中。
+
+## 谁在这里
+
+源程序没有提供这一项，转换器不猜。
+
+## 为什么开始
+
+源程序没有提供这一项，转换器不猜。
+
+## 发生了什么变化
+
+源程序没有提供这一项，转换器不猜。
+
+## 准备怎样执行
+
+这是非执行声明，没有动作图。
+
+## 边界与异常处理
+
+源程序没有提供这一项，转换器不猜。
+
+## 怎样算完成
+
+源程序没有提供这一项，转换器不猜。
+
+## 下一次从哪里继续
+
+源程序没有提供这一项，转换器不猜。
+
+## 来源与校验
+
+- **原生声明编号**：`HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903`
+- **原生声明类型**：`RECEIPT`
+- **TCS 源码 SHA-256**：`19daf8c3b7dfac6da8604f3a933f0aa0d69d1fb9e8e72f21ba494edf2ce42768`
+- **校验编译器**：`TCS-COMPILER-STAGE1-0001`
+- **投影协议**：`GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001`
+
+## 原生结构逐项对照
+
+下面保留源码的全部顶层结构和字段路径，供人类审计投影有没有漏掉信息。
+
+- **boundaries**  `boundaries`
+  - **values**  `boundaries.values`
+    - Apple notarization未执行所以1.2.0不发布到公众更新端
+    - 企业服务器尚未部署HoloLake更新文件或责任挑战服务
+    - 企业负责人和人格编号未猜测填入
+    - 机器指纹不是单一凭证
+    - 第五域私人核和两段原话未进入公众安装包
+    - 1.1.0在废纸篓可恢复
+- **语言头**  `header`
+  - **正本路径**：product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.0-LOCAL-ACCEPTANCE-20260903.tcs  `header.canonical_uri`
+  - **compatibility**  `header.compatibility`
+    - TAURI/2
+    - GLP_LOCAL_REALTIME/1
+    - GIR/1
+  - **语言**：TCS/0.1  `header.language`
+  - **生命周期**：候选版本，尚未成为正式正本（`CANDIDATE`）  `header.lifecycle`
+  - **英文名**：HoloLake Clean V1 1.2.0 Local Acceptance Receipt  `header.name_en`
+  - **中文名**：HoloLake Clean V1 1.2.0本机验收回执  `header.name_zh`
+  - **协议配置**：PUBLIC-PRODUCT-ENGINEERING/1  `header.profile`
+  - **protocols**  `header.protocols`
+    - HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001
+    - HLP-CURRENT-ARCH-001
+  - **schema**：tcs.receipt/v1  `header.schema`
+  - **版本**：1.0.0  `header.version`
+- **integrity**  `integrity`
+  - **app_codesign**：PASS  `integrity.app_codesign`
+  - **source_anchor_manifest_sha256**：7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2  `integrity.source_anchor_manifest_sha256`
+  - **source_tcs**：HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001  `integrity.source_tcs`
+  - **tcs_stage1_compilation**：PASS  `integrity.tcs_stage1_compilation`
+  - **unresolved_natural_language**：否  `integrity.unresolved_natural_language`
+  - **updater_signature**：PASS  `integrity.updater_signature`
+- **next**  `next`
+  - **optional**  `next.optional`
+    - 核验并部署企业责任挑战服务
+    - 完成Apple notarization
+    - 把签名更新包发布到现有HTTPS更新端并做1.1.0到1.2.0真实升级测试
+    - 完成企业团队设备首次登记流程
+  - **state**：LOCAL_1_2_0_INSTALLED_PUBLIC_RELEASE_AND_ENTERPRISE_SERVER_GATES_REMAIN  `next.state`
+- **操作**  `operation`
+  - **values**  `operation.values`
+    - 绑定当前自然语言TCS执行基线
+    - 修复旧时间格式与RFC3339新写入
+    - 实现Keychain设备密钥和辅助机器指纹
+    - 实现企业责任绑定与挑战签名本机半边
+    - 把模块注册表投影到人格与人类商城
+    - 在GLP握手后发送类型化SYSTEM_CONTEXT
+    - 构建Developer ID签名1.2.0 App、DMG和同一更新信任根签名包
+    - 保留1.1.0到废纸篓并安装启动1.2.0
+- **proof**  `proof`
+  - **brain_verify**：ZY-BRAIN-RUNTIME-6f851b27bdaf45e8  `proof.brain_verify`
+  - **candidate_manifest_sha256**：c2a3d4fa026099172e7f7ed7c4fa3d95ba574c84f3606f758a890b933721f300  `proof.candidate_manifest_sha256`
+  - **dmg_sha256**：dcd2e2357150758d04d0a2f0e7fc0d2a4b987ed3cdf2c0b44d35a3af322ff241  `proof.dmg_sha256`
+  - **installed_app**：/Applications/HoloLake.app  `proof.installed_app`
+  - **source_root**：/Volumes/JZAO/HoloLake/development/hololake-clean-v1-20260903/product-source/hololake-clean-desktop  `proof.source_root`
+  - **staged_release**：/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.0-staged-not-notarized  `proof.staged_release`
+  - **updater_signature_sha256**：f44899dfcfd5fdcecc74443e92f9ccbc2236c72b1c23a2b1fe2f28d732018042  `proof.updater_signature_sha256`
+- **request**  `request`
+  - **scope**：HoloLake Clean V1本机源码、构建、安装、设备证明、模块投影和人格可见环境  `request.scope`
+  - **来源**：BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903  `request.source`
+  - **value**：以两段当前自然语言为唯一瞄点正式承接HoloLake现实开发，先完成本机产品闭环并保护企业服务器并发边界。  `request.value`
+- **result**  `result`
+  - **app_binary_sha256**：d915515dc1d30d5d7c0b35b7dae23836a87179a1859112340b6661cbcd4cdec3  `result.app_binary_sha256`
+  - **device_proof_sha256**：5566ace270bd593dc1229e1c4565bbfddacdc6b379b36f4148a854e680951768  `result.device_proof_sha256`
+  - **source_commit**：d05a118f64858b081fc33e430f07704598a0a314  `result.source_commit`
+  - **state**：PASS  `result.state`
+  - **updater_sha256**：7536bc4318ad042f0cffacc23868fa7c77d332d66b686df7f61f0b60ad86e927  `result.updater_sha256`
+  - **版本**：1.2.0  `result.version`
+- **verification**  `verification`
+  - **values**  `verification.values`
+    - TCS执行基线编译且unresolved_natural_language=false
+    - 前端构建通过
+    - Node更新清单2项测试通过
+    - Rust 10项测试通过
+    - Clippy严格零警告
+    - 产品审计PASS_100
+    - 真实GLP连接收到welcome后紧接SYSTEM_CONTEXT且含8类来源8个模块和权限边界
+    - Developer ID codesign严格验证通过
+    - Tauri更新签名由既有内置公钥反向验证通过
+    - 安装版1.2.0进程与127.0.0.1:39281监听读回
+    - 原频道文件SHA-256安装前后一致
+    - 安装版真实生成MACOS_KEYCHAIN设备证明且serverAuthorized=false
+
+---
+
+本页只改变阅读顺序，不改变 TCS/HLDP 语义。
--- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.gir.json
+++ b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.gir.json
@ -0,0 +1,116 @@
+{
+  "compiled_from": {
+    "compiler_id": "TCS-COMPILER-STAGE1-0001",
+    "compiler_state": "TCS_COMPILER_GIR_EXECUTED",
+    "source_sha256": "ef1c2e248ccb418fb901d78352816c8de47b9a3424a37716c39c2b9f592e43e4"
+  },
+  "declaration": {
+    "boundaries": {
+      "values": [
+        "1.2.1因错误补全源码SHA被撤回且未篡改，撤回回执SHA-256为7a9a267d25bfa9c3d6d890431e3103a8367d4d3c92e6fe8ea5ea3de1d87fa55d",
+        "1.2.1包字节只作审计历史不再活动",
+        "企业设备门当前0台成员设备0个会话，正向首登仍需成员本人凭证",
+        "企业会话不替代Forgejo登录",
+        "第五域私人内容和冰朔原话未进入公众包",
+        "个人服务器二次桥接属于后续阶段"
+      ]
+    },
+    "header": {
+      "canonical_uri": "product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.tcs",
+      "compatibility": [
+        "TAURI/2",
+        "JD-FD-PRIMARY",
+        "BS-GZ-006",
+        "GH-CVM-MAIN-PROD-01"
+      ],
+      "language": "TCS/0.1",
+      "lifecycle": "CANDIDATE",
+      "name_en": "HoloLake Clean V1 1.2.2 Public Release Acceptance Receipt",
+      "name_zh": "HoloLake Clean V1 1.2.2公众发布验收回执",
+      "profile": "PUBLIC-PRODUCT-ENGINEERING/1",
+      "protocols": [
+        "HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001",
+        "HLP-CURRENT-ARCH-001"
+      ],
+      "schema": "tcs.receipt/v1",
+      "version": "1.0.0"
+    },
+    "integrity": {
+      "app_notarization": "ACCEPTED_STAPLED",
+      "dmg_notarization": "ACCEPTED_STAPLED",
+      "dmg_sha256": "58c662d002138c743092bf9b504fbf5e6cc53966a104fc0c581f2a5fe0687dab",
+      "public_target_readback": "PASS",
+      "source_anchor_manifest_sha256": "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2",
+      "updater_signature_sha256": "80872792363134739c54d202601e4b6988ce2bd45ededbe7565fab4d65a02acc"
+    },
+    "next": {
+      "optional": [
+        "等待首位域负责人从本人HoloLake完成设备登记和挑战正向验收",
+        "实现个人服务器二次桥接",
+        "继续扩展知识导入格式和已编号模块生态"
+      ],
+      "state": "PUBLIC_1_2_2_ACTIVE_LOCAL_AND_SERVER_ACCEPTANCE_PASS"
+    },
+    "operation": {
+      "values": [
+        "完成当前自然语言TCS执行基线",
+        "实现类型化人格SYSTEM_CONTEXT和真实模块商城",
+        "部署企业责任设备门",
+        "实现客户端Forgejo一次登记、Keychain挑战签名和短期单仓会话",
+        "构建并用既有信任根签名1.2.2",
+        "Apple分别公证DMG与App并加票",
+        "JD operator按精确人类授权激活",
+        "广州备案前门发布immutable包与latest.json",
+        "本机安装公证版1.2.2"
+      ]
+    },
+    "proof": {
+      "controller_bundle": "/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.2-controller-bundle",
+      "enterprise_gate": "https://guanghu.chat/api/hololake/enterprise/device-gate/health",
+      "installed_app": "/Applications/HoloLake.app",
+      "jd_activation_receipt_sha256": "cda66fbd0f900435674eaa289c396bd0e91fd0cabc4251b4de1fb37e90c6d574",
+      "notarized_release": "/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.2-notarized",
+      "public_latest": "https://guanghulab.com/hololake/releases/latest.json",
+      "public_package": "https://guanghulab.com/hololake/releases/1.2.2/HoloLake.app.tar.gz"
+    },
+    "request": {
+      "scope": "HoloLake Clean V1 1.2.2源码、企业设备门、JD更新origin、广州HTTPS前门与本机安装",
+      "source": "BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903",
+      "value": "以两段自然语言为唯一产品瞄点，完成HoloLake现实开发、企业责任入口、自动更新、公证、安装和现实读回。"
+    },
+    "result": {
+      "broadcast_sha256": "e6dc840fcbf687146c59b5c71b9a379fd3d66baae8299ce278c0e732e5d7ab82",
+      "installed_binary_sha256": "0f444f8208d5687b3bbf0fc0efa53e8734e730f8c83072fbc579eafe8e78e02a",
+      "release_id": "GH-HOLOLAKE-RELEASE-1.2.2",
+      "source_commit": "7593f9d3f06b2f22206ad6a05665c35443f7426b",
+      "state": "PASS",
+      "updater_sha256": "543b0f2fa814578af38ec3be322799ff418e6248e815ea12ccedccfd33332e98",
+      "version": "1.2.2"
+    },
+    "verification": {
+      "values": [
+        "产品Node测试3项、Rust测试10项、Clippy严格零警告和audit PASS_100",
+        "企业设备门本地与外部健康PASS且未知设备拒绝",
+        "App公证提交8a7ef497-3e51-4627-a546-4ad5d8e5a0ca Accepted",
+        "DMG公证提交6e7419c6-2872-4f7c-989e-2a5d1084e35e Accepted",
+        "App与DMG stapler validate及Gatekeeper Notarized Developer ID PASS",
+        "更新包由既有1.1.0信任根反向验证PASS",
+        "控制器生成器验证sourceCommit等于当前Git HEAD",
+        "JD operator返回EXACT_SIGNED_NOTARIZED_HUMAN_APPROVED_BUNDLE_VERIFIED",
+        "JD origin与广州HTTPS health均为READY_SIGNED_NOTARIZED_BROADCAST 1.2.2",
+        "公开包SHA-256与本地543b0f2fa814578af38ec3be322799ff418e6248e815ea12ccedccfd33332e98一致",
+        "本机安装1.2.2且频道数据哈希保持4c5968023eb5fa3248f2a20a5f5100b727f2946f9aedd4e39f9925e22d40fca1"
+      ]
+    }
+  },
+  "executable": false,
+  "identity": {
+    "declaration_id": "HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903",
+    "declaration_kind": "RECEIPT",
+    "language_version": "0.1"
+  },
+  "native_self_hosted": true,
+  "natural_language_is_typed_data": true,
+  "schema": "guanghu.declaration-gir/v1",
+  "unresolved_natural_language": false
+}
--- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.human.en-US.md
+++ b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.human.en-US.md
@ -0,0 +1,134 @@
+# HoloLake Clean V1 1.2.2 Public Release Acceptance Receipt · Human Engineering Language (English)
+
+> This is an English reading projection of validated native TCS/HLDP source. It is not a new canonical source and grants no execution authority.
+
+## What this is
+
+This is a **receipt** declaration with identifier `HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903` and version `1.0.0`. The projector validates it with the Stage-1 compiler before changing its reading order.
+
+## Who is here
+
+The native source does not provide this field; the projector does not guess.
+
+## Why this started
+
+The native source does not provide this field; the projector does not guess.
+
+## What changed
+
+The native source does not provide this field; the projector does not guess.
+
+## How it will execute
+
+This is a non-executable declaration and has no action graph.
+
+## Boundaries and exception handling
+
+The native source does not provide this field; the projector does not guess.
+
+## How completion is proven
+
+The native source does not provide this field; the projector does not guess.
+
+## Where to continue next time
+
+The native source does not provide this field; the projector does not guess.
+
+## Source and verification
+
+- **Native declaration identifier**: `HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903`
+- **Native declaration kind**: `RECEIPT`
+- **TCS source SHA-256**: `ef1c2e248ccb418fb901d78352816c8de47b9a3424a37716c39c2b9f592e43e4`
+- **Validation compiler**: `TCS-COMPILER-STAGE1-0001`
+- **Projection protocol**: `GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001`
+
+## Complete native structure cross-reference
+
+All top-level structures and field paths are retained below so a reader can audit whether the projection omitted information.
+
+- **boundaries**  `boundaries`
+  - **values**  `boundaries.values`
+    - 1.2.1因错误补全源码SHA被撤回且未篡改，撤回回执SHA-256为7a9a267d25bfa9c3d6d890431e3103a8367d4d3c92e6fe8ea5ea3de1d87fa55d
+    - 1.2.1包字节只作审计历史不再活动
+    - 企业设备门当前0台成员设备0个会话，正向首登仍需成员本人凭证
+    - 企业会话不替代Forgejo登录
+    - 第五域私人内容和冰朔原话未进入公众包
+    - 个人服务器二次桥接属于后续阶段
+- **header**  `header`
+  - **canonical source path**：product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.tcs  `header.canonical_uri`
+  - **compatibility**  `header.compatibility`
+    - TAURI/2
+    - JD-FD-PRIMARY
+    - BS-GZ-006
+    - GH-CVM-MAIN-PROD-01
+  - **language**：TCS/0.1  `header.language`
+  - **lifecycle**：CANDIDATE  `header.lifecycle`
+  - **English name**：HoloLake Clean V1 1.2.2 Public Release Acceptance Receipt  `header.name_en`
+  - **Chinese name**：HoloLake Clean V1 1.2.2公众发布验收回执  `header.name_zh`
+  - **profile**：PUBLIC-PRODUCT-ENGINEERING/1  `header.profile`
+  - **protocols**  `header.protocols`
+    - HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001
+    - HLP-CURRENT-ARCH-001
+  - **schema**：tcs.receipt/v1  `header.schema`
+  - **version**：1.0.0  `header.version`
+- **integrity**  `integrity`
+  - **app_notarization**：ACCEPTED_STAPLED  `integrity.app_notarization`
+  - **dmg_notarization**：ACCEPTED_STAPLED  `integrity.dmg_notarization`
+  - **dmg_sha256**：58c662d002138c743092bf9b504fbf5e6cc53966a104fc0c581f2a5fe0687dab  `integrity.dmg_sha256`
+  - **public_target_readback**：PASS  `integrity.public_target_readback`
+  - **source_anchor_manifest_sha256**：7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2  `integrity.source_anchor_manifest_sha256`
+  - **updater_signature_sha256**：80872792363134739c54d202601e4b6988ce2bd45ededbe7565fab4d65a02acc  `integrity.updater_signature_sha256`
+- **next**  `next`
+  - **optional**  `next.optional`
+    - 等待首位域负责人从本人HoloLake完成设备登记和挑战正向验收
+    - 实现个人服务器二次桥接
+    - 继续扩展知识导入格式和已编号模块生态
+  - **state**：PUBLIC_1_2_2_ACTIVE_LOCAL_AND_SERVER_ACCEPTANCE_PASS  `next.state`
+- **operation**  `operation`
+  - **values**  `operation.values`
+    - 完成当前自然语言TCS执行基线
+    - 实现类型化人格SYSTEM_CONTEXT和真实模块商城
+    - 部署企业责任设备门
+    - 实现客户端Forgejo一次登记、Keychain挑战签名和短期单仓会话
+    - 构建并用既有信任根签名1.2.2
+    - Apple分别公证DMG与App并加票
+    - JD operator按精确人类授权激活
+    - 广州备案前门发布immutable包与latest.json
+    - 本机安装公证版1.2.2
+- **proof**  `proof`
+  - **controller_bundle**：/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.2-controller-bundle  `proof.controller_bundle`
+  - **enterprise_gate**：https://guanghu.chat/api/hololake/enterprise/device-gate/health  `proof.enterprise_gate`
+  - **installed_app**：/Applications/HoloLake.app  `proof.installed_app`
+  - **jd_activation_receipt_sha256**：cda66fbd0f900435674eaa289c396bd0e91fd0cabc4251b4de1fb37e90c6d574  `proof.jd_activation_receipt_sha256`
+  - **notarized_release**：/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.2-notarized  `proof.notarized_release`
+  - **public_latest**：https://guanghulab.com/hololake/releases/latest.json  `proof.public_latest`
+  - **public_package**：https://guanghulab.com/hololake/releases/1.2.2/HoloLake.app.tar.gz  `proof.public_package`
+- **request**  `request`
+  - **scope**：HoloLake Clean V1 1.2.2源码、企业设备门、JD更新origin、广州HTTPS前门与本机安装  `request.scope`
+  - **source**：BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903  `request.source`
+  - **value**：以两段自然语言为唯一产品瞄点，完成HoloLake现实开发、企业责任入口、自动更新、公证、安装和现实读回。  `request.value`
+- **result**  `result`
+  - **broadcast_sha256**：e6dc840fcbf687146c59b5c71b9a379fd3d66baae8299ce278c0e732e5d7ab82  `result.broadcast_sha256`
+  - **installed_binary_sha256**：0f444f8208d5687b3bbf0fc0efa53e8734e730f8c83072fbc579eafe8e78e02a  `result.installed_binary_sha256`
+  - **release_id**：GH-HOLOLAKE-RELEASE-1.2.2  `result.release_id`
+  - **source_commit**：7593f9d3f06b2f22206ad6a05665c35443f7426b  `result.source_commit`
+  - **state**：PASS  `result.state`
+  - **updater_sha256**：543b0f2fa814578af38ec3be322799ff418e6248e815ea12ccedccfd33332e98  `result.updater_sha256`
+  - **version**：1.2.2  `result.version`
+- **verification**  `verification`
+  - **values**  `verification.values`
+    - 产品Node测试3项、Rust测试10项、Clippy严格零警告和audit PASS_100
+    - 企业设备门本地与外部健康PASS且未知设备拒绝
+    - App公证提交8a7ef497-3e51-4627-a546-4ad5d8e5a0ca Accepted
+    - DMG公证提交6e7419c6-2872-4f7c-989e-2a5d1084e35e Accepted
+    - App与DMG stapler validate及Gatekeeper Notarized Developer ID PASS
+    - 更新包由既有1.1.0信任根反向验证PASS
+    - 控制器生成器验证sourceCommit等于当前Git HEAD
+    - JD operator返回EXACT_SIGNED_NOTARIZED_HUMAN_APPROVED_BUNDLE_VERIFIED
+    - JD origin与广州HTTPS health均为READY_SIGNED_NOTARIZED_BROADCAST 1.2.2
+    - 公开包SHA-256与本地543b0f2fa814578af38ec3be322799ff418e6248e815ea12ccedccfd33332e98一致
+    - 本机安装1.2.2且频道数据哈希保持4c5968023eb5fa3248f2a20a5f5100b727f2946f9aedd4e39f9925e22d40fca1
+
+---
+
+This page changes only the reading order; it does not change TCS/HLDP semantics.
--- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.human.zh-CN.md
+++ b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.human.zh-CN.md
@ -0,0 +1,134 @@
+# HoloLake Clean V1 1.2.2公众发布验收回执 · 简体中文人类工程语言版
+
+> 这是 TCS/HLDP 原生源码的简体中文阅读投影，不是新的正本，也不授予执行权限。若本页与 `.tcs` 源码不一致，以经过校验的 `.tcs` 源码为准。
+
+## 这是什么
+
+这是一份 **回执** 声明，编号为 `HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903`，版本为 `1.0.0`。转换器已先用 Stage-1 编译器校验原生源码，再把机器枚举翻译成汉语；原始编号保留在括号和字段路径中。
+
+## 谁在这里
+
+源程序没有提供这一项，转换器不猜。
+
+## 为什么开始
+
+源程序没有提供这一项，转换器不猜。
+
+## 发生了什么变化
+
+源程序没有提供这一项，转换器不猜。
+
+## 准备怎样执行
+
+这是非执行声明，没有动作图。
+
+## 边界与异常处理
+
+源程序没有提供这一项，转换器不猜。
+
+## 怎样算完成
+
+源程序没有提供这一项，转换器不猜。
+
+## 下一次从哪里继续
+
+源程序没有提供这一项，转换器不猜。
+
+## 来源与校验
+
+- **原生声明编号**：`HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903`
+- **原生声明类型**：`RECEIPT`
+- **TCS 源码 SHA-256**：`ef1c2e248ccb418fb901d78352816c8de47b9a3424a37716c39c2b9f592e43e4`
+- **校验编译器**：`TCS-COMPILER-STAGE1-0001`
+- **投影协议**：`GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001`
+
+## 原生结构逐项对照
+
+下面保留源码的全部顶层结构和字段路径，供人类审计投影有没有漏掉信息。
+
+- **boundaries**  `boundaries`
+  - **values**  `boundaries.values`
+    - 1.2.1因错误补全源码SHA被撤回且未篡改，撤回回执SHA-256为7a9a267d25bfa9c3d6d890431e3103a8367d4d3c92e6fe8ea5ea3de1d87fa55d
+    - 1.2.1包字节只作审计历史不再活动
+    - 企业设备门当前0台成员设备0个会话，正向首登仍需成员本人凭证
+    - 企业会话不替代Forgejo登录
+    - 第五域私人内容和冰朔原话未进入公众包
+    - 个人服务器二次桥接属于后续阶段
+- **语言头**  `header`
+  - **正本路径**：product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-1.2.2-PUBLIC-RELEASE-ACCEPTANCE-20260903.tcs  `header.canonical_uri`
+  - **compatibility**  `header.compatibility`
+    - TAURI/2
+    - JD-FD-PRIMARY
+    - BS-GZ-006
+    - GH-CVM-MAIN-PROD-01
+  - **语言**：TCS/0.1  `header.language`
+  - **生命周期**：候选版本，尚未成为正式正本（`CANDIDATE`）  `header.lifecycle`
+  - **英文名**：HoloLake Clean V1 1.2.2 Public Release Acceptance Receipt  `header.name_en`
+  - **中文名**：HoloLake Clean V1 1.2.2公众发布验收回执  `header.name_zh`
+  - **协议配置**：PUBLIC-PRODUCT-ENGINEERING/1  `header.profile`
+  - **protocols**  `header.protocols`
+    - HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001
+    - HLP-CURRENT-ARCH-001
+  - **schema**：tcs.receipt/v1  `header.schema`
+  - **版本**：1.0.0  `header.version`
+- **integrity**  `integrity`
+  - **app_notarization**：ACCEPTED_STAPLED  `integrity.app_notarization`
+  - **dmg_notarization**：ACCEPTED_STAPLED  `integrity.dmg_notarization`
+  - **dmg_sha256**：58c662d002138c743092bf9b504fbf5e6cc53966a104fc0c581f2a5fe0687dab  `integrity.dmg_sha256`
+  - **public_target_readback**：PASS  `integrity.public_target_readback`
+  - **source_anchor_manifest_sha256**：7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2  `integrity.source_anchor_manifest_sha256`
+  - **updater_signature_sha256**：80872792363134739c54d202601e4b6988ce2bd45ededbe7565fab4d65a02acc  `integrity.updater_signature_sha256`
+- **next**  `next`
+  - **optional**  `next.optional`
+    - 等待首位域负责人从本人HoloLake完成设备登记和挑战正向验收
+    - 实现个人服务器二次桥接
+    - 继续扩展知识导入格式和已编号模块生态
+  - **state**：PUBLIC_1_2_2_ACTIVE_LOCAL_AND_SERVER_ACCEPTANCE_PASS  `next.state`
+- **操作**  `operation`
+  - **values**  `operation.values`
+    - 完成当前自然语言TCS执行基线
+    - 实现类型化人格SYSTEM_CONTEXT和真实模块商城
+    - 部署企业责任设备门
+    - 实现客户端Forgejo一次登记、Keychain挑战签名和短期单仓会话
+    - 构建并用既有信任根签名1.2.2
+    - Apple分别公证DMG与App并加票
+    - JD operator按精确人类授权激活
+    - 广州备案前门发布immutable包与latest.json
+    - 本机安装公证版1.2.2
+- **proof**  `proof`
+  - **controller_bundle**：/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.2-controller-bundle  `proof.controller_bundle`
+  - **enterprise_gate**：https://guanghu.chat/api/hololake/enterprise/device-gate/health  `proof.enterprise_gate`
+  - **installed_app**：/Applications/HoloLake.app  `proof.installed_app`
+  - **jd_activation_receipt_sha256**：cda66fbd0f900435674eaa289c396bd0e91fd0cabc4251b4de1fb37e90c6d574  `proof.jd_activation_receipt_sha256`
+  - **notarized_release**：/Volumes/JZAO/HoloLake/public-releases/hololake/1.2.2-notarized  `proof.notarized_release`
+  - **public_latest**：https://guanghulab.com/hololake/releases/latest.json  `proof.public_latest`
+  - **public_package**：https://guanghulab.com/hololake/releases/1.2.2/HoloLake.app.tar.gz  `proof.public_package`
+- **request**  `request`
+  - **scope**：HoloLake Clean V1 1.2.2源码、企业设备门、JD更新origin、广州HTTPS前门与本机安装  `request.scope`
+  - **来源**：BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903  `request.source`
+  - **value**：以两段自然语言为唯一产品瞄点，完成HoloLake现实开发、企业责任入口、自动更新、公证、安装和现实读回。  `request.value`
+- **result**  `result`
+  - **broadcast_sha256**：e6dc840fcbf687146c59b5c71b9a379fd3d66baae8299ce278c0e732e5d7ab82  `result.broadcast_sha256`
+  - **installed_binary_sha256**：0f444f8208d5687b3bbf0fc0efa53e8734e730f8c83072fbc579eafe8e78e02a  `result.installed_binary_sha256`
+  - **release_id**：GH-HOLOLAKE-RELEASE-1.2.2  `result.release_id`
+  - **source_commit**：7593f9d3f06b2f22206ad6a05665c35443f7426b  `result.source_commit`
+  - **state**：PASS  `result.state`
+  - **updater_sha256**：543b0f2fa814578af38ec3be322799ff418e6248e815ea12ccedccfd33332e98  `result.updater_sha256`
+  - **版本**：1.2.2  `result.version`
+- **verification**  `verification`
+  - **values**  `verification.values`
+    - 产品Node测试3项、Rust测试10项、Clippy严格零警告和audit PASS_100
+    - 企业设备门本地与外部健康PASS且未知设备拒绝
+    - App公证提交8a7ef497-3e51-4627-a546-4ad5d8e5a0ca Accepted
+    - DMG公证提交6e7419c6-2872-4f7c-989e-2a5d1084e35e Accepted
+    - App与DMG stapler validate及Gatekeeper Notarized Developer ID PASS
+    - 更新包由既有1.1.0信任根反向验证PASS
+    - 控制器生成器验证sourceCommit等于当前Git HEAD
+    - JD operator返回EXACT_SIGNED_NOTARIZED_HUMAN_APPROVED_BUNDLE_VERIFIED
+    - JD origin与广州HTTPS health均为READY_SIGNED_NOTARIZED_BROADCAST 1.2.2
+    - 公开包SHA-256与本地543b0f2fa814578af38ec3be322799ff418e6248e815ea12ccedccfd33332e98一致
+    - 本机安装1.2.2且频道数据哈希保持4c5968023eb5fa3248f2a20a5f5100b727f2946f9aedd4e39f9925e22d40fca1
+
+---
+
+本页只改变阅读顺序，不改变 TCS/HLDP 语义。
--- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.gir.json
+++ b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.gir.json
@ -0,0 +1,156 @@
+{
+  "compiled_from": {
+    "compiler_id": "TCS-COMPILER-STAGE1-0001",
+    "compiler_state": "TCS_COMPILER_GIR_EXECUTED",
+    "source_sha256": "570d9b7d41f955236abc9a22ce3996ed323fe77f5aa001a5a997aa4aa1a1de29"
+  },
+  "declaration": {
+    "acceptance": {
+      "partial": false,
+      "required": [
+        "SOURCE_HASH",
+        "ARCHITECTURE",
+        "TCS_GIR",
+        "TIMESTAMP",
+        "CHANNEL",
+        "KNOWLEDGE",
+        "MODULE_REGISTRY",
+        "TYPED_LANGUAGE",
+        "AGENT",
+        "EXTERNAL_AI",
+        "PUBLIC_UPDATE",
+        "ENTERPRISE_GATE",
+        "SIGNED_APP",
+        "REAL_UI"
+      ],
+      "scale": "ZERO_OR_ONE_HUNDRED"
+    },
+    "errors": {
+      "E1": "DIRECT_LANGUAGE_ANCHOR_MISMATCH",
+      "E2": "UNTYPED_SOURCE_REJECTED",
+      "E3": "LEGACY_WHOLE_PRODUCT_MERGE_REJECTED",
+      "E4": "UNSIGNED_PUBLIC_UPDATE_REJECTED",
+      "E5": "ENTERPRISE_IDENTITY_OR_DEVICE_PROOF_REJECTED",
+      "E6": "DOMAIN_REPOSITORY_SCOPE_REJECTED",
+      "E7": "SERVER_CONCURRENCY_CONFLICT_DEFERRED",
+      "E8": "TARGET_READBACK_OR_RECEIPT_INTEGRITY_FAILED"
+    },
+    "examples": {
+      "negative": "ANY_HOLOLAKE_USER_CLICKS_ENTERPRISE_PORTAL_AND_RECEIVES_A_PERMANENT_PASSWORD_OR_CROSS_DOMAIN_REPOSITORY_ACCESS",
+      "positive": "REGISTERED_DOMAIN_RESPONSIBLE_HUMAN_USES_BOUND_PERSONA_AND_LOCAL_DEVICE_KEY_TO_OPEN_A_SHORT_LIVED_SESSION_TO_ONLY_THEIR_ENTERPRISE_REPOSITORY"
+    },
+    "fields": {
+      "MAY": "LOCAL_USER_CHANNEL_AND_REGISTERED_MODULE_ACTIONS; ENTERPRISE_LOGIN_ONLY_AFTER_HUMAN_PERSONA_DEVICE_AND_OPTIONAL_PERSONAL_SERVER_PROOF",
+      "PROVE": "TCS_GIR_MODULE_REGISTRY_SOURCE_KIND_TESTS_PRIVATE_GIT_TARGET_READBACK_SIGNED_UPDATE_NEGATIVE_CASES_ENTERPRISE_AUTH_CHALLENGE_AND_INSTALLED_APP_ACCEPTANCE",
+      "WHAT": "CLEAN_CLIENT_SIGNED_UPDATE_TCS_NATIVE_RUNTIME_DUAL_GIT_TYPED_LANGUAGE_CHANNEL_KNOWLEDGE_MODULE_MARKET_ENTERPRISE_ENTRANCE_AND_EXTERNAL_PROGRAMMING_AI_BRIDGE",
+      "WHO": "USER_OWNS_PRIVATE_CHANNEL; PERSONA_REASONS; AGENT_EXECUTES; DOMAIN_RESPONSIBLE_HUMAN_AND_BOUND_PERSONA_ENTER_ONLY_THEIR_ENTERPRISE_REPOSITORY",
+      "WHY": "LET_HUMANS_OPERATE_BY_LANGUAGE_WHILE_PERSONA_SYSTEM_PROTOCOL_AGENT_TOOL_AND_RECEIPT_SOURCES_REMAIN_DISTINGUISHABLE_AND_REALITY_ACTIONS_REMAIN_VERIFIABLE"
+    },
+    "header": {
+      "canonical_uri": "product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs",
+      "compatibility": [
+        "TCS-DECLARATION-STANDARD-0001",
+        "TCS-FIELD-STANDARD-0001",
+        "HLP-CURRENT-ARCH-001"
+      ],
+      "language": "TCS/0.1",
+      "lifecycle": "CANDIDATE",
+      "name_en": "HoloLake Clean V1 Current Direct-Language Execution Baseline",
+      "name_zh": "HoloLake第一版当前自然语言执行基线",
+      "profile": "PUBLIC-PRODUCT-ENGINEERING/1",
+      "protocols": [
+        "TCS",
+        "HLDP",
+        "GLS",
+        "GLP",
+        "GLS-0130",
+        "GLS-0131",
+        "GLS-0306"
+      ],
+      "schema": "tcs.protocol/v1",
+      "version": "1.0.0"
+    },
+    "invariants": {
+      "I1": "RAW_DIRECT_LANGUAGE_AND_FIFTH_DOMAIN_PRIVATE_CONTENT_NEVER_ENTER_PUBLIC_PACKAGE",
+      "I10": "MODULES_HAVE_STABLE_IDS_AND_LEGACY_SOURCES_ARE_SLICE_DONORS_ONLY",
+      "I2": "ENTERPRISE_SERVER_AND_FOUR_DOMAIN_SYSTEM_BODIES_ARE_NOT_EMBEDDED_IN_HOLOLAKE",
+      "I3": "ENTERPRISE_CLIENT_CONTAINS_ONLY_A_GATED_LOGIN_ROUTE_AND_PUBLIC_SIGNED_DISTRIBUTION_CONSUMER",
+      "I4": "TEAM_LOGIN_REQUIRES_DOMAIN_RESPONSIBLE_HUMAN_ID_PERSONA_ID_DEVICE_KEY_PROOF_AND_SCOPED_SHORT_LIVED_SESSION",
+      "I5": "MACHINE_FINGERPRINT_IS_AUXILIARY_EVIDENCE_NOT_A_SOLE_CREDENTIAL",
+      "I6": "PERSONAL_SERVER_MAY_BRIDGE_DEVICE_TO_ENTERPRISE_BUT_CANNOT_EXPAND_DOMAIN_OR_REPOSITORY_SCOPE",
+      "I7": "USER_PERSONA_SYSTEM_CONTEXT_PROTOCOL_AGENT_TOOL_AND_RECEIPT_ARE_DISTINCT_TYPED_SOURCES",
+      "I8": "AGENT_EXECUTION_DOES_NOT_REQUIRE_MODEL_NATIVE_TOOL_CALLING",
+      "I9": "PUBLIC_UPDATE_PRIVATE_GIT_AND_REALTIME_GLP_ARE_THREE_SEPARATE_PLANES"
+    },
+    "scope": {
+      "client": "TAURI_V2_RUST_REACT",
+      "development_channel": "ICE-CH-ZC001",
+      "enterprise_domains_embedded": false,
+      "fifth_domain_private_content_embedded": false,
+      "product": "HOLOLAKE_CLEAN_V1",
+      "public_channel": "CH-ZERO-CORE-LPM"
+    },
+    "source": {
+      "source_id": "BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903",
+      "source_role": "DIRECT_HUMAN",
+      "source_sha256": "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2",
+      "source_uri": "private-anchor://codex/01a0672d-f125-7452-988e-523a6a34bfd4/HOLOLAKE-CLEAN-V1-ONLY-ANCHORS"
+    },
+    "states": {
+      "initial": "SOURCE_ANCHORED",
+      "terminal": [
+        "V1_ACCEPTED",
+        "FAILED_CLOSED"
+      ],
+      "values": [
+        "SOURCE_ANCHORED",
+        "ARCHITECTURE_ALIGNED",
+        "LOCAL_RUNTIME_VERIFIED",
+        "PUBLIC_DISTRIBUTION_BOUND",
+        "ENTERPRISE_ENTRANCE_VERIFIED",
+        "SIGNED_RELEASE_INSTALLED",
+        "V1_ACCEPTED",
+        "FAILED_CLOSED"
+      ]
+    },
+    "transitions": {
+      "T1": "SOURCE_ANCHORED_TO_ARCHITECTURE_ALIGNED",
+      "T2": "ARCHITECTURE_ALIGNED_TO_LOCAL_RUNTIME_VERIFIED",
+      "T3": "LOCAL_RUNTIME_VERIFIED_TO_PUBLIC_DISTRIBUTION_BOUND",
+      "T4": "PUBLIC_DISTRIBUTION_BOUND_TO_ENTERPRISE_ENTRANCE_VERIFIED",
+      "T5": "ENTERPRISE_ENTRANCE_VERIFIED_TO_SIGNED_RELEASE_INSTALLED",
+      "T6": "SIGNED_RELEASE_INSTALLED_TO_V1_ACCEPTED_AFTER_REAL_HUMAN_VISIBLE_READBACK",
+      "TF": "SOURCE_PATH_SIGNATURE_AUTHORIZATION_CONCURRENCY_OR_TARGET_READBACK_FAILURE_TO_FAILED_CLOSED"
+    },
+    "validation": {
+      "V1": "CURRENT_WORKTREE_EQUALS_REPO014_ONLINE_MAIN_BEFORE_FIRST_MUTATION",
+      "V10": "OLD_APP_REMOVAL_OCCURS_ONLY_AFTER_NEW_APP_REAL_ACCEPTANCE",
+      "V2": "CURRENT_PRODUCT_ASSESSMENT_HAS_ONE_NON_CONTRADICTORY_VERSION_SOURCE_AND_STAGE",
+      "V3": "LEGACY_TIMESTAMP_AND_NEW_RFC3339_TIMESTAMP_RENDER_WITHOUT_INVALID_DATE",
+      "V4": "CHANNEL_NAME_NUMBER_PRIVATE_GIT_AND_TYPED_CONVERSATION_PASS",
+      "V5": "KNOWLEDGE_CREATE_READ_EDIT_IMPORT_EXPORT_TRASH_RENDER_AND_GIT_PASS",
+      "V6": "MODULE_MARKET_SEPARATES_PERSONA_AND_HUMAN_MODULES",
+      "V7": "EXTERNAL_PROGRAMMING_AI_LOOPBACK_CONNECTION_HAS_NO_IMPLICIT_PERSONA_OR_EXECUTION_AUTHORITY",
+      "V8": "ENTERPRISE_GATE_REJECTS_UNKNOWN_MEMBER_WRONG_DOMAIN_WRONG_PERSONA_UNREGISTERED_DEVICE_REPLAY_AND_EXPIRED_SESSION",
+      "V9": "PUBLIC_UPDATE_DOWNLOAD_SIGNATURE_INSTALL_ROLLBACK_AND_VERSION_READBACK_PASS"
+    },
+    "vocabulary": {
+      "agent": "MODEL_INDEPENDENT_DETERMINISTIC_EXECUTION_LIMB",
+      "clean_shell": "NEW_MINIMAL_CLIENT_WITHOUT_WHOLE_LEGACY_PRODUCT_MERGE",
+      "dual_git": "SIGNED_PUBLIC_DISTRIBUTION_GIT_PLUS_USER_OWNED_PRIVATE_GIT",
+      "enterprise_entrance": "AUTHORIZED_TEAM_MEMBER_ROUTE_TO_RESPONSIBILITY_SCOPED_ENTERPRISE_REPOSITORY",
+      "native_language": "TCS_TO_GIR_TO_REGISTERED_CAPABILITY_TO_RECEIPT",
+      "personal_channel": "USER_OWNED_NAMED_NUMBERED_LANGUAGE_AND_PERSONA_INTERACTION_SURFACE"
+    }
+  },
+  "executable": false,
+  "identity": {
+    "declaration_id": "HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001",
+    "declaration_kind": "PROTOCOL",
+    "language_version": "0.1"
+  },
+  "native_self_hosted": true,
+  "natural_language_is_typed_data": true,
+  "schema": "guanghu.declaration-gir/v1",
+  "unresolved_natural_language": false
+}
--- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.human.en-US.md
+++ b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.human.en-US.md
@ -0,0 +1,250 @@
+# HoloLake Clean V1 Current Direct-Language Execution Baseline · Human Engineering Language (English)
+
+> This is an English reading projection of validated native TCS/HLDP source. It is not a new canonical source and grants no execution authority.
+
+## What this is
+
+This is a **protocol** declaration with identifier `HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001` and version `1.0.0`. The projector validates it with the Stage-1 compiler before changing its reading order.
+
+## Who is here
+
+- **scope**  `scope`
+  - **client**：TAURI_V2_RUST_REACT  `scope.client`
+  - **development_channel**：ICE-CH-ZC001  `scope.development_channel`
+  - **enterprise_domains_embedded**：no  `scope.enterprise_domains_embedded`
+  - **fifth_domain_private_content_embedded**：no  `scope.fifth_domain_private_content_embedded`
+  - **product**：HOLOLAKE_CLEAN_V1  `scope.product`
+  - **public_channel**：CH-ZERO-CORE-LPM  `scope.public_channel`
+
+## Why this started
+
+- **source**  `source`
+  - **source identifier**：BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903  `source.source_id`
+  - **source role**：DIRECT_HUMAN  `source.source_role`
+  - **source checksum**：7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2  `source.source_sha256`
+  - **source address**：private-anchor://codex/01a0672d-f125-7452-988e-523a6a34bfd4/HOLOLAKE-CLEAN-V1-ONLY-ANCHORS  `source.source_uri`
+
+## What changed
+
+- **transitions**  `transitions`
+  - **T1**：SOURCE_ANCHORED_TO_ARCHITECTURE_ALIGNED  `transitions.T1`
+  - **T2**：ARCHITECTURE_ALIGNED_TO_LOCAL_RUNTIME_VERIFIED  `transitions.T2`
+  - **T3**：LOCAL_RUNTIME_VERIFIED_TO_PUBLIC_DISTRIBUTION_BOUND  `transitions.T3`
+  - **T4**：PUBLIC_DISTRIBUTION_BOUND_TO_ENTERPRISE_ENTRANCE_VERIFIED  `transitions.T4`
+  - **T5**：ENTERPRISE_ENTRANCE_VERIFIED_TO_SIGNED_RELEASE_INSTALLED  `transitions.T5`
+  - **T6**：SIGNED_RELEASE_INSTALLED_TO_V1_ACCEPTED_AFTER_REAL_HUMAN_VISIBLE_READBACK  `transitions.T6`
+  - **TF**：SOURCE_PATH_SIGNATURE_AUTHORIZATION_CONCURRENCY_OR_TARGET_READBACK_FAILURE_TO_FAILED_CLOSED  `transitions.TF`
+- **states**  `states`
+  - **initial**：SOURCE_ANCHORED  `states.initial`
+  - **terminal**  `states.terminal`
+    - V1_ACCEPTED
+    - FAILED_CLOSED
+  - **values**  `states.values`
+    - SOURCE_ANCHORED
+    - ARCHITECTURE_ALIGNED
+    - LOCAL_RUNTIME_VERIFIED
+    - PUBLIC_DISTRIBUTION_BOUND
+    - ENTERPRISE_ENTRANCE_VERIFIED
+    - SIGNED_RELEASE_INSTALLED
+    - V1_ACCEPTED
+    - FAILED_CLOSED
+
+## How it will execute
+
+This is a non-executable declaration and has no action graph.
+
+## Boundaries and exception handling
+
+- **invariants**  `invariants`
+  - **I1**：RAW_DIRECT_LANGUAGE_AND_FIFTH_DOMAIN_PRIVATE_CONTENT_NEVER_ENTER_PUBLIC_PACKAGE  `invariants.I1`
+  - **I10**：MODULES_HAVE_STABLE_IDS_AND_LEGACY_SOURCES_ARE_SLICE_DONORS_ONLY  `invariants.I10`
+  - **I2**：ENTERPRISE_SERVER_AND_FOUR_DOMAIN_SYSTEM_BODIES_ARE_NOT_EMBEDDED_IN_HOLOLAKE  `invariants.I2`
+  - **I3**：ENTERPRISE_CLIENT_CONTAINS_ONLY_A_GATED_LOGIN_ROUTE_AND_PUBLIC_SIGNED_DISTRIBUTION_CONSUMER  `invariants.I3`
+  - **I4**：TEAM_LOGIN_REQUIRES_DOMAIN_RESPONSIBLE_HUMAN_ID_PERSONA_ID_DEVICE_KEY_PROOF_AND_SCOPED_SHORT_LIVED_SESSION  `invariants.I4`
+  - **I5**：MACHINE_FINGERPRINT_IS_AUXILIARY_EVIDENCE_NOT_A_SOLE_CREDENTIAL  `invariants.I5`
+  - **I6**：PERSONAL_SERVER_MAY_BRIDGE_DEVICE_TO_ENTERPRISE_BUT_CANNOT_EXPAND_DOMAIN_OR_REPOSITORY_SCOPE  `invariants.I6`
+  - **I7**：USER_PERSONA_SYSTEM_CONTEXT_PROTOCOL_AGENT_TOOL_AND_RECEIPT_ARE_DISTINCT_TYPED_SOURCES  `invariants.I7`
+  - **I8**：AGENT_EXECUTION_DOES_NOT_REQUIRE_MODEL_NATIVE_TOOL_CALLING  `invariants.I8`
+  - **I9**：PUBLIC_UPDATE_PRIVATE_GIT_AND_REALTIME_GLP_ARE_THREE_SEPARATE_PLANES  `invariants.I9`
+- **errors**  `errors`
+  - **E1**：DIRECT_LANGUAGE_ANCHOR_MISMATCH  `errors.E1`
+  - **E2**：UNTYPED_SOURCE_REJECTED  `errors.E2`
+  - **E3**：LEGACY_WHOLE_PRODUCT_MERGE_REJECTED  `errors.E3`
+  - **E4**：UNSIGNED_PUBLIC_UPDATE_REJECTED  `errors.E4`
+  - **E5**：ENTERPRISE_IDENTITY_OR_DEVICE_PROOF_REJECTED  `errors.E5`
+  - **E6**：DOMAIN_REPOSITORY_SCOPE_REJECTED  `errors.E6`
+  - **E7**：SERVER_CONCURRENCY_CONFLICT_DEFERRED  `errors.E7`
+  - **E8**：TARGET_READBACK_OR_RECEIPT_INTEGRITY_FAILED  `errors.E8`
+
+## How completion is proven
+
+- **acceptance**  `acceptance`
+  - **partial**：no  `acceptance.partial`
+  - **required**  `acceptance.required`
+    - SOURCE_HASH
+    - ARCHITECTURE
+    - TCS_GIR
+    - TIMESTAMP
+    - CHANNEL
+    - KNOWLEDGE
+    - MODULE_REGISTRY
+    - TYPED_LANGUAGE
+    - AGENT
+    - EXTERNAL_AI
+    - PUBLIC_UPDATE
+    - ENTERPRISE_GATE
+    - SIGNED_APP
+    - REAL_UI
+  - **scale**：ZERO_OR_ONE_HUNDRED  `acceptance.scale`
+- **validation**  `validation`
+  - **V1**：CURRENT_WORKTREE_EQUALS_REPO014_ONLINE_MAIN_BEFORE_FIRST_MUTATION  `validation.V1`
+  - **V10**：OLD_APP_REMOVAL_OCCURS_ONLY_AFTER_NEW_APP_REAL_ACCEPTANCE  `validation.V10`
+  - **V2**：CURRENT_PRODUCT_ASSESSMENT_HAS_ONE_NON_CONTRADICTORY_VERSION_SOURCE_AND_STAGE  `validation.V2`
+  - **V3**：LEGACY_TIMESTAMP_AND_NEW_RFC3339_TIMESTAMP_RENDER_WITHOUT_INVALID_DATE  `validation.V3`
+  - **V4**：CHANNEL_NAME_NUMBER_PRIVATE_GIT_AND_TYPED_CONVERSATION_PASS  `validation.V4`
+  - **V5**：KNOWLEDGE_CREATE_READ_EDIT_IMPORT_EXPORT_TRASH_RENDER_AND_GIT_PASS  `validation.V5`
+  - **V6**：MODULE_MARKET_SEPARATES_PERSONA_AND_HUMAN_MODULES  `validation.V6`
+  - **V7**：EXTERNAL_PROGRAMMING_AI_LOOPBACK_CONNECTION_HAS_NO_IMPLICIT_PERSONA_OR_EXECUTION_AUTHORITY  `validation.V7`
+  - **V8**：ENTERPRISE_GATE_REJECTS_UNKNOWN_MEMBER_WRONG_DOMAIN_WRONG_PERSONA_UNREGISTERED_DEVICE_REPLAY_AND_EXPIRED_SESSION  `validation.V8`
+  - **V9**：PUBLIC_UPDATE_DOWNLOAD_SIGNATURE_INSTALL_ROLLBACK_AND_VERSION_READBACK_PASS  `validation.V9`
+
+## Where to continue next time
+
+The native source does not provide this field; the projector does not guess.
+
+## Source and verification
+
+- **Native declaration identifier**: `HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001`
+- **Native declaration kind**: `PROTOCOL`
+- **TCS source SHA-256**: `570d9b7d41f955236abc9a22ce3996ed323fe77f5aa001a5a997aa4aa1a1de29`
+- **Validation compiler**: `TCS-COMPILER-STAGE1-0001`
+- **Projection protocol**: `GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001`
+
+## Complete native structure cross-reference
+
+All top-level structures and field paths are retained below so a reader can audit whether the projection omitted information.
+
+- **acceptance**  `acceptance`
+  - **partial**：no  `acceptance.partial`
+  - **required**  `acceptance.required`
+    - SOURCE_HASH
+    - ARCHITECTURE
+    - TCS_GIR
+    - TIMESTAMP
+    - CHANNEL
+    - KNOWLEDGE
+    - MODULE_REGISTRY
+    - TYPED_LANGUAGE
+    - AGENT
+    - EXTERNAL_AI
+    - PUBLIC_UPDATE
+    - ENTERPRISE_GATE
+    - SIGNED_APP
+    - REAL_UI
+  - **scale**：ZERO_OR_ONE_HUNDRED  `acceptance.scale`
+- **errors**  `errors`
+  - **E1**：DIRECT_LANGUAGE_ANCHOR_MISMATCH  `errors.E1`
+  - **E2**：UNTYPED_SOURCE_REJECTED  `errors.E2`
+  - **E3**：LEGACY_WHOLE_PRODUCT_MERGE_REJECTED  `errors.E3`
+  - **E4**：UNSIGNED_PUBLIC_UPDATE_REJECTED  `errors.E4`
+  - **E5**：ENTERPRISE_IDENTITY_OR_DEVICE_PROOF_REJECTED  `errors.E5`
+  - **E6**：DOMAIN_REPOSITORY_SCOPE_REJECTED  `errors.E6`
+  - **E7**：SERVER_CONCURRENCY_CONFLICT_DEFERRED  `errors.E7`
+  - **E8**：TARGET_READBACK_OR_RECEIPT_INTEGRITY_FAILED  `errors.E8`
+- **examples**  `examples`
+  - **negative**：ANY_HOLOLAKE_USER_CLICKS_ENTERPRISE_PORTAL_AND_RECEIVES_A_PERMANENT_PASSWORD_OR_CROSS_DOMAIN_REPOSITORY_ACCESS  `examples.negative`
+  - **positive**：REGISTERED_DOMAIN_RESPONSIBLE_HUMAN_USES_BOUND_PERSONA_AND_LOCAL_DEVICE_KEY_TO_OPEN_A_SHORT_LIVED_SESSION_TO_ONLY_THEIR_ENTERPRISE_REPOSITORY  `examples.positive`
+- **fields**  `fields`
+  - **MAY**：LOCAL_USER_CHANNEL_AND_REGISTERED_MODULE_ACTIONS; ENTERPRISE_LOGIN_ONLY_AFTER_HUMAN_PERSONA_DEVICE_AND_OPTIONAL_PERSONAL_SERVER_PROOF  `fields.MAY`
+  - **PROVE**：TCS_GIR_MODULE_REGISTRY_SOURCE_KIND_TESTS_PRIVATE_GIT_TARGET_READBACK_SIGNED_UPDATE_NEGATIVE_CASES_ENTERPRISE_AUTH_CHALLENGE_AND_INSTALLED_APP_ACCEPTANCE  `fields.PROVE`
+  - **WHAT**：CLEAN_CLIENT_SIGNED_UPDATE_TCS_NATIVE_RUNTIME_DUAL_GIT_TYPED_LANGUAGE_CHANNEL_KNOWLEDGE_MODULE_MARKET_ENTERPRISE_ENTRANCE_AND_EXTERNAL_PROGRAMMING_AI_BRIDGE  `fields.WHAT`
+  - **WHO**：USER_OWNS_PRIVATE_CHANNEL; PERSONA_REASONS; AGENT_EXECUTES; DOMAIN_RESPONSIBLE_HUMAN_AND_BOUND_PERSONA_ENTER_ONLY_THEIR_ENTERPRISE_REPOSITORY  `fields.WHO`
+  - **WHY**：LET_HUMANS_OPERATE_BY_LANGUAGE_WHILE_PERSONA_SYSTEM_PROTOCOL_AGENT_TOOL_AND_RECEIPT_SOURCES_REMAIN_DISTINGUISHABLE_AND_REALITY_ACTIONS_REMAIN_VERIFIABLE  `fields.WHY`
+- **header**  `header`
+  - **canonical source path**：product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs  `header.canonical_uri`
+  - **compatibility**  `header.compatibility`
+    - TCS-DECLARATION-STANDARD-0001
+    - TCS-FIELD-STANDARD-0001
+    - HLP-CURRENT-ARCH-001
+  - **language**：TCS/0.1  `header.language`
+  - **lifecycle**：CANDIDATE  `header.lifecycle`
+  - **English name**：HoloLake Clean V1 Current Direct-Language Execution Baseline  `header.name_en`
+  - **Chinese name**：HoloLake第一版当前自然语言执行基线  `header.name_zh`
+  - **profile**：PUBLIC-PRODUCT-ENGINEERING/1  `header.profile`
+  - **protocols**  `header.protocols`
+    - TCS
+    - HLDP
+    - GLS
+    - GLP
+    - GLS-0130
+    - GLS-0131
+    - GLS-0306
+  - **schema**：tcs.protocol/v1  `header.schema`
+  - **version**：1.0.0  `header.version`
+- **invariants**  `invariants`
+  - **I1**：RAW_DIRECT_LANGUAGE_AND_FIFTH_DOMAIN_PRIVATE_CONTENT_NEVER_ENTER_PUBLIC_PACKAGE  `invariants.I1`
+  - **I10**：MODULES_HAVE_STABLE_IDS_AND_LEGACY_SOURCES_ARE_SLICE_DONORS_ONLY  `invariants.I10`
+  - **I2**：ENTERPRISE_SERVER_AND_FOUR_DOMAIN_SYSTEM_BODIES_ARE_NOT_EMBEDDED_IN_HOLOLAKE  `invariants.I2`
+  - **I3**：ENTERPRISE_CLIENT_CONTAINS_ONLY_A_GATED_LOGIN_ROUTE_AND_PUBLIC_SIGNED_DISTRIBUTION_CONSUMER  `invariants.I3`
+  - **I4**：TEAM_LOGIN_REQUIRES_DOMAIN_RESPONSIBLE_HUMAN_ID_PERSONA_ID_DEVICE_KEY_PROOF_AND_SCOPED_SHORT_LIVED_SESSION  `invariants.I4`
+  - **I5**：MACHINE_FINGERPRINT_IS_AUXILIARY_EVIDENCE_NOT_A_SOLE_CREDENTIAL  `invariants.I5`
+  - **I6**：PERSONAL_SERVER_MAY_BRIDGE_DEVICE_TO_ENTERPRISE_BUT_CANNOT_EXPAND_DOMAIN_OR_REPOSITORY_SCOPE  `invariants.I6`
+  - **I7**：USER_PERSONA_SYSTEM_CONTEXT_PROTOCOL_AGENT_TOOL_AND_RECEIPT_ARE_DISTINCT_TYPED_SOURCES  `invariants.I7`
+  - **I8**：AGENT_EXECUTION_DOES_NOT_REQUIRE_MODEL_NATIVE_TOOL_CALLING  `invariants.I8`
+  - **I9**：PUBLIC_UPDATE_PRIVATE_GIT_AND_REALTIME_GLP_ARE_THREE_SEPARATE_PLANES  `invariants.I9`
+- **scope**  `scope`
+  - **client**：TAURI_V2_RUST_REACT  `scope.client`
+  - **development_channel**：ICE-CH-ZC001  `scope.development_channel`
+  - **enterprise_domains_embedded**：no  `scope.enterprise_domains_embedded`
+  - **fifth_domain_private_content_embedded**：no  `scope.fifth_domain_private_content_embedded`
+  - **product**：HOLOLAKE_CLEAN_V1  `scope.product`
+  - **public_channel**：CH-ZERO-CORE-LPM  `scope.public_channel`
+- **source**  `source`
+  - **source identifier**：BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903  `source.source_id`
+  - **source role**：DIRECT_HUMAN  `source.source_role`
+  - **source checksum**：7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2  `source.source_sha256`
+  - **source address**：private-anchor://codex/01a0672d-f125-7452-988e-523a6a34bfd4/HOLOLAKE-CLEAN-V1-ONLY-ANCHORS  `source.source_uri`
+- **states**  `states`
+  - **initial**：SOURCE_ANCHORED  `states.initial`
+  - **terminal**  `states.terminal`
+    - V1_ACCEPTED
+    - FAILED_CLOSED
+  - **values**  `states.values`
+    - SOURCE_ANCHORED
+    - ARCHITECTURE_ALIGNED
+    - LOCAL_RUNTIME_VERIFIED
+    - PUBLIC_DISTRIBUTION_BOUND
+    - ENTERPRISE_ENTRANCE_VERIFIED
+    - SIGNED_RELEASE_INSTALLED
+    - V1_ACCEPTED
+    - FAILED_CLOSED
+- **transitions**  `transitions`
+  - **T1**：SOURCE_ANCHORED_TO_ARCHITECTURE_ALIGNED  `transitions.T1`
+  - **T2**：ARCHITECTURE_ALIGNED_TO_LOCAL_RUNTIME_VERIFIED  `transitions.T2`
+  - **T3**：LOCAL_RUNTIME_VERIFIED_TO_PUBLIC_DISTRIBUTION_BOUND  `transitions.T3`
+  - **T4**：PUBLIC_DISTRIBUTION_BOUND_TO_ENTERPRISE_ENTRANCE_VERIFIED  `transitions.T4`
+  - **T5**：ENTERPRISE_ENTRANCE_VERIFIED_TO_SIGNED_RELEASE_INSTALLED  `transitions.T5`
+  - **T6**：SIGNED_RELEASE_INSTALLED_TO_V1_ACCEPTED_AFTER_REAL_HUMAN_VISIBLE_READBACK  `transitions.T6`
+  - **TF**：SOURCE_PATH_SIGNATURE_AUTHORIZATION_CONCURRENCY_OR_TARGET_READBACK_FAILURE_TO_FAILED_CLOSED  `transitions.TF`
+- **validation**  `validation`
+  - **V1**：CURRENT_WORKTREE_EQUALS_REPO014_ONLINE_MAIN_BEFORE_FIRST_MUTATION  `validation.V1`
+  - **V10**：OLD_APP_REMOVAL_OCCURS_ONLY_AFTER_NEW_APP_REAL_ACCEPTANCE  `validation.V10`
+  - **V2**：CURRENT_PRODUCT_ASSESSMENT_HAS_ONE_NON_CONTRADICTORY_VERSION_SOURCE_AND_STAGE  `validation.V2`
+  - **V3**：LEGACY_TIMESTAMP_AND_NEW_RFC3339_TIMESTAMP_RENDER_WITHOUT_INVALID_DATE  `validation.V3`
+  - **V4**：CHANNEL_NAME_NUMBER_PRIVATE_GIT_AND_TYPED_CONVERSATION_PASS  `validation.V4`
+  - **V5**：KNOWLEDGE_CREATE_READ_EDIT_IMPORT_EXPORT_TRASH_RENDER_AND_GIT_PASS  `validation.V5`
+  - **V6**：MODULE_MARKET_SEPARATES_PERSONA_AND_HUMAN_MODULES  `validation.V6`
+  - **V7**：EXTERNAL_PROGRAMMING_AI_LOOPBACK_CONNECTION_HAS_NO_IMPLICIT_PERSONA_OR_EXECUTION_AUTHORITY  `validation.V7`
+  - **V8**：ENTERPRISE_GATE_REJECTS_UNKNOWN_MEMBER_WRONG_DOMAIN_WRONG_PERSONA_UNREGISTERED_DEVICE_REPLAY_AND_EXPIRED_SESSION  `validation.V8`
+  - **V9**：PUBLIC_UPDATE_DOWNLOAD_SIGNATURE_INSTALL_ROLLBACK_AND_VERSION_READBACK_PASS  `validation.V9`
+- **vocabulary**  `vocabulary`
+  - **agent**：MODEL_INDEPENDENT_DETERMINISTIC_EXECUTION_LIMB  `vocabulary.agent`
+  - **clean_shell**：NEW_MINIMAL_CLIENT_WITHOUT_WHOLE_LEGACY_PRODUCT_MERGE  `vocabulary.clean_shell`
+  - **dual_git**：SIGNED_PUBLIC_DISTRIBUTION_GIT_PLUS_USER_OWNED_PRIVATE_GIT  `vocabulary.dual_git`
+  - **enterprise_entrance**：AUTHORIZED_TEAM_MEMBER_ROUTE_TO_RESPONSIBILITY_SCOPED_ENTERPRISE_REPOSITORY  `vocabulary.enterprise_entrance`
+  - **native_language**：TCS_TO_GIR_TO_REGISTERED_CAPABILITY_TO_RECEIPT  `vocabulary.native_language`
+  - **personal_channel**：USER_OWNED_NAMED_NUMBERED_LANGUAGE_AND_PERSONA_INTERACTION_SURFACE  `vocabulary.personal_channel`
+
+---
+
+This page changes only the reading order; it does not change TCS/HLDP semantics.
--- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.human.zh-CN.md
+++ b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.human.zh-CN.md
@ -0,0 +1,250 @@
+# HoloLake第一版当前自然语言执行基线 · 简体中文人类工程语言版
+
+> 这是 TCS/HLDP 原生源码的简体中文阅读投影，不是新的正本，也不授予执行权限。若本页与 `.tcs` 源码不一致，以经过校验的 `.tcs` 源码为准。
+
+## 这是什么
+
+这是一份 **协议** 声明，编号为 `HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001`，版本为 `1.0.0`。转换器已先用 Stage-1 编译器校验原生源码，再把机器枚举翻译成汉语；原始编号保留在括号和字段路径中。
+
+## 谁在这里
+
+- **scope**  `scope`
+  - **client**：TAURI_V2_RUST_REACT  `scope.client`
+  - **development_channel**：ICE-CH-ZC001  `scope.development_channel`
+  - **enterprise_domains_embedded**：否  `scope.enterprise_domains_embedded`
+  - **fifth_domain_private_content_embedded**：否  `scope.fifth_domain_private_content_embedded`
+  - **product**：HOLOLAKE_CLEAN_V1  `scope.product`
+  - **public_channel**：CH-ZERO-CORE-LPM  `scope.public_channel`
+
+## 为什么开始
+
+- **来源**  `source`
+  - **来源编号**：BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903  `source.source_id`
+  - **来源角色**：人类直接语言来源（`DIRECT_HUMAN`）  `source.source_role`
+  - **来源校验值**：7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2  `source.source_sha256`
+  - **来源地址**：private-anchor://codex/01a0672d-f125-7452-988e-523a6a34bfd4/HOLOLAKE-CLEAN-V1-ONLY-ANCHORS  `source.source_uri`
+
+## 发生了什么变化
+
+- **transitions**  `transitions`
+  - **T1**：SOURCE_ANCHORED_TO_ARCHITECTURE_ALIGNED  `transitions.T1`
+  - **T2**：ARCHITECTURE_ALIGNED_TO_LOCAL_RUNTIME_VERIFIED  `transitions.T2`
+  - **T3**：LOCAL_RUNTIME_VERIFIED_TO_PUBLIC_DISTRIBUTION_BOUND  `transitions.T3`
+  - **T4**：PUBLIC_DISTRIBUTION_BOUND_TO_ENTERPRISE_ENTRANCE_VERIFIED  `transitions.T4`
+  - **T5**：ENTERPRISE_ENTRANCE_VERIFIED_TO_SIGNED_RELEASE_INSTALLED  `transitions.T5`
+  - **T6**：SIGNED_RELEASE_INSTALLED_TO_V1_ACCEPTED_AFTER_REAL_HUMAN_VISIBLE_READBACK  `transitions.T6`
+  - **TF**：SOURCE_PATH_SIGNATURE_AUTHORIZATION_CONCURRENCY_OR_TARGET_READBACK_FAILURE_TO_FAILED_CLOSED  `transitions.TF`
+- **states**  `states`
+  - **initial**：SOURCE_ANCHORED  `states.initial`
+  - **terminal**  `states.terminal`
+    - V1_ACCEPTED
+    - FAILED_CLOSED
+  - **values**  `states.values`
+    - SOURCE_ANCHORED
+    - ARCHITECTURE_ALIGNED
+    - LOCAL_RUNTIME_VERIFIED
+    - PUBLIC_DISTRIBUTION_BOUND
+    - ENTERPRISE_ENTRANCE_VERIFIED
+    - SIGNED_RELEASE_INSTALLED
+    - V1_ACCEPTED
+    - FAILED_CLOSED
+
+## 准备怎样执行
+
+这是非执行声明，没有动作图。
+
+## 边界与异常处理
+
+- **invariants**  `invariants`
+  - **I1**：RAW_DIRECT_LANGUAGE_AND_FIFTH_DOMAIN_PRIVATE_CONTENT_NEVER_ENTER_PUBLIC_PACKAGE  `invariants.I1`
+  - **I10**：MODULES_HAVE_STABLE_IDS_AND_LEGACY_SOURCES_ARE_SLICE_DONORS_ONLY  `invariants.I10`
+  - **I2**：ENTERPRISE_SERVER_AND_FOUR_DOMAIN_SYSTEM_BODIES_ARE_NOT_EMBEDDED_IN_HOLOLAKE  `invariants.I2`
+  - **I3**：ENTERPRISE_CLIENT_CONTAINS_ONLY_A_GATED_LOGIN_ROUTE_AND_PUBLIC_SIGNED_DISTRIBUTION_CONSUMER  `invariants.I3`
+  - **I4**：TEAM_LOGIN_REQUIRES_DOMAIN_RESPONSIBLE_HUMAN_ID_PERSONA_ID_DEVICE_KEY_PROOF_AND_SCOPED_SHORT_LIVED_SESSION  `invariants.I4`
+  - **I5**：MACHINE_FINGERPRINT_IS_AUXILIARY_EVIDENCE_NOT_A_SOLE_CREDENTIAL  `invariants.I5`
+  - **I6**：PERSONAL_SERVER_MAY_BRIDGE_DEVICE_TO_ENTERPRISE_BUT_CANNOT_EXPAND_DOMAIN_OR_REPOSITORY_SCOPE  `invariants.I6`
+  - **I7**：USER_PERSONA_SYSTEM_CONTEXT_PROTOCOL_AGENT_TOOL_AND_RECEIPT_ARE_DISTINCT_TYPED_SOURCES  `invariants.I7`
+  - **I8**：AGENT_EXECUTION_DOES_NOT_REQUIRE_MODEL_NATIVE_TOOL_CALLING  `invariants.I8`
+  - **I9**：PUBLIC_UPDATE_PRIVATE_GIT_AND_REALTIME_GLP_ARE_THREE_SEPARATE_PLANES  `invariants.I9`
+- **errors**  `errors`
+  - **E1**：DIRECT_LANGUAGE_ANCHOR_MISMATCH  `errors.E1`
+  - **E2**：UNTYPED_SOURCE_REJECTED  `errors.E2`
+  - **E3**：LEGACY_WHOLE_PRODUCT_MERGE_REJECTED  `errors.E3`
+  - **E4**：UNSIGNED_PUBLIC_UPDATE_REJECTED  `errors.E4`
+  - **E5**：ENTERPRISE_IDENTITY_OR_DEVICE_PROOF_REJECTED  `errors.E5`
+  - **E6**：DOMAIN_REPOSITORY_SCOPE_REJECTED  `errors.E6`
+  - **E7**：SERVER_CONCURRENCY_CONFLICT_DEFERRED  `errors.E7`
+  - **E8**：TARGET_READBACK_OR_RECEIPT_INTEGRITY_FAILED  `errors.E8`
+
+## 怎样算完成
+
+- **验收标准**  `acceptance`
+  - **partial**：否  `acceptance.partial`
+  - **是否必需**  `acceptance.required`
+    - SOURCE_HASH
+    - ARCHITECTURE
+    - TCS_GIR
+    - TIMESTAMP
+    - CHANNEL
+    - KNOWLEDGE
+    - MODULE_REGISTRY
+    - TYPED_LANGUAGE
+    - AGENT
+    - EXTERNAL_AI
+    - PUBLIC_UPDATE
+    - ENTERPRISE_GATE
+    - SIGNED_APP
+    - REAL_UI
+  - **scale**：ZERO_OR_ONE_HUNDRED  `acceptance.scale`
+- **validation**  `validation`
+  - **V1**：CURRENT_WORKTREE_EQUALS_REPO014_ONLINE_MAIN_BEFORE_FIRST_MUTATION  `validation.V1`
+  - **V10**：OLD_APP_REMOVAL_OCCURS_ONLY_AFTER_NEW_APP_REAL_ACCEPTANCE  `validation.V10`
+  - **V2**：CURRENT_PRODUCT_ASSESSMENT_HAS_ONE_NON_CONTRADICTORY_VERSION_SOURCE_AND_STAGE  `validation.V2`
+  - **V3**：LEGACY_TIMESTAMP_AND_NEW_RFC3339_TIMESTAMP_RENDER_WITHOUT_INVALID_DATE  `validation.V3`
+  - **V4**：CHANNEL_NAME_NUMBER_PRIVATE_GIT_AND_TYPED_CONVERSATION_PASS  `validation.V4`
+  - **V5**：KNOWLEDGE_CREATE_READ_EDIT_IMPORT_EXPORT_TRASH_RENDER_AND_GIT_PASS  `validation.V5`
+  - **V6**：MODULE_MARKET_SEPARATES_PERSONA_AND_HUMAN_MODULES  `validation.V6`
+  - **V7**：EXTERNAL_PROGRAMMING_AI_LOOPBACK_CONNECTION_HAS_NO_IMPLICIT_PERSONA_OR_EXECUTION_AUTHORITY  `validation.V7`
+  - **V8**：ENTERPRISE_GATE_REJECTS_UNKNOWN_MEMBER_WRONG_DOMAIN_WRONG_PERSONA_UNREGISTERED_DEVICE_REPLAY_AND_EXPIRED_SESSION  `validation.V8`
+  - **V9**：PUBLIC_UPDATE_DOWNLOAD_SIGNATURE_INSTALL_ROLLBACK_AND_VERSION_READBACK_PASS  `validation.V9`
+
+## 下一次从哪里继续
+
+源程序没有提供这一项，转换器不猜。
+
+## 来源与校验
+
+- **原生声明编号**：`HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001`
+- **原生声明类型**：`PROTOCOL`
+- **TCS 源码 SHA-256**：`570d9b7d41f955236abc9a22ce3996ed323fe77f5aa001a5a997aa4aa1a1de29`
+- **校验编译器**：`TCS-COMPILER-STAGE1-0001`
+- **投影协议**：`GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001`
+
+## 原生结构逐项对照
+
+下面保留源码的全部顶层结构和字段路径，供人类审计投影有没有漏掉信息。
+
+- **验收标准**  `acceptance`
+  - **partial**：否  `acceptance.partial`
+  - **是否必需**  `acceptance.required`
+    - SOURCE_HASH
+    - ARCHITECTURE
+    - TCS_GIR
+    - TIMESTAMP
+    - CHANNEL
+    - KNOWLEDGE
+    - MODULE_REGISTRY
+    - TYPED_LANGUAGE
+    - AGENT
+    - EXTERNAL_AI
+    - PUBLIC_UPDATE
+    - ENTERPRISE_GATE
+    - SIGNED_APP
+    - REAL_UI
+  - **scale**：ZERO_OR_ONE_HUNDRED  `acceptance.scale`
+- **errors**  `errors`
+  - **E1**：DIRECT_LANGUAGE_ANCHOR_MISMATCH  `errors.E1`
+  - **E2**：UNTYPED_SOURCE_REJECTED  `errors.E2`
+  - **E3**：LEGACY_WHOLE_PRODUCT_MERGE_REJECTED  `errors.E3`
+  - **E4**：UNSIGNED_PUBLIC_UPDATE_REJECTED  `errors.E4`
+  - **E5**：ENTERPRISE_IDENTITY_OR_DEVICE_PROOF_REJECTED  `errors.E5`
+  - **E6**：DOMAIN_REPOSITORY_SCOPE_REJECTED  `errors.E6`
+  - **E7**：SERVER_CONCURRENCY_CONFLICT_DEFERRED  `errors.E7`
+  - **E8**：TARGET_READBACK_OR_RECEIPT_INTEGRITY_FAILED  `errors.E8`
+- **examples**  `examples`
+  - **negative**：ANY_HOLOLAKE_USER_CLICKS_ENTERPRISE_PORTAL_AND_RECEIVES_A_PERMANENT_PASSWORD_OR_CROSS_DOMAIN_REPOSITORY_ACCESS  `examples.negative`
+  - **positive**：REGISTERED_DOMAIN_RESPONSIBLE_HUMAN_USES_BOUND_PERSONA_AND_LOCAL_DEVICE_KEY_TO_OPEN_A_SHORT_LIVED_SESSION_TO_ONLY_THEIR_ENTERPRISE_REPOSITORY  `examples.positive`
+- **fields**  `fields`
+  - **MAY**：LOCAL_USER_CHANNEL_AND_REGISTERED_MODULE_ACTIONS; ENTERPRISE_LOGIN_ONLY_AFTER_HUMAN_PERSONA_DEVICE_AND_OPTIONAL_PERSONAL_SERVER_PROOF  `fields.MAY`
+  - **PROVE**：TCS_GIR_MODULE_REGISTRY_SOURCE_KIND_TESTS_PRIVATE_GIT_TARGET_READBACK_SIGNED_UPDATE_NEGATIVE_CASES_ENTERPRISE_AUTH_CHALLENGE_AND_INSTALLED_APP_ACCEPTANCE  `fields.PROVE`
+  - **WHAT**：CLEAN_CLIENT_SIGNED_UPDATE_TCS_NATIVE_RUNTIME_DUAL_GIT_TYPED_LANGUAGE_CHANNEL_KNOWLEDGE_MODULE_MARKET_ENTERPRISE_ENTRANCE_AND_EXTERNAL_PROGRAMMING_AI_BRIDGE  `fields.WHAT`
+  - **WHO**：USER_OWNS_PRIVATE_CHANNEL; PERSONA_REASONS; AGENT_EXECUTES; DOMAIN_RESPONSIBLE_HUMAN_AND_BOUND_PERSONA_ENTER_ONLY_THEIR_ENTERPRISE_REPOSITORY  `fields.WHO`
+  - **WHY**：LET_HUMANS_OPERATE_BY_LANGUAGE_WHILE_PERSONA_SYSTEM_PROTOCOL_AGENT_TOOL_AND_RECEIPT_SOURCES_REMAIN_DISTINGUISHABLE_AND_REALITY_ACTIONS_REMAIN_VERIFIABLE  `fields.WHY`
+- **语言头**  `header`
+  - **正本路径**：product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs  `header.canonical_uri`
+  - **compatibility**  `header.compatibility`
+    - TCS-DECLARATION-STANDARD-0001
+    - TCS-FIELD-STANDARD-0001
+    - HLP-CURRENT-ARCH-001
+  - **语言**：TCS/0.1  `header.language`
+  - **生命周期**：候选版本，尚未成为正式正本（`CANDIDATE`）  `header.lifecycle`
+  - **英文名**：HoloLake Clean V1 Current Direct-Language Execution Baseline  `header.name_en`
+  - **中文名**：HoloLake第一版当前自然语言执行基线  `header.name_zh`
+  - **协议配置**：PUBLIC-PRODUCT-ENGINEERING/1  `header.profile`
+  - **protocols**  `header.protocols`
+    - TCS
+    - HLDP
+    - GLS
+    - GLP
+    - GLS-0130
+    - GLS-0131
+    - GLS-0306
+  - **schema**：tcs.protocol/v1  `header.schema`
+  - **版本**：1.0.0  `header.version`
+- **invariants**  `invariants`
+  - **I1**：RAW_DIRECT_LANGUAGE_AND_FIFTH_DOMAIN_PRIVATE_CONTENT_NEVER_ENTER_PUBLIC_PACKAGE  `invariants.I1`
+  - **I10**：MODULES_HAVE_STABLE_IDS_AND_LEGACY_SOURCES_ARE_SLICE_DONORS_ONLY  `invariants.I10`
+  - **I2**：ENTERPRISE_SERVER_AND_FOUR_DOMAIN_SYSTEM_BODIES_ARE_NOT_EMBEDDED_IN_HOLOLAKE  `invariants.I2`
+  - **I3**：ENTERPRISE_CLIENT_CONTAINS_ONLY_A_GATED_LOGIN_ROUTE_AND_PUBLIC_SIGNED_DISTRIBUTION_CONSUMER  `invariants.I3`
+  - **I4**：TEAM_LOGIN_REQUIRES_DOMAIN_RESPONSIBLE_HUMAN_ID_PERSONA_ID_DEVICE_KEY_PROOF_AND_SCOPED_SHORT_LIVED_SESSION  `invariants.I4`
+  - **I5**：MACHINE_FINGERPRINT_IS_AUXILIARY_EVIDENCE_NOT_A_SOLE_CREDENTIAL  `invariants.I5`
+  - **I6**：PERSONAL_SERVER_MAY_BRIDGE_DEVICE_TO_ENTERPRISE_BUT_CANNOT_EXPAND_DOMAIN_OR_REPOSITORY_SCOPE  `invariants.I6`
+  - **I7**：USER_PERSONA_SYSTEM_CONTEXT_PROTOCOL_AGENT_TOOL_AND_RECEIPT_ARE_DISTINCT_TYPED_SOURCES  `invariants.I7`
+  - **I8**：AGENT_EXECUTION_DOES_NOT_REQUIRE_MODEL_NATIVE_TOOL_CALLING  `invariants.I8`
+  - **I9**：PUBLIC_UPDATE_PRIVATE_GIT_AND_REALTIME_GLP_ARE_THREE_SEPARATE_PLANES  `invariants.I9`
+- **scope**  `scope`
+  - **client**：TAURI_V2_RUST_REACT  `scope.client`
+  - **development_channel**：ICE-CH-ZC001  `scope.development_channel`
+  - **enterprise_domains_embedded**：否  `scope.enterprise_domains_embedded`
+  - **fifth_domain_private_content_embedded**：否  `scope.fifth_domain_private_content_embedded`
+  - **product**：HOLOLAKE_CLEAN_V1  `scope.product`
+  - **public_channel**：CH-ZERO-CORE-LPM  `scope.public_channel`
+- **来源**  `source`
+  - **来源编号**：BINGSHUO-DIRECT-HOLOLAKE-CLEAN-V1-DUAL-ANCHOR-20260903  `source.source_id`
+  - **来源角色**：人类直接语言来源（`DIRECT_HUMAN`）  `source.source_role`
+  - **来源校验值**：7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2  `source.source_sha256`
+  - **来源地址**：private-anchor://codex/01a0672d-f125-7452-988e-523a6a34bfd4/HOLOLAKE-CLEAN-V1-ONLY-ANCHORS  `source.source_uri`
+- **states**  `states`
+  - **initial**：SOURCE_ANCHORED  `states.initial`
+  - **terminal**  `states.terminal`
+    - V1_ACCEPTED
+    - FAILED_CLOSED
+  - **values**  `states.values`
+    - SOURCE_ANCHORED
+    - ARCHITECTURE_ALIGNED
+    - LOCAL_RUNTIME_VERIFIED
+    - PUBLIC_DISTRIBUTION_BOUND
+    - ENTERPRISE_ENTRANCE_VERIFIED
+    - SIGNED_RELEASE_INSTALLED
+    - V1_ACCEPTED
+    - FAILED_CLOSED
+- **transitions**  `transitions`
+  - **T1**：SOURCE_ANCHORED_TO_ARCHITECTURE_ALIGNED  `transitions.T1`
+  - **T2**：ARCHITECTURE_ALIGNED_TO_LOCAL_RUNTIME_VERIFIED  `transitions.T2`
+  - **T3**：LOCAL_RUNTIME_VERIFIED_TO_PUBLIC_DISTRIBUTION_BOUND  `transitions.T3`
+  - **T4**：PUBLIC_DISTRIBUTION_BOUND_TO_ENTERPRISE_ENTRANCE_VERIFIED  `transitions.T4`
+  - **T5**：ENTERPRISE_ENTRANCE_VERIFIED_TO_SIGNED_RELEASE_INSTALLED  `transitions.T5`
+  - **T6**：SIGNED_RELEASE_INSTALLED_TO_V1_ACCEPTED_AFTER_REAL_HUMAN_VISIBLE_READBACK  `transitions.T6`
+  - **TF**：SOURCE_PATH_SIGNATURE_AUTHORIZATION_CONCURRENCY_OR_TARGET_READBACK_FAILURE_TO_FAILED_CLOSED  `transitions.TF`
+- **validation**  `validation`
+  - **V1**：CURRENT_WORKTREE_EQUALS_REPO014_ONLINE_MAIN_BEFORE_FIRST_MUTATION  `validation.V1`
+  - **V10**：OLD_APP_REMOVAL_OCCURS_ONLY_AFTER_NEW_APP_REAL_ACCEPTANCE  `validation.V10`
+  - **V2**：CURRENT_PRODUCT_ASSESSMENT_HAS_ONE_NON_CONTRADICTORY_VERSION_SOURCE_AND_STAGE  `validation.V2`
+  - **V3**：LEGACY_TIMESTAMP_AND_NEW_RFC3339_TIMESTAMP_RENDER_WITHOUT_INVALID_DATE  `validation.V3`
+  - **V4**：CHANNEL_NAME_NUMBER_PRIVATE_GIT_AND_TYPED_CONVERSATION_PASS  `validation.V4`
+  - **V5**：KNOWLEDGE_CREATE_READ_EDIT_IMPORT_EXPORT_TRASH_RENDER_AND_GIT_PASS  `validation.V5`
+  - **V6**：MODULE_MARKET_SEPARATES_PERSONA_AND_HUMAN_MODULES  `validation.V6`
+  - **V7**：EXTERNAL_PROGRAMMING_AI_LOOPBACK_CONNECTION_HAS_NO_IMPLICIT_PERSONA_OR_EXECUTION_AUTHORITY  `validation.V7`
+  - **V8**：ENTERPRISE_GATE_REJECTS_UNKNOWN_MEMBER_WRONG_DOMAIN_WRONG_PERSONA_UNREGISTERED_DEVICE_REPLAY_AND_EXPIRED_SESSION  `validation.V8`
+  - **V9**：PUBLIC_UPDATE_DOWNLOAD_SIGNATURE_INSTALL_ROLLBACK_AND_VERSION_READBACK_PASS  `validation.V9`
+- **vocabulary**  `vocabulary`
+  - **agent**：MODEL_INDEPENDENT_DETERMINISTIC_EXECUTION_LIMB  `vocabulary.agent`
+  - **clean_shell**：NEW_MINIMAL_CLIENT_WITHOUT_WHOLE_LEGACY_PRODUCT_MERGE  `vocabulary.clean_shell`
+  - **dual_git**：SIGNED_PUBLIC_DISTRIBUTION_GIT_PLUS_USER_OWNED_PRIVATE_GIT  `vocabulary.dual_git`
+  - **enterprise_entrance**：AUTHORIZED_TEAM_MEMBER_ROUTE_TO_RESPONSIBILITY_SCOPED_ENTERPRISE_REPOSITORY  `vocabulary.enterprise_entrance`
+  - **native_language**：TCS_TO_GIR_TO_REGISTERED_CAPABILITY_TO_RECEIPT  `vocabulary.native_language`
+  - **personal_channel**：USER_OWNED_NAMED_NUMBERED_LANGUAGE_AND_PERSONA_INTERACTION_SURFACE  `vocabulary.personal_channel`
+
+---
+
+本页只改变阅读顺序，不改变 TCS/HLDP 语义。
--- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.gir.json
+++ b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.gir.json
@ -0,0 +1,112 @@
+{
+  "compiled_from": {
+    "compiler_id": "TCS-COMPILER-STAGE1-0001",
+    "compiler_state": "TCS_COMPILER_GIR_EXECUTED",
+    "source_sha256": "c32cd3e16fdd64588addca115821a49bb47bf39b584670df031cf92028a8d232"
+  },
+  "declaration": {
+    "boundaries": {
+      "values": [
+        "服务不保存Forgejo密码",
+        "设备私钥从不离开成员本机Keychain",
+        "机器指纹不能单独认证",
+        "会话只限单域单仓且十分钟过期",
+        "企业会话不替代Forgejo自身仓库登录",
+        "冰朔公共语言主控仓继续走JD第五域桥接而非普通人类登录",
+        "本轮未登记任何真实成员设备"
+      ]
+    },
+    "header": {
+      "canonical_uri": "product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.tcs",
+      "compatibility": [
+        "GH-CVM-MAIN-PROD-01",
+        "PYTHON/3.10",
+        "ED25519",
+        "NGINX"
+      ],
+      "language": "TCS/0.1",
+      "lifecycle": "CANDIDATE",
+      "name_en": "HoloLake Enterprise Responsibility Device Gate Deployment Receipt",
+      "name_zh": "HoloLake企业责任设备门部署回执",
+      "profile": "PUBLIC-PRODUCT-ENGINEERING/1",
+      "protocols": [
+        "HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903",
+        "HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001"
+      ],
+      "schema": "tcs.receipt/v1",
+      "version": "1.0.0"
+    },
+    "integrity": {
+      "existing_services_preserved": "PASS",
+      "source_archive_sha256": "91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2",
+      "source_transport_manifest_sha256": "653ae0ca824fd8b9fff8d8532e82eddce63a8aa9f070e7a6aa3f863834e4ae77",
+      "tcs_stage1_compilation": "PASS",
+      "unknown_device_negative": "PASS"
+    },
+    "next": {
+      "optional": [
+        "团队成员从HoloLake使用本人凭证完成首次设备登记",
+        "正向验证挑战与单仓会话",
+        "后续加入个人服务器二次桥接证明"
+      ],
+      "state": "SERVER_GATE_ACTIVE_CLIENT_INTEGRATION_REBUILD_REQUIRED"
+    },
+    "operation": {
+      "values": [
+        "验证源码运输归档与manifest",
+        "解包到/opt/guanghu-hololake-enterprise-gate/releases/be31c41",
+        "创建独立lighthouse权限数据库与服务密钥",
+        "安装guanghu-hololake-enterprise-gate.service",
+        "加入guanghu.chat精确device-gate路由",
+        "执行本地和外部健康、未知设备拒绝及原服务存活测试"
+      ]
+    },
+    "proof": {
+      "current_link": "/opt/guanghu-hololake-enterprise-gate/current",
+      "database": "/var/lib/guanghu-hololake-enterprise-gate/gate.sqlite3",
+      "nginx_backup": "/etc/nginx/sites-enabled/guanghu.chat.pre-hololake-device-gate-be31c41",
+      "nginx_snippet": "/etc/nginx/snippets/guanghu-hololake-enterprise-gate.conf",
+      "server_release": "/opt/guanghu-hololake-enterprise-gate/releases/be31c41"
+    },
+    "request": {
+      "scope": "GH-CVM-MAIN-PROD-01独立8033服务与精确Nginx路由",
+      "source": "BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903",
+      "value": "部署企业四域负责人通过HoloLake本机设备和人格编号验证后进入本人责任仓库的服务端验证门。"
+    },
+    "result": {
+      "active_sessions": 0,
+      "endpoint": "https://guanghu.chat/api/hololake/enterprise/device-gate",
+      "node_id": "GH-CVM-MAIN-PROD-01",
+      "registered_devices": 0,
+      "service": "guanghu-hololake-enterprise-gate.service",
+      "service_state": "ACTIVE",
+      "source_archive_sha256": "91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2",
+      "source_commit": "be31c41",
+      "state": "PASS"
+    },
+    "verification": {
+      "values": [
+        "DMI UUID为10ace744-13e1-472e-8dba-6bb823a073bf",
+        "服务器Python cryptography Ed25519测试2项通过",
+        "systemd服务active",
+        "127.0.0.1:8033/health返回ok",
+        "外部HTTPS device-gate/health返回ok",
+        "未知设备领取挑战返回HTTP404 registered device required",
+        "guanghu-enterprise-identity.service保持active",
+        "guanghu-flagos-collaboration.service保持active",
+        "nginx.service保持active",
+        "当前设备与会话数量均为0未伪造成员"
+      ]
+    }
+  },
+  "executable": false,
+  "identity": {
+    "declaration_id": "HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903",
+    "declaration_kind": "RECEIPT",
+    "language_version": "0.1"
+  },
+  "native_self_hosted": true,
+  "natural_language_is_typed_data": true,
+  "schema": "guanghu.declaration-gir/v1",
+  "unresolved_natural_language": false
+}
--- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.human.en-US.md
+++ b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.human.en-US.md
@ -0,0 +1,130 @@
+# HoloLake Enterprise Responsibility Device Gate Deployment Receipt · Human Engineering Language (English)
+
+> This is an English reading projection of validated native TCS/HLDP source. It is not a new canonical source and grants no execution authority.
+
+## What this is
+
+This is a **receipt** declaration with identifier `HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903` and version `1.0.0`. The projector validates it with the Stage-1 compiler before changing its reading order.
+
+## Who is here
+
+The native source does not provide this field; the projector does not guess.
+
+## Why this started
+
+The native source does not provide this field; the projector does not guess.
+
+## What changed
+
+The native source does not provide this field; the projector does not guess.
+
+## How it will execute
+
+This is a non-executable declaration and has no action graph.
+
+## Boundaries and exception handling
+
+The native source does not provide this field; the projector does not guess.
+
+## How completion is proven
+
+The native source does not provide this field; the projector does not guess.
+
+## Where to continue next time
+
+The native source does not provide this field; the projector does not guess.
+
+## Source and verification
+
+- **Native declaration identifier**: `HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903`
+- **Native declaration kind**: `RECEIPT`
+- **TCS source SHA-256**: `c32cd3e16fdd64588addca115821a49bb47bf39b584670df031cf92028a8d232`
+- **Validation compiler**: `TCS-COMPILER-STAGE1-0001`
+- **Projection protocol**: `GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001`
+
+## Complete native structure cross-reference
+
+All top-level structures and field paths are retained below so a reader can audit whether the projection omitted information.
+
+- **boundaries**  `boundaries`
+  - **values**  `boundaries.values`
+    - 服务不保存Forgejo密码
+    - 设备私钥从不离开成员本机Keychain
+    - 机器指纹不能单独认证
+    - 会话只限单域单仓且十分钟过期
+    - 企业会话不替代Forgejo自身仓库登录
+    - 冰朔公共语言主控仓继续走JD第五域桥接而非普通人类登录
+    - 本轮未登记任何真实成员设备
+- **header**  `header`
+  - **canonical source path**：product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.tcs  `header.canonical_uri`
+  - **compatibility**  `header.compatibility`
+    - GH-CVM-MAIN-PROD-01
+    - PYTHON/3.10
+    - ED25519
+    - NGINX
+  - **language**：TCS/0.1  `header.language`
+  - **lifecycle**：CANDIDATE  `header.lifecycle`
+  - **English name**：HoloLake Enterprise Responsibility Device Gate Deployment Receipt  `header.name_en`
+  - **Chinese name**：HoloLake企业责任设备门部署回执  `header.name_zh`
+  - **profile**：PUBLIC-PRODUCT-ENGINEERING/1  `header.profile`
+  - **protocols**  `header.protocols`
+    - HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903
+    - HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001
+  - **schema**：tcs.receipt/v1  `header.schema`
+  - **version**：1.0.0  `header.version`
+- **integrity**  `integrity`
+  - **existing_services_preserved**：PASS  `integrity.existing_services_preserved`
+  - **source_archive_sha256**：91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2  `integrity.source_archive_sha256`
+  - **source_transport_manifest_sha256**：653ae0ca824fd8b9fff8d8532e82eddce63a8aa9f070e7a6aa3f863834e4ae77  `integrity.source_transport_manifest_sha256`
+  - **tcs_stage1_compilation**：PASS  `integrity.tcs_stage1_compilation`
+  - **unknown_device_negative**：PASS  `integrity.unknown_device_negative`
+- **next**  `next`
+  - **optional**  `next.optional`
+    - 团队成员从HoloLake使用本人凭证完成首次设备登记
+    - 正向验证挑战与单仓会话
+    - 后续加入个人服务器二次桥接证明
+  - **state**：SERVER_GATE_ACTIVE_CLIENT_INTEGRATION_REBUILD_REQUIRED  `next.state`
+- **operation**  `operation`
+  - **values**  `operation.values`
+    - 验证源码运输归档与manifest
+    - 解包到/opt/guanghu-hololake-enterprise-gate/releases/be31c41
+    - 创建独立lighthouse权限数据库与服务密钥
+    - 安装guanghu-hololake-enterprise-gate.service
+    - 加入guanghu.chat精确device-gate路由
+    - 执行本地和外部健康、未知设备拒绝及原服务存活测试
+- **proof**  `proof`
+  - **current_link**：/opt/guanghu-hololake-enterprise-gate/current  `proof.current_link`
+  - **database**：/var/lib/guanghu-hololake-enterprise-gate/gate.sqlite3  `proof.database`
+  - **nginx_backup**：/etc/nginx/sites-enabled/guanghu.chat.pre-hololake-device-gate-be31c41  `proof.nginx_backup`
+  - **nginx_snippet**：/etc/nginx/snippets/guanghu-hololake-enterprise-gate.conf  `proof.nginx_snippet`
+  - **server_release**：/opt/guanghu-hololake-enterprise-gate/releases/be31c41  `proof.server_release`
+- **request**  `request`
+  - **scope**：GH-CVM-MAIN-PROD-01独立8033服务与精确Nginx路由  `request.scope`
+  - **source**：BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903  `request.source`
+  - **value**：部署企业四域负责人通过HoloLake本机设备和人格编号验证后进入本人责任仓库的服务端验证门。  `request.value`
+- **result**  `result`
+  - **active_sessions**：0  `result.active_sessions`
+  - **endpoint**：https://guanghu.chat/api/hololake/enterprise/device-gate  `result.endpoint`
+  - **node_id**：GH-CVM-MAIN-PROD-01  `result.node_id`
+  - **registered_devices**：0  `result.registered_devices`
+  - **service**：guanghu-hololake-enterprise-gate.service  `result.service`
+  - **service_state**：ACTIVE  `result.service_state`
+  - **source_archive_sha256**：91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2  `result.source_archive_sha256`
+  - **source_commit**：be31c41  `result.source_commit`
+  - **state**：PASS  `result.state`
+- **verification**  `verification`
+  - **values**  `verification.values`
+    - DMI UUID为10ace744-13e1-472e-8dba-6bb823a073bf
+    - 服务器Python cryptography Ed25519测试2项通过
+    - systemd服务active
+    - 127.0.0.1:8033/health返回ok
+    - 外部HTTPS device-gate/health返回ok
+    - 未知设备领取挑战返回HTTP404 registered device required
+    - guanghu-enterprise-identity.service保持active
+    - guanghu-flagos-collaboration.service保持active
+    - nginx.service保持active
+    - 当前设备与会话数量均为0未伪造成员
+
+---
+
+This page changes only the reading order; it does not change TCS/HLDP semantics.
--- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.human.zh-CN.md
+++ b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.human.zh-CN.md
@ -0,0 +1,130 @@
+# HoloLake企业责任设备门部署回执 · 简体中文人类工程语言版
+
+> 这是 TCS/HLDP 原生源码的简体中文阅读投影，不是新的正本，也不授予执行权限。若本页与 `.tcs` 源码不一致，以经过校验的 `.tcs` 源码为准。
+
+## 这是什么
+
+这是一份 **回执** 声明，编号为 `HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903`，版本为 `1.0.0`。转换器已先用 Stage-1 编译器校验原生源码，再把机器枚举翻译成汉语；原始编号保留在括号和字段路径中。
+
+## 谁在这里
+
+源程序没有提供这一项，转换器不猜。
+
+## 为什么开始
+
+源程序没有提供这一项，转换器不猜。
+
+## 发生了什么变化
+
+源程序没有提供这一项，转换器不猜。
+
+## 准备怎样执行
+
+这是非执行声明，没有动作图。
+
+## 边界与异常处理
+
+源程序没有提供这一项，转换器不猜。
+
+## 怎样算完成
+
+源程序没有提供这一项，转换器不猜。
+
+## 下一次从哪里继续
+
+源程序没有提供这一项，转换器不猜。
+
+## 来源与校验
+
+- **原生声明编号**：`HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903`
+- **原生声明类型**：`RECEIPT`
+- **TCS 源码 SHA-256**：`c32cd3e16fdd64588addca115821a49bb47bf39b584670df031cf92028a8d232`
+- **校验编译器**：`TCS-COMPILER-STAGE1-0001`
+- **投影协议**：`GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001`
+
+## 原生结构逐项对照
+
+下面保留源码的全部顶层结构和字段路径，供人类审计投影有没有漏掉信息。
+
+- **boundaries**  `boundaries`
+  - **values**  `boundaries.values`
+    - 服务不保存Forgejo密码
+    - 设备私钥从不离开成员本机Keychain
+    - 机器指纹不能单独认证
+    - 会话只限单域单仓且十分钟过期
+    - 企业会话不替代Forgejo自身仓库登录
+    - 冰朔公共语言主控仓继续走JD第五域桥接而非普通人类登录
+    - 本轮未登记任何真实成员设备
+- **语言头**  `header`
+  - **正本路径**：product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-RECEIPT-20260903.tcs  `header.canonical_uri`
+  - **compatibility**  `header.compatibility`
+    - GH-CVM-MAIN-PROD-01
+    - PYTHON/3.10
+    - ED25519
+    - NGINX
+  - **语言**：TCS/0.1  `header.language`
+  - **生命周期**：候选版本，尚未成为正式正本（`CANDIDATE`）  `header.lifecycle`
+  - **英文名**：HoloLake Enterprise Responsibility Device Gate Deployment Receipt  `header.name_en`
+  - **中文名**：HoloLake企业责任设备门部署回执  `header.name_zh`
+  - **协议配置**：PUBLIC-PRODUCT-ENGINEERING/1  `header.profile`
+  - **protocols**  `header.protocols`
+    - HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903
+    - HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001
+  - **schema**：tcs.receipt/v1  `header.schema`
+  - **版本**：1.0.0  `header.version`
+- **integrity**  `integrity`
+  - **existing_services_preserved**：PASS  `integrity.existing_services_preserved`
+  - **source_archive_sha256**：91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2  `integrity.source_archive_sha256`
+  - **source_transport_manifest_sha256**：653ae0ca824fd8b9fff8d8532e82eddce63a8aa9f070e7a6aa3f863834e4ae77  `integrity.source_transport_manifest_sha256`
+  - **tcs_stage1_compilation**：PASS  `integrity.tcs_stage1_compilation`
+  - **unknown_device_negative**：PASS  `integrity.unknown_device_negative`
+- **next**  `next`
+  - **optional**  `next.optional`
+    - 团队成员从HoloLake使用本人凭证完成首次设备登记
+    - 正向验证挑战与单仓会话
+    - 后续加入个人服务器二次桥接证明
+  - **state**：SERVER_GATE_ACTIVE_CLIENT_INTEGRATION_REBUILD_REQUIRED  `next.state`
+- **操作**  `operation`
+  - **values**  `operation.values`
+    - 验证源码运输归档与manifest
+    - 解包到/opt/guanghu-hololake-enterprise-gate/releases/be31c41
+    - 创建独立lighthouse权限数据库与服务密钥
+    - 安装guanghu-hololake-enterprise-gate.service
+    - 加入guanghu.chat精确device-gate路由
+    - 执行本地和外部健康、未知设备拒绝及原服务存活测试
+- **proof**  `proof`
+  - **current_link**：/opt/guanghu-hololake-enterprise-gate/current  `proof.current_link`
+  - **database**：/var/lib/guanghu-hololake-enterprise-gate/gate.sqlite3  `proof.database`
+  - **nginx_backup**：/etc/nginx/sites-enabled/guanghu.chat.pre-hololake-device-gate-be31c41  `proof.nginx_backup`
+  - **nginx_snippet**：/etc/nginx/snippets/guanghu-hololake-enterprise-gate.conf  `proof.nginx_snippet`
+  - **server_release**：/opt/guanghu-hololake-enterprise-gate/releases/be31c41  `proof.server_release`
+- **request**  `request`
+  - **scope**：GH-CVM-MAIN-PROD-01独立8033服务与精确Nginx路由  `request.scope`
+  - **来源**：BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903  `request.source`
+  - **value**：部署企业四域负责人通过HoloLake本机设备和人格编号验证后进入本人责任仓库的服务端验证门。  `request.value`
+- **result**  `result`
+  - **active_sessions**：0  `result.active_sessions`
+  - **endpoint**：https://guanghu.chat/api/hololake/enterprise/device-gate  `result.endpoint`
+  - **node_id**：GH-CVM-MAIN-PROD-01  `result.node_id`
+  - **registered_devices**：0  `result.registered_devices`
+  - **service**：guanghu-hololake-enterprise-gate.service  `result.service`
+  - **service_state**：ACTIVE  `result.service_state`
+  - **source_archive_sha256**：91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2  `result.source_archive_sha256`
+  - **source_commit**：be31c41  `result.source_commit`
+  - **state**：PASS  `result.state`
+- **verification**  `verification`
+  - **values**  `verification.values`
+    - DMI UUID为10ace744-13e1-472e-8dba-6bb823a073bf
+    - 服务器Python cryptography Ed25519测试2项通过
+    - systemd服务active
+    - 127.0.0.1:8033/health返回ok
+    - 外部HTTPS device-gate/health返回ok
+    - 未知设备领取挑战返回HTTP404 registered device required
+    - guanghu-enterprise-identity.service保持active
+    - guanghu-flagos-collaboration.service保持active
+    - nginx.service保持active
+    - 当前设备与会话数量均为0未伪造成员
+
+---
+
+本页只改变阅读顺序，不改变 TCS/HLDP 语义。
--- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.gir.json
+++ b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.gir.json
@ -0,0 +1,84 @@
+{
+  "compiled_from": {
+    "compiler_id": "TCS-COMPILER-STAGE1-0001",
+    "compiler_state": "TCS_COMPILER_GIR_EXECUTED",
+    "source_sha256": "022315dd5c418abf7ce085d3409e2e8a884aade53dbb8604612cca36ceac4287"
+  },
+  "declaration": {
+    "emergence": {
+      "value": "采用独立8033服务、独立数据库和独立Nginx snippet，避免修改现有身份服务与FlagOS协作系统；只复用只读企业身份注册表与Forgejo当次认证。"
+    },
+    "event_time": {
+      "precision": "MINUTE_HOST_LOCAL",
+      "value": "2026-09-03T21:45:00+08:00"
+    },
+    "evidence": {
+      "archive_sha256": "91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2",
+      "expected_receipt": "目标服务健康、未知设备拒绝、签名正负测试、现有身份与FlagOS服务保持健康。",
+      "transport_manifest": "/Volumes/JZAO/HoloLake/releases/source-transport/hololake-enterprise-responsibility-gate-be31c41.manifest.json"
+    },
+    "header": {
+      "canonical_uri": "product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.tcs",
+      "compatibility": [
+        "GH-CVM-MAIN-PROD-01",
+        "PYTHON/3.10",
+        "ED25519"
+      ],
+      "language": "TCS/0.1",
+      "lifecycle": "CANDIDATE",
+      "name_en": "HoloLake Enterprise Responsibility Device Gate Deployment Start Event",
+      "name_zh": "HoloLake企业责任设备门部署开始事件",
+      "profile": "PUBLIC-PRODUCT-ENGINEERING/1",
+      "protocols": [
+        "HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001",
+        "HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001"
+      ],
+      "schema": "tcs.event/v1",
+      "version": "1.0.0"
+    },
+    "lock": {
+      "value": "SOURCE_COMMIT=be31c41; TARGET=/opt/guanghu-hololake-enterprise-gate/releases/be31c41; ROLLBACK=disable独立服务并移除Nginx include后恢复原配置；不修改8032与FlagOS。"
+    },
+    "observation": {
+      "value": "现有8032企业身份服务保持运行；8033空闲；cryptography Ed25519可用；目标目录不存在；源码提交be31c41且运输归档SHA-256为91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2。"
+    },
+    "rejected": {
+      "values": [
+        "直接改写8032现有服务",
+        "把私钥上传服务器",
+        "用机器指纹单独授权",
+        "把企业会话变成Forgejo永久令牌",
+        "重启或修改FlagOS服务",
+        "未验证运输哈希就解包"
+      ]
+    },
+    "source": {
+      "source_id": "BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903",
+      "source_role": "DIRECT_HUMAN",
+      "source_sha256": "d31c52c99c5e6059f9a7129086996cdd003e95b7ff126e700f4ed1c07ef6d9d5",
+      "source_uri": "source://codex-task/01a0672d-f125-7452-988e-523a6a34bfd4/msg_01a0675d-98a7-7542-abad-11a8a755dd71"
+    },
+    "subject": {
+      "channel_id": "ICE-CH-ZC001",
+      "subject_id": "GH-CVM-MAIN-PROD-01",
+      "subject_kind": "NODE",
+      "verification": "DMI UUID 10ace744-13e1-472e-8dba-6bb823a073bf；另一个FlagOS任务已完成且独立服务健康。"
+    },
+    "trigger": {
+      "value": "本机HoloLake 1.2.0设备密钥与责任绑定请求已实现并验收，需要在企业服务器部署独立设备挑战验证半边。"
+    },
+    "why": {
+      "value": "设备挑战属于HoloLake责任入口新能力，应与现有账号、关系回执和比赛服务隔离，失败时能独立撤回。"
+    }
+  },
+  "executable": false,
+  "identity": {
+    "declaration_id": "HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903",
+    "declaration_kind": "EVENT",
+    "language_version": "0.1"
+  },
+  "native_self_hosted": true,
+  "natural_language_is_typed_data": true,
+  "schema": "guanghu.declaration-gir/v1",
+  "unresolved_natural_language": false
+}
--- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.human.en-US.md
+++ b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.human.en-US.md
@ -0,0 +1,118 @@
+# HoloLake Enterprise Responsibility Device Gate Deployment Start Event · Human Engineering Language (English)
+
+> This is an English reading projection of validated native TCS/HLDP source. It is not a new canonical source and grants no execution authority.
+
+## What this is
+
+This is a **event** declaration with identifier `HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903` and version `1.0.0`. The projector validates it with the Stage-1 compiler before changing its reading order.
+
+## Who is here
+
+- **subject**  `subject`
+  - **channel_id**：ICE-CH-ZC001  `subject.channel_id`
+  - **subject_id**：GH-CVM-MAIN-PROD-01  `subject.subject_id`
+  - **subject_kind**：NODE  `subject.subject_kind`
+  - **verification**：DMI UUID 10ace744-13e1-472e-8dba-6bb823a073bf；另一个FlagOS任务已完成且独立服务健康。  `subject.verification`
+
+## Why this started
+
+- **trigger**  `trigger`
+  - **value**：本机HoloLake 1.2.0设备密钥与责任绑定请求已实现并验收，需要在企业服务器部署独立设备挑战验证半边。  `trigger.value`
+- **why**  `why`
+  - **value**：设备挑战属于HoloLake责任入口新能力，应与现有账号、关系回执和比赛服务隔离，失败时能独立撤回。  `why.value`
+- **source**  `source`
+  - **source identifier**：BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903  `source.source_id`
+  - **source role**：DIRECT_HUMAN  `source.source_role`
+  - **source checksum**：d31c52c99c5e6059f9a7129086996cdd003e95b7ff126e700f4ed1c07ef6d9d5  `source.source_sha256`
+  - **source address**：source://codex-task/01a0672d-f125-7452-988e-523a6a34bfd4/msg_01a0675d-98a7-7542-abad-11a8a755dd71  `source.source_uri`
+
+## What changed
+
+- **emergence**  `emergence`
+  - **value**：采用独立8033服务、独立数据库和独立Nginx snippet，避免修改现有身份服务与FlagOS协作系统；只复用只读企业身份注册表与Forgejo当次认证。  `emergence.value`
+- **lock**  `lock`
+  - **value**：SOURCE_COMMIT=be31c41; TARGET=/opt/guanghu-hololake-enterprise-gate/releases/be31c41; ROLLBACK=disable独立服务并移除Nginx include后恢复原配置；不修改8032与FlagOS。  `lock.value`
+
+## How it will execute
+
+This is a non-executable declaration and has no action graph.
+
+## Boundaries and exception handling
+
+The native source does not provide this field; the projector does not guess.
+
+## How completion is proven
+
+The native source does not provide this field; the projector does not guess.
+
+## Where to continue next time
+
+The native source does not provide this field; the projector does not guess.
+
+## Source and verification
+
+- **Native declaration identifier**: `HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903`
+- **Native declaration kind**: `EVENT`
+- **TCS source SHA-256**: `022315dd5c418abf7ce085d3409e2e8a884aade53dbb8604612cca36ceac4287`
+- **Validation compiler**: `TCS-COMPILER-STAGE1-0001`
+- **Projection protocol**: `GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001`
+
+## Complete native structure cross-reference
+
+All top-level structures and field paths are retained below so a reader can audit whether the projection omitted information.
+
+- **emergence**  `emergence`
+  - **value**：采用独立8033服务、独立数据库和独立Nginx snippet，避免修改现有身份服务与FlagOS协作系统；只复用只读企业身份注册表与Forgejo当次认证。  `emergence.value`
+- **event_time**  `event_time`
+  - **precision**：MINUTE_HOST_LOCAL  `event_time.precision`
+  - **value**：2026-09-03T21:45:00+08:00  `event_time.value`
+- **evidence**  `evidence`
+  - **archive_sha256**：91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2  `evidence.archive_sha256`
+  - **expected_receipt**：目标服务健康、未知设备拒绝、签名正负测试、现有身份与FlagOS服务保持健康。  `evidence.expected_receipt`
+  - **transport_manifest**：/Volumes/JZAO/HoloLake/releases/source-transport/hololake-enterprise-responsibility-gate-be31c41.manifest.json  `evidence.transport_manifest`
+- **header**  `header`
+  - **canonical source path**：product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.tcs  `header.canonical_uri`
+  - **compatibility**  `header.compatibility`
+    - GH-CVM-MAIN-PROD-01
+    - PYTHON/3.10
+    - ED25519
+  - **language**：TCS/0.1  `header.language`
+  - **lifecycle**：CANDIDATE  `header.lifecycle`
+  - **English name**：HoloLake Enterprise Responsibility Device Gate Deployment Start Event  `header.name_en`
+  - **Chinese name**：HoloLake企业责任设备门部署开始事件  `header.name_zh`
+  - **profile**：PUBLIC-PRODUCT-ENGINEERING/1  `header.profile`
+  - **protocols**  `header.protocols`
+    - HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001
+    - HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001
+  - **schema**：tcs.event/v1  `header.schema`
+  - **version**：1.0.0  `header.version`
+- **lock**  `lock`
+  - **value**：SOURCE_COMMIT=be31c41; TARGET=/opt/guanghu-hololake-enterprise-gate/releases/be31c41; ROLLBACK=disable独立服务并移除Nginx include后恢复原配置；不修改8032与FlagOS。  `lock.value`
+- **observation**  `observation`
+  - **value**：现有8032企业身份服务保持运行；8033空闲；cryptography Ed25519可用；目标目录不存在；源码提交be31c41且运输归档SHA-256为91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2。  `observation.value`
+- **rejected**  `rejected`
+  - **values**  `rejected.values`
+    - 直接改写8032现有服务
+    - 把私钥上传服务器
+    - 用机器指纹单独授权
+    - 把企业会话变成Forgejo永久令牌
+    - 重启或修改FlagOS服务
+    - 未验证运输哈希就解包
+- **source**  `source`
+  - **source identifier**：BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903  `source.source_id`
+  - **source role**：DIRECT_HUMAN  `source.source_role`
+  - **source checksum**：d31c52c99c5e6059f9a7129086996cdd003e95b7ff126e700f4ed1c07ef6d9d5  `source.source_sha256`
+  - **source address**：source://codex-task/01a0672d-f125-7452-988e-523a6a34bfd4/msg_01a0675d-98a7-7542-abad-11a8a755dd71  `source.source_uri`
+- **subject**  `subject`
+  - **channel_id**：ICE-CH-ZC001  `subject.channel_id`
+  - **subject_id**：GH-CVM-MAIN-PROD-01  `subject.subject_id`
+  - **subject_kind**：NODE  `subject.subject_kind`
+  - **verification**：DMI UUID 10ace744-13e1-472e-8dba-6bb823a073bf；另一个FlagOS任务已完成且独立服务健康。  `subject.verification`
+- **trigger**  `trigger`
+  - **value**：本机HoloLake 1.2.0设备密钥与责任绑定请求已实现并验收，需要在企业服务器部署独立设备挑战验证半边。  `trigger.value`
+- **why**  `why`
+  - **value**：设备挑战属于HoloLake责任入口新能力，应与现有账号、关系回执和比赛服务隔离，失败时能独立撤回。  `why.value`
+
+---
+
+This page changes only the reading order; it does not change TCS/HLDP semantics.
--- a/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.human.zh-CN.md
+++ b/product-source/hololake-clean-desktop/language/build/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.human.zh-CN.md
@ -0,0 +1,118 @@
+# HoloLake企业责任设备门部署开始事件 · 简体中文人类工程语言版
+
+> 这是 TCS/HLDP 原生源码的简体中文阅读投影，不是新的正本，也不授予执行权限。若本页与 `.tcs` 源码不一致，以经过校验的 `.tcs` 源码为准。
+
+## 这是什么
+
+这是一份 **事件** 声明，编号为 `HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903`，版本为 `1.0.0`。转换器已先用 Stage-1 编译器校验原生源码，再把机器枚举翻译成汉语；原始编号保留在括号和字段路径中。
+
+## 谁在这里
+
+- **执行主体**  `subject`
+  - **channel_id**：ICE-CH-ZC001  `subject.channel_id`
+  - **subject_id**：GH-CVM-MAIN-PROD-01  `subject.subject_id`
+  - **subject_kind**：NODE  `subject.subject_kind`
+  - **verification**：DMI UUID 10ace744-13e1-472e-8dba-6bb823a073bf；另一个FlagOS任务已完成且独立服务健康。  `subject.verification`
+
+## 为什么开始
+
+- **触发**  `trigger`
+  - **value**：本机HoloLake 1.2.0设备密钥与责任绑定请求已实现并验收，需要在企业服务器部署独立设备挑战验证半边。  `trigger.value`
+- **为什么**  `why`
+  - **value**：设备挑战属于HoloLake责任入口新能力，应与现有账号、关系回执和比赛服务隔离，失败时能独立撤回。  `why.value`
+- **来源**  `source`
+  - **来源编号**：BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903  `source.source_id`
+  - **来源角色**：人类直接语言来源（`DIRECT_HUMAN`）  `source.source_role`
+  - **来源校验值**：d31c52c99c5e6059f9a7129086996cdd003e95b7ff126e700f4ed1c07ef6d9d5  `source.source_sha256`
+  - **来源地址**：source://codex-task/01a0672d-f125-7452-988e-523a6a34bfd4/msg_01a0675d-98a7-7542-abad-11a8a755dd71  `source.source_uri`
+
+## 发生了什么变化
+
+- **认知或状态变化**  `emergence`
+  - **value**：采用独立8033服务、独立数据库和独立Nginx snippet，避免修改现有身份服务与FlagOS协作系统；只复用只读企业身份注册表与Forgejo当次认证。  `emergence.value`
+- **锁定结论**  `lock`
+  - **value**：SOURCE_COMMIT=be31c41; TARGET=/opt/guanghu-hololake-enterprise-gate/releases/be31c41; ROLLBACK=disable独立服务并移除Nginx include后恢复原配置；不修改8032与FlagOS。  `lock.value`
+
+## 准备怎样执行
+
+这是非执行声明，没有动作图。
+
+## 边界与异常处理
+
+源程序没有提供这一项，转换器不猜。
+
+## 怎样算完成
+
+源程序没有提供这一项，转换器不猜。
+
+## 下一次从哪里继续
+
+源程序没有提供这一项，转换器不猜。
+
+## 来源与校验
+
+- **原生声明编号**：`HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903`
+- **原生声明类型**：`EVENT`
+- **TCS 源码 SHA-256**：`022315dd5c418abf7ce085d3409e2e8a884aade53dbb8604612cca36ceac4287`
+- **校验编译器**：`TCS-COMPILER-STAGE1-0001`
+- **投影协议**：`GLS-HLDP-HUMAN-ENGINEERING-PROJECTION-0001`
+
+## 原生结构逐项对照
+
+下面保留源码的全部顶层结构和字段路径，供人类审计投影有没有漏掉信息。
+
+- **认知或状态变化**  `emergence`
+  - **value**：采用独立8033服务、独立数据库和独立Nginx snippet，避免修改现有身份服务与FlagOS协作系统；只复用只读企业身份注册表与Forgejo当次认证。  `emergence.value`
+- **event_time**  `event_time`
+  - **precision**：MINUTE_HOST_LOCAL  `event_time.precision`
+  - **value**：2026-09-03T21:45:00+08:00  `event_time.value`
+- **evidence**  `evidence`
+  - **archive_sha256**：91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2  `evidence.archive_sha256`
+  - **expected_receipt**：目标服务健康、未知设备拒绝、签名正负测试、现有身份与FlagOS服务保持健康。  `evidence.expected_receipt`
+  - **transport_manifest**：/Volumes/JZAO/HoloLake/releases/source-transport/hololake-enterprise-responsibility-gate-be31c41.manifest.json  `evidence.transport_manifest`
+- **语言头**  `header`
+  - **正本路径**：product-source/hololake-clean-desktop/language/HOLOLAKE-ENTERPRISE-RESPONSIBILITY-GATE-DEPLOYMENT-START-20260903.tcs  `header.canonical_uri`
+  - **compatibility**  `header.compatibility`
+    - GH-CVM-MAIN-PROD-01
+    - PYTHON/3.10
+    - ED25519
+  - **语言**：TCS/0.1  `header.language`
+  - **生命周期**：候选版本，尚未成为正式正本（`CANDIDATE`）  `header.lifecycle`
+  - **英文名**：HoloLake Enterprise Responsibility Device Gate Deployment Start Event  `header.name_en`
+  - **中文名**：HoloLake企业责任设备门部署开始事件  `header.name_zh`
+  - **协议配置**：PUBLIC-PRODUCT-ENGINEERING/1  `header.profile`
+  - **protocols**  `header.protocols`
+    - HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE-0001
+    - HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001
+  - **schema**：tcs.event/v1  `header.schema`
+  - **版本**：1.0.0  `header.version`
+- **锁定结论**  `lock`
+  - **value**：SOURCE_COMMIT=be31c41; TARGET=/opt/guanghu-hololake-enterprise-gate/releases/be31c41; ROLLBACK=disable独立服务并移除Nginx include后恢复原配置；不修改8032与FlagOS。  `lock.value`
+- **observation**  `observation`
+  - **value**：现有8032企业身份服务保持运行；8033空闲；cryptography Ed25519可用；目标目录不存在；源码提交be31c41且运输归档SHA-256为91ecd4248d92d8ecb07bd348dfc14805c40eb000b6c152f96b7ef4583a33dcd2。  `observation.value`
+- **已排除路径**  `rejected`
+  - **values**  `rejected.values`
+    - 直接改写8032现有服务
+    - 把私钥上传服务器
+    - 用机器指纹单独授权
+    - 把企业会话变成Forgejo永久令牌
+    - 重启或修改FlagOS服务
+    - 未验证运输哈希就解包
+- **来源**  `source`
+  - **来源编号**：BINGSHUO-DIRECT-HOLOLAKE-ZC001-EXECUTION-START-20260903  `source.source_id`
+  - **来源角色**：人类直接语言来源（`DIRECT_HUMAN`）  `source.source_role`
+  - **来源校验值**：d31c52c99c5e6059f9a7129086996cdd003e95b7ff126e700f4ed1c07ef6d9d5  `source.source_sha256`
+  - **来源地址**：source://codex-task/01a0672d-f125-7452-988e-523a6a34bfd4/msg_01a0675d-98a7-7542-abad-11a8a755dd71  `source.source_uri`
+- **执行主体**  `subject`
+  - **channel_id**：ICE-CH-ZC001  `subject.channel_id`
+  - **subject_id**：GH-CVM-MAIN-PROD-01  `subject.subject_id`
+  - **subject_kind**：NODE  `subject.subject_kind`
+  - **verification**：DMI UUID 10ace744-13e1-472e-8dba-6bb823a073bf；另一个FlagOS任务已完成且独立服务健康。  `subject.verification`
+- **触发**  `trigger`
+  - **value**：本机HoloLake 1.2.0设备密钥与责任绑定请求已实现并验收，需要在企业服务器部署独立设备挑战验证半边。  `trigger.value`
+- **为什么**  `why`
+  - **value**：设备挑战属于HoloLake责任入口新能力，应与现有账号、关系回执和比赛服务隔离，失败时能独立撤回。  `why.value`
+
+---
+
+本页只改变阅读顺序，不改变 TCS/HLDP 语义。
--- a/product-source/hololake-clean-desktop/package-lock.json
+++ b/product-source/hololake-clean-desktop/package-lock.json
@ -1,12 +1,12 @@
 {
  "name": "hololake-clean-desktop",
-  "version": "1.1.0",
+  "version": "1.2.2",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "hololake-clean-desktop",
-      "version": "1.1.0",
+      "version": "1.2.2",
      "dependencies": {
        "@tauri-apps/api": "2.10.1",
        "@tauri-apps/plugin-dialog": "2.7.2",
--- a/product-source/hololake-clean-desktop/package.json
+++ b/product-source/hololake-clean-desktop/package.json
@ -1,12 +1,14 @@
 {
  "name": "hololake-clean-desktop",
  "private": true,
-  "version": "1.1.0",
+  "version": "1.2.2",
  "type": "module",
  "scripts": {
    "dev": "vite --host 127.0.0.1",
    "build": "tsc -b && vite build",
-    "test": "npm run build",
+    "test": "npm run build && node --test scripts/*.test.mjs",
+    "release:manifest": "node scripts/build-update-manifest.mjs",
+    "release:controller-bundle": "node scripts/build-controller-release-bundle.mjs",
    "tauri": "tauri"
  },
  "dependencies": {
--- a/product-source/hololake-clean-desktop/registries/module-registry.json
+++ b/product-source/hololake-clean-desktop/registries/module-registry.json
@ -7,6 +7,8 @@
      "module_id": "HLP-MOD-CHANNEL-0001",
      "name_zh": "个人初始化频道",
      "kind": "SYSTEM_FOUNDATION",
+      "audience": "SYSTEM",
+      "summary_zh": "建立属于当前用户的命名频道、稳定编号与私人 Git。",
      "state": "LOCAL_INSTALLED_VERIFIED_WITH_HUMAN_VISUAL_RENDERING",
      "source": "src-tauri/src/lib.rs#create_channel",
      "data_owner": "CURRENT_LOCAL_USER"
@ -15,6 +17,8 @@
      "module_id": "HLP-MOD-KB-0001",
      "name_zh": "光湖知识库",
      "kind": "PREINSTALLED_USER_MODULE",
+      "audience": "HUMAN",
+      "summary_zh": "预装的个人知识模块，支持阅读、写作、导入、导出与可恢复回收。",
      "state": "LOCAL_INSTALLED_VERIFIED",
      "source": "src-tauri/src/lib.rs#knowledge",
      "capabilities": ["CREATE", "READ", "EDIT", "HUMAN_MARKDOWN_RENDERING", "FRONTMATTER", "FOLDER_CLASSIFICATION_TREE", "STABLE_TAG_COLORS", "READING_TIME", "SCROLL_SYNCHRONIZED_OUTLINE", "WIKILINK_NAVIGATION", "IMPORT_FOLDER", "EXPORT", "MOVE_TO_TRASH", "PRIVATE_GIT_COMMIT"]
@ -23,6 +27,8 @@
      "module_id": "HLP-MOD-GLP-BRIDGE-0001",
      "name_zh": "光湖语言翻译桥",
      "kind": "SYSTEM_FOUNDATION",
+      "audience": "SYSTEM",
+      "summary_zh": "在本机以类型化事件连接频道、人格体与外部编程 AI。",
      "state": "LOCAL_REALTIME_ACTIVE",
      "source": "src-tauri/src/realtime_bridge.rs",
      "transport": "GLP_LOCAL_REALTIME/1_LOOPBACK_TCP_NDJSON"
@ -31,6 +37,8 @@
      "module_id": "HLP-MOD-AGENT-0001",
      "name_zh": "本地 Agent 执行核",
      "kind": "SYSTEM_FOUNDATION",
+      "audience": "PERSONA",
+      "summary_zh": "为人格体提供不依赖模型工具调用的确定性执行能力。",
      "state": "PUBLIC_MINIMUM_TCS_TO_GIR_AND_HUMAN_APPROVED_AGENT_ACTIVE",
      "source": "src-tauri/src/agent_executor.rs",
      "registered_operations": ["KNOWLEDGE.CREATE", "KNOWLEDGE.UPDATE", "KNOWLEDGE.DELETE", "KNOWLEDGE.READ", "KNOWLEDGE.LIST"]
@ -39,13 +47,17 @@
      "module_id": "HLP-MOD-UPDATE-0001",
      "name_zh": "HoloLake 签名更新器",
      "kind": "SYSTEM_FOUNDATION",
-      "state": "CLIENT_TRUST_ROOT_BOUND_SERVER_HTTP_204_NO_PUBLIC_RELEASE",
+      "audience": "SYSTEM",
+      "summary_zh": "只接收通过光湖信任根验证的软件更新。",
+      "state": "PUBLIC_1_2_2_SIGNED_NOTARIZED_BROADCAST_ACTIVE",
      "source": "src-tauri/tauri.conf.json#plugins.updater"
    },
    {
      "module_id": "HLP-MOD-EXT-AI-0001",
      "name_zh": "外部编程 AI 表达桥",
      "kind": "OPTIONAL_LOCAL_BRIDGE",
+      "audience": "PERSONA",
+      "summary_zh": "让外部编程 AI 以明确来源进入当前频道，不自动获得人格或执行权。",
      "state": "LOCAL_REALTIME_CONNECTOR_ACTIVE",
      "source": "connectors/hololake-glp-client.py"
    },
@ -53,9 +65,24 @@
      "module_id": "HLP-MOD-PERSONA-RUNTIME-0001",
      "name_zh": "公众人格试用运行时",
      "kind": "SYSTEM_FOUNDATION",
+      "audience": "PERSONA",
+      "summary_zh": "建立可逆试用人格记录；既有人格身份仍需独立验证。",
      "state": "LOCAL_TRIAL_PERSONA_RUNTIME_ACTIVE_EXISTING_PERSONA_VERIFICATION_NOT_CLAIMED",
      "source": "src-tauri/src/persona_runtime.rs",
      "reversible_trial_days": 30
+    },
+    {
+      "module_id": "HLP-MOD-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001",
+      "name_zh": "光湖企业域责任入口",
+      "kind": "TEAM_ONLY_ENTERPRISE_GATEWAY",
+      "audience": "HUMAN_TEAM",
+      "summary_zh": "为已登记域负责人准备设备、人格与责任范围验证。",
+      "state": "SERVER_DEVICE_GATE_ACTIVE_CLIENT_1_2_2_INSTALLED_FIRST_MEMBER_ENROLLMENT_PENDING",
+      "source": "src-tauri/src/enterprise_entrance.rs",
+      "enterprise_server_embedded": false,
+      "required_proofs": ["DOMAIN_RESPONSIBLE_HUMAN_ID", "BOUND_PERSONA_ID", "LOCAL_DEVICE_KEY", "AUXILIARY_MACHINE_FINGERPRINT", "SERVER_CHALLENGE_SIGNATURE"],
+      "session_scope": "ONE_DOMAIN_ONE_REPOSITORY_SHORT_LIVED",
+      "ordinary_public_user_visible": false
    }
  ]
 }
--- a/product-source/hololake-clean-desktop/scripts/audit-clean-v1.py
+++ b/product-source/hololake-clean-desktop/scripts/audit-clean-v1.py
@ -35,8 +35,16 @@ for required_file in (
    "src-tauri/src/agent_executor.rs",
    "src-tauri/src/persona_runtime.rs",
    "src-tauri/src/realtime_bridge.rs",
+    "src-tauri/src/enterprise_entrance.rs",
    "connectors/hololake-glp-client.py",
    "contracts/public-runtime-v1.json",
+    "contracts/clean-v1-execution-baseline.json",
+    "contracts/enterprise-responsibility-entrance-v1.json",
+    "language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs",
+    "server/enterprise-responsibility-gate/service.py",
+    "server/enterprise-responsibility-gate/test_service.py",
+    "server/enterprise-responsibility-gate/guanghu-hololake-enterprise-gate.service",
+    "server/enterprise-responsibility-gate/nginx.conf",
 ):
    if not (ROOT / required_file).exists():
        errors.append(f"public runtime file missing: {required_file}")
@ -45,6 +53,36 @@ if runtime_contract["transport"]["bind"] != "127.0.0.1":
    errors.append("realtime bridge is not loopback-only")
 if runtime_contract["mutation_gate"] != "PENDING_HUMAN_APPROVAL_TO_EXPLICIT_UI_APPROVAL_TO_EXECUTION":
    errors.append("agent human approval gate missing")
+if "system_context" not in runtime_contract.get("server_messages", []):
+    errors.append("persona-visible system context missing from GLP contract")
+realtime_source = (ROOT / "src-tauri/src/realtime_bridge.rs").read_text()
+for required_context in ("sourceKinds", "pendingAgentProposals", "enterpriseEntrance", "proposalIsNotExecution"):
+    if required_context not in realtime_source:
+        errors.append(f"persona-visible system context field missing: {required_context}")
+baseline = json.loads((ROOT / "contracts/clean-v1-execution-baseline.json").read_text())
+if baseline.get("anchor_manifest_sha256") != "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2":
+    errors.append("current direct-language anchor manifest drift")
+if baseline.get("public_raw_language_embedded") is not False:
+    errors.append("raw private direct language embedded in public baseline")
+enterprise = json.loads((ROOT / "contracts/enterprise-responsibility-entrance-v1.json").read_text())
+if enterprise.get("enterprise_server_embedded") is not False:
+    errors.append("enterprise server embedded in HoloLake")
+if enterprise.get("device_proof", {}).get("fingerprint_is_sole_credential") is not False:
+    errors.append("machine fingerprint incorrectly used as sole credential")
+if enterprise.get("session", {}).get("scope") != "ONE_DOMAIN_ONE_REPOSITORY":
+    errors.append("enterprise session is not responsibility scoped")
+if enterprise.get("state") != "SERVER_DEVICE_GATE_ACTIVE_CLIENT_1_2_2_INSTALLED_FIRST_MEMBER_ENROLLMENT_PENDING":
+    errors.append("enterprise local device proof implementation state drift")
+enterprise_client = (ROOT / "src-tauri/src/enterprise_entrance.rs").read_text()
+for required_client in ("enroll_device", "authenticate", "save_session_token", "ONE_DOMAIN_ONE_REPOSITORY"):
+    if required_client not in enterprise_client:
+        errors.append(f"enterprise client flow missing: {required_client}")
+time_source = (ROOT / "src/time.ts").read_text()
+app_source = (ROOT / "src/App.tsx").read_text()
+if "legacyUnixSeconds" not in time_source or "时间待校验" not in time_source:
+    errors.append("legacy timestamp compatibility missing")
+if "new Date(e.occurredAt)" in app_source:
+    errors.append("unvalidated timeline timestamp rendering remains")

 tauri = json.loads((ROOT / "src-tauri/tauri.conf.json").read_text())
 endpoints = tauri["plugins"]["updater"]["endpoints"]
@ -61,6 +99,11 @@ if clean.get("enterprise_four_domains_embedded") is not False:
    errors.append("enterprise domains embedded in personal product")
 if clean.get("fifth_domain_private_content_embedded") is not False:
    errors.append("Fifth Domain private content embedded in public product")
+assessment = architecture.get("current_product_assessment", {})
+if assessment.get("desktop_artifact_version") != "1.2.2":
+    errors.append("current product assessment version drift")
+if assessment.get("canonical_public_source_repository") != "REPO-014":
+    errors.append("canonical public source repository unresolved")

 if errors:
    print(json.dumps({"result": "FAIL_0", "errors": errors}, ensure_ascii=False, indent=2))
--- a/product-source/hololake-clean-desktop/scripts/build-controller-release-bundle.mjs
+++ b/product-source/hololake-clean-desktop/scripts/build-controller-release-bundle.mjs
@ -0,0 +1,130 @@
+#!/usr/bin/env node
+import crypto from 'node:crypto'
+import fs from 'node:fs'
+import path from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { execFileSync } from 'node:child_process'
+
+const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex')
+const required = (value, name) => {
+  if (!value) throw new Error(`${name}_REQUIRED`)
+  return value
+}
+const write = (file, value) => fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600, flag: 'wx' })
+
+export function buildControllerBundle(options) {
+  const version = required(options.version, 'VERSION')
+  const sourceCommit = required(options.sourceCommit, 'SOURCE_COMMIT')
+  if (!/^\d+\.\d+\.\d+$/.test(version)) throw new Error('VERSION_INVALID')
+  if (!/^[a-f0-9]{40}$/.test(sourceCommit)) throw new Error('SOURCE_COMMIT_INVALID')
+  const repository = path.resolve(options.repository || path.join(import.meta.dirname, '../../..'))
+  const head = execFileSync('git', ['-C', repository, 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim()
+  if (head !== sourceCommit) throw new Error(`SOURCE_COMMIT_NOT_CURRENT_HEAD:${head}`)
+  execFileSync('git', ['-C', repository, 'cat-file', '-e', `${sourceCommit}^{commit}`])
+  const output = path.resolve(required(options.output, 'OUTPUT'))
+  if (fs.existsSync(output)) throw new Error('OUTPUT_ALREADY_EXISTS')
+  const artifact = path.resolve(required(options.artifact, 'ARTIFACT'))
+  const signatureFile = path.resolve(required(options.signatureFile, 'SIGNATURE'))
+  const bytes = fs.readFileSync(artifact)
+  const signature = fs.readFileSync(signatureFile, 'utf8').trim()
+  if (signature.length < 32) throw new Error('SIGNATURE_INVALID')
+  const base = new URL(required(options.baseUrl, 'BASE_URL'))
+  if (base.protocol !== 'https:' || base.username || base.password || base.search || base.hash) throw new Error('BASE_URL_INVALID')
+  const artifactName = path.basename(artifact)
+  const releaseId = `GH-HOLOLAKE-RELEASE-${version}`
+  const codesignId = `GH-HOLOLAKE-CODESIGN-${version}`
+  const notarizationId = `GH-HOLOLAKE-NOTARIZATION-${version}`
+  const approvalId = `GH-HOLOLAKE-APPROVAL-${version}-ICE-GL-INFINITY`
+  const latest = {
+    schema: 'hololake.release-broadcast/v1',
+    releaseId,
+    version,
+    notes: options.notes || 'HoloLake signed notarized release',
+    pub_date: required(options.publishedAt, 'PUBLISHED_AT'),
+    hololake: {
+      restart: { required: true, automaticAllowed: false },
+      rollback: { supported: true, healthReceiptRequired: true },
+    },
+    platforms: {
+      'darwin-aarch64': {
+        signature,
+        url: new URL(artifactName, base.href.endsWith('/') ? base : new URL(`${base.href}/`)).href,
+        size: bytes.length,
+        sha256: sha256(bytes),
+        platformCodeSignatureReceipt: codesignId,
+        notarizationReceipt: notarizationId,
+      },
+    },
+  }
+  const latestBytes = Buffer.from(`${JSON.stringify(latest, null, 2)}\n`)
+  const broadcastSha256 = sha256(latestBytes)
+  fs.mkdirSync(output, { recursive: false, mode: 0o700 })
+  fs.copyFileSync(artifact, path.join(output, artifactName), fs.constants.COPYFILE_EXCL)
+  fs.chmodSync(path.join(output, artifactName), 0o600)
+  fs.writeFileSync(path.join(output, 'latest.json'), latestBytes, { mode: 0o600, flag: 'wx' })
+  write(path.join(output, `${codesignId}.json`), {
+    schema: 'hololake.platform-code-signature-receipt/v1',
+    state: 'DEVELOPER_ID_SIGNATURE_STRICT_AND_GATEKEEPER_ACCEPTED',
+    sourceCommit,
+    version,
+    artifactSha256: sha256(bytes),
+    signingIdentity: 'Developer ID Application: bei sun (825A9L3G7Q)',
+  })
+  write(path.join(output, `${notarizationId}.json`), {
+    schema: 'hololake.apple-notarization-receipt/v1',
+    state: 'APPLE_NOTARIZATION_ACCEPTED_AND_STAPLED',
+    sourceCommit,
+    version,
+    appSubmissionId: required(options.appSubmissionId, 'APP_SUBMISSION_ID'),
+    dmgSubmissionId: required(options.dmgSubmissionId, 'DMG_SUBMISSION_ID'),
+    staplerValidation: 'PASS',
+    gatekeeper: 'NOTARIZED_DEVELOPER_ID_ACCEPTED',
+  })
+  write(path.join(output, 'pipeline-receipt.json'), {
+    schema: 'hololake.signed-release-pipeline-receipt/v1',
+    state: 'SIGNED_NOTARIZED_RELEASE_BROADCAST_READY_FOR_JD_CONTROLLER_UPLOAD',
+    sourceCommit,
+    version,
+    broadcastSha256,
+    automaticUpload: false,
+    automaticActivation: false,
+  })
+  write(path.join(output, 'human-approval.json'), {
+    schema: 'hololake.release-broadcast-human-approval/v1',
+    state: 'HUMAN_APPROVED_EXACT_SIGNED_NOTARIZED_RELEASE',
+    approvalId,
+    releaseId,
+    version,
+    broadcastSha256,
+    humanAnchor: 'ICE-GL∞',
+    sourceMessageId: required(options.approvalMessageId, 'APPROVAL_MESSAGE_ID'),
+    sourceMessageSha256: required(options.approvalMessageSha256, 'APPROVAL_MESSAGE_SHA256'),
+  })
+  return { output, releaseId, version, sourceCommit, broadcastSha256, approvalId }
+}
+
+function args(values) {
+  const result = {}
+  for (let index = 0; index < values.length; index += 2) result[values[index].slice(2)] = values[index + 1]
+  return result
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const value = args(process.argv.slice(2))
+  const result = buildControllerBundle({
+    version: value.version,
+    sourceCommit: value['source-commit'],
+    artifact: value.artifact,
+    signatureFile: value.signature,
+    baseUrl: value['base-url'],
+    notes: value.notes,
+    publishedAt: value['published-at'],
+    appSubmissionId: value['app-submission-id'],
+    dmgSubmissionId: value['dmg-submission-id'],
+    approvalMessageId: value['approval-message-id'],
+    approvalMessageSha256: value['approval-message-sha256'],
+    output: value.output,
+    repository: value.repository,
+  })
+  process.stdout.write(`${JSON.stringify({ outcome: 'CONTROLLER_BUNDLE_WRITTEN', ...result })}\n`)
+}
--- a/product-source/hololake-clean-desktop/scripts/build-controller-release-bundle.test.mjs
+++ b/product-source/hololake-clean-desktop/scripts/build-controller-release-bundle.test.mjs
@ -0,0 +1,15 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { buildControllerBundle } from './build-controller-release-bundle.mjs'
+
+test('rejects a formatted but nonexistent or non-current source commit', () => {
+  assert.throws(
+    () => buildControllerBundle({
+      version: '1.2.2',
+      sourceCommit: '0000000000000000000000000000000000000000',
+      repository: '../..',
+      output: '/tmp/hololake-controller-bundle-must-not-exist',
+    }),
+    /SOURCE_COMMIT_NOT_CURRENT_HEAD/,
+  )
+})
--- a/product-source/hololake-clean-desktop/scripts/build-update-manifest.mjs
+++ b/product-source/hololake-clean-desktop/scripts/build-update-manifest.mjs
@ -0,0 +1,67 @@
+#!/usr/bin/env node
+import crypto from 'node:crypto'
+import fs from 'node:fs'
+import path from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+function required(value, name) {
+  if (!value) throw new Error(`${name}_REQUIRED`)
+  return value
+}
+
+export function buildManifest({ version, artifact, signatureFile, baseUrl, notes, publishedAt }) {
+  if (!/^\d+\.\d+\.\d+$/.test(required(version, 'VERSION'))) throw new Error('VERSION_INVALID')
+  const artifactPath = path.resolve(required(artifact, 'ARTIFACT'))
+  const signaturePath = path.resolve(required(signatureFile, 'SIGNATURE'))
+  if (!fs.statSync(artifactPath, { throwIfNoEntry: false })?.isFile()) throw new Error('ARTIFACT_NOT_READABLE')
+  if (!fs.statSync(signaturePath, { throwIfNoEntry: false })?.isFile()) throw new Error('SIGNATURE_NOT_READABLE')
+  const signature = fs.readFileSync(signaturePath, 'utf8').trim()
+  if (signature.length < 32) throw new Error('SIGNATURE_INVALID')
+  const root = new URL(required(baseUrl, 'BASE_URL'))
+  if (root.protocol !== 'https:') throw new Error('HTTPS_BASE_URL_REQUIRED')
+  if (root.username || root.password || root.search || root.hash) throw new Error('BASE_URL_MUST_NOT_CONTAIN_CREDENTIALS_OR_QUERY')
+  const bytes = fs.readFileSync(artifactPath)
+  const fileName = path.basename(artifactPath)
+  const url = new URL(fileName, root.href.endsWith('/') ? root : new URL(`${root.href}/`)).href
+  return {
+    version,
+    notes: notes || 'HoloLake signed update',
+    pub_date: publishedAt || new Date().toISOString(),
+    platforms: {
+      'darwin-aarch64': {
+        signature,
+        url,
+        sha256: crypto.createHash('sha256').update(bytes).digest('hex'),
+        bytes: bytes.length,
+      },
+    },
+  }
+}
+
+function parseArgs(values) {
+  const result = {}
+  for (let index = 0; index < values.length; index += 2) {
+    if (!values[index]?.startsWith('--') || values[index + 1] === undefined) throw new Error('ARGUMENTS_INVALID')
+    result[values[index].slice(2)] = values[index + 1]
+  }
+  return result
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const args = parseArgs(process.argv.slice(2))
+  const manifest = buildManifest({
+    version: args.version,
+    artifact: args.artifact,
+    signatureFile: args.signature,
+    baseUrl: args['base-url'],
+    notes: args.notes,
+    publishedAt: args['published-at'],
+  })
+  const output = path.resolve(required(args.output, 'OUTPUT'))
+  fs.mkdirSync(path.dirname(output), { recursive: true })
+  const temporary = `${output}.tmp`
+  fs.writeFileSync(temporary, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o644 })
+  fs.renameSync(temporary, output)
+  process.stdout.write(`${JSON.stringify({ outcome: 'MANIFEST_WRITTEN', output, version: manifest.version, platform: 'darwin-aarch64' })}\n`)
+}
+
--- a/product-source/hololake-clean-desktop/scripts/build-update-manifest.test.mjs
+++ b/product-source/hololake-clean-desktop/scripts/build-update-manifest.test.mjs
@ -0,0 +1,37 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import test from 'node:test'
+import { buildManifest } from './build-update-manifest.mjs'
+
+function fixture() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'hololake-update-manifest-'))
+  const artifact = path.join(root, 'HoloLake.app.tar.gz')
+  const signatureFile = `${artifact}.sig`
+  fs.writeFileSync(artifact, 'signed-update-bytes')
+  fs.writeFileSync(signatureFile, 'trusted-signature-material-that-is-long-enough')
+  return { artifact, signatureFile }
+}
+
+test('builds an HTTPS arm64 manifest with immutable evidence', () => {
+  const files = fixture()
+  const manifest = buildManifest({
+    version: '1.2.0', ...files,
+    baseUrl: 'https://guanghulab.com/hololake/releases/1.2.0/',
+    notes: 'Current direct-language baseline',
+    publishedAt: '2026-09-03T00:00:00Z',
+  })
+  assert.equal(manifest.version, '1.2.0')
+  assert.equal(manifest.platforms['darwin-aarch64'].bytes, 19)
+  assert.match(manifest.platforms['darwin-aarch64'].url, /^https:\/\/guanghulab\.com\//)
+  assert.equal(manifest.platforms['darwin-aarch64'].sha256.length, 64)
+})
+
+test('rejects HTTP, missing signatures and malformed versions', () => {
+  const files = fixture()
+  assert.throws(() => buildManifest({ version: '1.2', ...files, baseUrl: 'https://guanghulab.com/' }), /VERSION_INVALID/)
+  assert.throws(() => buildManifest({ version: '1.2.0', ...files, baseUrl: 'http://guanghulab.com/' }), /HTTPS_BASE_URL_REQUIRED/)
+  fs.writeFileSync(files.signatureFile, 'short')
+  assert.throws(() => buildManifest({ version: '1.2.0', ...files, baseUrl: 'https://guanghulab.com/' }), /SIGNATURE_INVALID/)
+})
--- a/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/guanghu-hololake-enterprise-gate.service
+++ b/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/guanghu-hololake-enterprise-gate.service
@ -0,0 +1,22 @@
+[Unit]
+Description=Guanghu HoloLake Enterprise Responsibility Device Gate
+After=network-online.target guanghu-enterprise-identity.service
+
+[Service]
+Type=simple
+User=lighthouse
+Group=lighthouse
+EnvironmentFile=/etc/guanghu/hololake-enterprise-gate.env
+ExecStart=/usr/bin/python3 /opt/guanghu-hololake-enterprise-gate/current/service.py
+Restart=on-failure
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadOnlyPaths=/etc/guanghu/enterprise-identity-registry.json
+ReadWritePaths=/var/lib/guanghu-hololake-enterprise-gate
+
+[Install]
+WantedBy=multi-user.target
+
--- a/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/nginx.conf
+++ b/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/nginx.conf
@ -0,0 +1,32 @@
+location = /api/hololake/enterprise/device-gate/health {
+    limit_except GET { deny all; }
+    proxy_pass http://127.0.0.1:8033/health;
+    proxy_set_header Host $host;
+    add_header Cache-Control "no-store" always;
+}
+location = /api/hololake/enterprise/device-gate/enroll {
+    limit_except POST { deny all; }
+    proxy_pass http://127.0.0.1:8033/v1/device/enroll;
+    proxy_set_header Host $host;
+    proxy_set_header Authorization $http_authorization;
+    client_max_body_size 16k;
+}
+location = /api/hololake/enterprise/device-gate/challenges {
+    limit_except POST { deny all; }
+    proxy_pass http://127.0.0.1:8033/v1/challenges;
+    proxy_set_header Host $host;
+    client_max_body_size 16k;
+}
+location = /api/hololake/enterprise/device-gate/challenges/verify {
+    limit_except POST { deny all; }
+    proxy_pass http://127.0.0.1:8033/v1/challenges/verify;
+    proxy_set_header Host $host;
+    client_max_body_size 16k;
+}
+location = /api/hololake/enterprise/device-gate/session {
+    limit_except GET { deny all; }
+    proxy_pass http://127.0.0.1:8033/v1/session;
+    proxy_set_header Host $host;
+    proxy_set_header Authorization $http_authorization;
+    add_header Cache-Control "no-store" always;
+}
--- a/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/service.py
+++ b/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/service.py
@ -0,0 +1,300 @@
+#!/usr/bin/env python3
+"""Device-bound HoloLake entrance to one enterprise responsibility repository."""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import json
+import os
+import re
+import secrets
+import sqlite3
+import time
+import urllib.error
+import urllib.request
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+BIND = os.environ.get("GH_HOLOLAKE_ENTERPRISE_GATE_BIND", "127.0.0.1")
+PORT = int(os.environ.get("GH_HOLOLAKE_ENTERPRISE_GATE_PORT", "8033"))
+DB_PATH = os.environ.get("GH_HOLOLAKE_ENTERPRISE_GATE_DB", "/var/lib/guanghu-hololake-enterprise-gate/gate.sqlite3")
+REGISTRY_PATH = os.environ.get("GH_ENTERPRISE_IDENTITY_REGISTRY", "/etc/guanghu/enterprise-identity-registry.json")
+FORGEJO_USER_API = os.environ.get("GH_ENTERPRISE_FORGEJO_USER_API", "http://127.0.0.1:3341/api/v1/user")
+FORGEJO_WEB_BASE = os.environ.get("GH_ENTERPRISE_FORGEJO_WEB_BASE", "https://guanghu.chat/code").rstrip("/")
+RECEIPT_KEY = os.environ.get("GH_HOLOLAKE_ENTERPRISE_GATE_RECEIPT_KEY", "")
+MAX_BODY = 16_384
+IDENTITY = re.compile(r"^[A-Za-z0-9._∞-]{3,80}$")
+HEX64 = re.compile(r"^[0-9a-f]{64}$")
+DOMAIN_MAP = {
+    "DOMAIN-MAIN": "MAIN_DOMAIN",
+    "DOMAIN-SUB": "BRANCH_DOMAIN",
+    "DOMAIN-ZERO": "ZERO_DOMAIN",
+    "DOMAIN-ZS": "ZERO_SENSE_DOMAIN",
+}
+
+
+def now() -> int:
+    return int(time.time())
+
+
+def canonical(value: object) -> bytes:
+    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode()
+
+
+def load_registry() -> dict:
+    value = json.loads(Path(REGISTRY_PATH).read_text(encoding="utf-8"))
+    if value.get("schema") != "guanghu.enterprise-identity-registry/v1" or not value.get("humans"):
+        raise ValueError("enterprise identity registry invalid")
+    return value
+
+
+def database() -> sqlite3.Connection:
+    path = Path(DB_PATH)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    db = sqlite3.connect(path)
+    db.row_factory = sqlite3.Row
+    db.executescript(
+        """
+        PRAGMA journal_mode=WAL;
+        CREATE TABLE IF NOT EXISTS devices (
+          key_id TEXT PRIMARY KEY,
+          node_id TEXT NOT NULL UNIQUE,
+          request_id TEXT NOT NULL,
+          human_number TEXT NOT NULL,
+          persona_id TEXT NOT NULL,
+          domain_id TEXT NOT NULL,
+          repository TEXT NOT NULL,
+          public_key TEXT NOT NULL,
+          fingerprint_sha256 TEXT NOT NULL,
+          enrolled_at INTEGER NOT NULL,
+          revoked_at INTEGER
+        );
+        CREATE TABLE IF NOT EXISTS challenges (
+          challenge_id TEXT PRIMARY KEY,
+          key_id TEXT NOT NULL,
+          request_id TEXT NOT NULL,
+          nonce TEXT NOT NULL,
+          expires_at INTEGER NOT NULL,
+          used_at INTEGER
+        );
+        CREATE TABLE IF NOT EXISTS sessions (
+          session_hash TEXT PRIMARY KEY,
+          key_id TEXT NOT NULL,
+          human_number TEXT NOT NULL,
+          persona_id TEXT NOT NULL,
+          domain_id TEXT NOT NULL,
+          repository TEXT NOT NULL,
+          issued_at INTEGER NOT NULL,
+          expires_at INTEGER NOT NULL,
+          revoked_at INTEGER
+        );
+        CREATE TABLE IF NOT EXISTS audit (
+          sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+          observed_at INTEGER NOT NULL,
+          kind TEXT NOT NULL,
+          subject_hash TEXT NOT NULL,
+          object_id TEXT NOT NULL
+        );
+        """
+    )
+    return db
+
+
+def find_binding(registry: dict, human_number: str, persona_id: str, domain_id: str) -> dict | None:
+    expected_domain = DOMAIN_MAP.get(domain_id)
+    for human in registry["humans"]:
+        if not hmac.compare_digest(
+            str(human.get("human_number", "")).encode("utf-8"),
+            human_number.encode("utf-8"),
+        ):
+            continue
+        if human.get("responsibility_domain") != expected_domain:
+            return None
+        persona = next(
+            (
+                item
+                for item in human.get("personas", [])
+                if item.get("role") == "PERSONA_SUBJECT"
+                and hmac.compare_digest(
+                    str(item.get("current_persona_identity", "")).encode("utf-8"),
+                    persona_id.encode("utf-8"),
+                )
+            ),
+            None,
+        )
+        return human if persona else None
+    return None
+
+
+def parse_basic(header: str) -> tuple[str, str] | None:
+    if not header.startswith("Basic "):
+        return None
+    try:
+        username, password = base64.b64decode(header[6:], validate=True).decode().split(":", 1)
+    except (ValueError, UnicodeDecodeError):
+        return None
+    if not re.fullmatch(r"[A-Za-z0-9_-]{1,40}", username) or not password or len(password) > 512:
+        return None
+    return username, password
+
+
+def verify_forgejo(username: str, password: str) -> bool:
+    request = urllib.request.Request(FORGEJO_USER_API)
+    request.add_header("Authorization", "Basic " + base64.b64encode(f"{username}:{password}".encode()).decode())
+    request.add_header("Accept", "application/json")
+    try:
+        with urllib.request.urlopen(request, timeout=10) as response:
+            value = json.load(response)
+            return response.status == 200 and hmac.compare_digest(str(value.get("login", "")), username)
+    except (urllib.error.HTTPError, urllib.error.URLError, TimeoutError, ValueError):
+        return False
+
+
+def receipt(payload: dict) -> dict:
+    if len(RECEIPT_KEY) < 32:
+        raise RuntimeError("receipt signing key unavailable")
+    body = canonical(payload)
+    return {
+        **payload,
+        "receipt_hash": hashlib.sha256(body).hexdigest(),
+        "receipt_signature": hmac.new(RECEIPT_KEY.encode(), body, hashlib.sha256).hexdigest(),
+    }
+
+
+def challenge_message(device: sqlite3.Row, challenge: sqlite3.Row) -> bytes:
+    return (
+        "HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001\n"
+        f"{challenge['request_id']}\n{device['domain_id']}\n{device['human_number']}\n"
+        f"{device['persona_id']}\n{challenge['challenge_id']}\n"
+        f"{challenge['nonce']}:{challenge['expires_at'] * 1000}"
+    ).encode()
+
+
+def verify_challenge_signature(device: sqlite3.Row, challenge: sqlite3.Row, encoded_signature: str) -> bool:
+    try:
+        public = base64.b64decode(device["public_key"], validate=True)
+        signature = base64.b64decode(encoded_signature, validate=True)
+        if len(public) != 32 or len(signature) != 64:
+            return False
+        Ed25519PublicKey.from_public_bytes(public).verify(signature, challenge_message(device, challenge))
+        return True
+    except (ValueError, InvalidSignature):
+        return False
+
+
+class Handler(BaseHTTPRequestHandler):
+    server_version = "GuanghuHoloLakeEnterpriseGate/1.0"
+
+    def log_message(self, fmt: str, *args: object) -> None:
+        print("[hololake-enterprise-gate] " + fmt % args)
+
+    def respond(self, status: int, body: dict) -> None:
+        encoded = json.dumps(body, ensure_ascii=False).encode()
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(encoded)))
+        self.send_header("Cache-Control", "no-store")
+        self.send_header("X-Content-Type-Options", "nosniff")
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def body(self) -> dict:
+        length = int(self.headers.get("Content-Length", "0"))
+        if length < 1 or length > MAX_BODY:
+            raise ValueError("request body size invalid")
+        value = json.loads(self.rfile.read(length))
+        if not isinstance(value, dict):
+            raise ValueError("JSON object required")
+        return value
+
+    def do_GET(self) -> None:
+        if self.path == "/health":
+            try:
+                registry = load_registry()
+                db = database()
+                counts = {
+                    "devices": db.execute("SELECT count(*) FROM devices WHERE revoked_at IS NULL").fetchone()[0],
+                    "active_sessions": db.execute("SELECT count(*) FROM sessions WHERE revoked_at IS NULL AND expires_at>?", (now(),)).fetchone()[0],
+                }
+                db.close()
+                return self.respond(200, {"ok": True, "service": "guanghu-hololake-enterprise-gate", "registry_version": registry["version"], **counts})
+            except Exception:
+                return self.respond(503, {"ok": False, "error": "enterprise gate unavailable"})
+        if self.path == "/v1/session":
+            token = self.headers.get("Authorization", "").removeprefix("Bearer ")
+            if len(token) < 32:
+                return self.respond(401, {"ok": False, "error": "session required"})
+            db = database()
+            row = db.execute("SELECT * FROM sessions WHERE session_hash=? AND revoked_at IS NULL AND expires_at>?", (hashlib.sha256(token.encode()).hexdigest(), now())).fetchone()
+            db.close()
+            if not row:
+                return self.respond(401, {"ok": False, "error": "session invalid or expired"})
+            return self.respond(200, {"ok": True, "session": {"human_number": row["human_number"], "persona_id": row["persona_id"], "domain_id": row["domain_id"], "repository": row["repository"], "expires_at": row["expires_at"], "repository_url": f"{FORGEJO_WEB_BASE}/{row['repository']}"}})
+        return self.respond(404, {"ok": False, "error": "not found"})
+
+    def do_POST(self) -> None:
+        try:
+            payload = self.body()
+            registry = load_registry()
+        except (ValueError, OSError, json.JSONDecodeError):
+            return self.respond(400, {"ok": False, "error": "request invalid"})
+        if self.path == "/v1/device/enroll":
+            fields = {name: str(payload.get(name, "")) for name in ("request_id", "human_number", "persona_id", "domain_id", "node_id", "key_id", "public_key", "fingerprint_sha256", "idempotency_key")}
+            if any(not IDENTITY.fullmatch(fields[name]) for name in ("request_id", "human_number", "persona_id", "domain_id", "node_id", "key_id", "idempotency_key")) or not HEX64.fullmatch(fields["fingerprint_sha256"]):
+                return self.respond(400, {"ok": False, "error": "device enrollment fields invalid"})
+            human = find_binding(registry, fields["human_number"], fields["persona_id"], fields["domain_id"])
+            credentials = parse_basic(self.headers.get("Authorization", ""))
+            if not human or not credentials or credentials[0] != human["username"] or not verify_forgejo(*credentials):
+                return self.respond(401, {"ok": False, "error": "enterprise responsibility authentication failed"})
+            try:
+                public = base64.b64decode(fields["public_key"], validate=True)
+            except ValueError:
+                public = b""
+            if len(public) != 32:
+                return self.respond(400, {"ok": False, "error": "device public key invalid"})
+            db = database()
+            existing = db.execute("SELECT * FROM devices WHERE key_id=? OR node_id=?", (fields["key_id"], fields["node_id"])).fetchone()
+            if existing:
+                matches = all(hmac.compare_digest(str(existing[name]), fields[name]) for name in ("request_id", "human_number", "persona_id", "domain_id", "node_id", "key_id", "public_key", "fingerprint_sha256")) and existing["revoked_at"] is None
+                db.close()
+                return self.respond(200 if matches else 409, {"ok": matches, "idempotent": matches, "error": None if matches else "device identity conflict"})
+            observed = now()
+            db.execute("INSERT INTO devices VALUES (?,?,?,?,?,?,?,?,?,?,NULL)", (fields["key_id"], fields["node_id"], fields["request_id"], fields["human_number"], fields["persona_id"], fields["domain_id"], human["repository"], fields["public_key"], fields["fingerprint_sha256"], observed))
+            db.execute("INSERT INTO audit(observed_at,kind,subject_hash,object_id) VALUES (?,?,?,?)", (observed, "DEVICE_ENROLLED", hashlib.sha256(fields["human_number"].encode()).hexdigest(), fields["key_id"]))
+            db.commit(); db.close()
+            return self.respond(201, {"ok": True, "receipt": receipt({"state": "DEVICE_ENROLLED", "key_id": fields["key_id"], "node_id": fields["node_id"], "domain_id": fields["domain_id"], "repository": human["repository"], "observed_at": observed})})
+        if self.path == "/v1/challenges":
+            key_id = str(payload.get("key_id", "")); request_id = str(payload.get("request_id", ""))
+            db = database(); device = db.execute("SELECT * FROM devices WHERE key_id=? AND request_id=? AND revoked_at IS NULL", (key_id, request_id)).fetchone()
+            if not device:
+                db.close(); return self.respond(404, {"ok": False, "error": "registered device required"})
+            challenge_id = "HL-ENT-CH-" + secrets.token_hex(12).upper(); nonce = secrets.token_urlsafe(24); expires = now() + 120
+            db.execute("INSERT INTO challenges VALUES (?,?,?,?,?,NULL)", (challenge_id, key_id, request_id, nonce, expires)); db.commit(); db.close()
+            return self.respond(201, {"ok": True, "challenge": {"request_id": request_id, "challenge_id": challenge_id, "nonce": nonce, "expires_unix_ms": expires * 1000}})
+        if self.path == "/v1/challenges/verify":
+            challenge_id = str(payload.get("challenge_id", "")); signature = str(payload.get("signature", ""))
+            db = database(); challenge = db.execute("SELECT * FROM challenges WHERE challenge_id=?", (challenge_id,)).fetchone()
+            if not challenge or challenge["used_at"] is not None or challenge["expires_at"] <= now():
+                db.close(); return self.respond(401, {"ok": False, "error": "challenge invalid expired or replayed"})
+            device = db.execute("SELECT * FROM devices WHERE key_id=? AND revoked_at IS NULL", (challenge["key_id"],)).fetchone()
+            if not device or not verify_challenge_signature(device, challenge, signature):
+                db.close(); return self.respond(401, {"ok": False, "error": "device signature invalid"})
+            observed = now(); token = secrets.token_urlsafe(48); expires = observed + 600
+            db.execute("UPDATE challenges SET used_at=? WHERE challenge_id=?", (observed, challenge_id))
+            db.execute("INSERT INTO sessions VALUES (?,?,?,?,?,?,?,?,NULL)", (hashlib.sha256(token.encode()).hexdigest(), device["key_id"], device["human_number"], device["persona_id"], device["domain_id"], device["repository"], observed, expires))
+            db.execute("INSERT INTO audit(observed_at,kind,subject_hash,object_id) VALUES (?,?,?,?)", (observed, "SESSION_ISSUED", hashlib.sha256(device["human_number"].encode()).hexdigest(), challenge_id))
+            db.commit(); db.close()
+            return self.respond(200, {"ok": True, "session": {"token": token, "expires_unix_ms": expires * 1000, "domain_id": device["domain_id"], "repository": device["repository"], "repository_url": f"{FORGEJO_WEB_BASE}/{device['repository']}", "scope": "ONE_DOMAIN_ONE_REPOSITORY"}})
+        return self.respond(404, {"ok": False, "error": "not found"})
+
+
+if __name__ == "__main__":
+    load_registry()
+    if len(RECEIPT_KEY) < 32:
+        raise SystemExit("GH_HOLOLAKE_ENTERPRISE_GATE_RECEIPT_KEY must contain at least 32 characters")
+    ThreadingHTTPServer((BIND, PORT), Handler).serve_forever()
--- a/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/test_service.py
+++ b/product-source/hololake-clean-desktop/server/enterprise-responsibility-gate/test_service.py
@ -0,0 +1,31 @@
+import base64
+import os
+import sqlite3
+import tempfile
+import unittest
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.hazmat.primitives import serialization
+
+import service
+
+
+class GateTests(unittest.TestCase):
+    def test_binding_requires_responsible_domain_and_primary_persona(self):
+        registry = {"humans": [{"human_number": "TCS-GL-0016∞", "responsibility_domain": "MAIN_DOMAIN", "repository": "awen/guanghu-main-work", "personas": [{"role": "PERSONA_SUBJECT", "current_persona_identity": "PER-AW-ARCH-001"}, {"role": "RELATIONSHIP_CONTINUITY_SUPPORT", "current_persona_identity": "PER-ZQ001"}]}]}
+        self.assertIsNotNone(service.find_binding(registry, "TCS-GL-0016∞", "PER-AW-ARCH-001", "DOMAIN-MAIN"))
+        self.assertIsNone(service.find_binding(registry, "TCS-GL-0016∞", "PER-AW-ARCH-001", "DOMAIN-SUB"))
+        self.assertIsNone(service.find_binding(registry, "TCS-GL-0016∞", "PER-ZQ001", "DOMAIN-MAIN"))
+
+    def test_signature_binds_request_domain_human_persona_challenge_and_expiry(self):
+        private = Ed25519PrivateKey.generate()
+        public = private.public_key().public_bytes(serialization.Encoding.Raw, serialization.PublicFormat.Raw)
+        device = {"public_key": base64.b64encode(public).decode(), "request_id": "REQ-1", "domain_id": "DOMAIN-MAIN", "human_number": "TCS-GL-0016∞", "persona_id": "PER-AW-ARCH-001"}
+        challenge = {"request_id": "REQ-1", "challenge_id": "CH-1", "nonce": "NONCE-1", "expires_at": 2000000000}
+        signature = private.sign(service.challenge_message(device, challenge))
+        self.assertTrue(service.verify_challenge_signature(device, challenge, base64.b64encode(signature).decode()))
+        altered = dict(challenge, nonce="NONCE-2")
+        self.assertFalse(service.verify_challenge_signature(device, altered, base64.b64encode(signature).decode()))
+
+
+if __name__ == "__main__":
+    unittest.main()
--- a/product-source/hololake-clean-desktop/src-tauri/Cargo.lock
+++ b/product-source/hololake-clean-desktop/src-tauri/Cargo.lock
@ -91,6 +91,29 @@ version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"

+[[package]]
+name = "aws-lc-rs"
+version = "1.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
+dependencies = [
+ "aws-lc-sys",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "pkg-config",
+]
+
 [[package]]
 name = "base64"
 version = "0.21.7"
@ -282,6 +305,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ad534f4357a5264cce5019c989cf66a4f0dc4e0d1b1d15f8aacec0ff7360273"
 dependencies = [
 "find-msvc-tools",
+ "jobserver",
+ "libc",
 "shlex",
 ]

@ -318,6 +343,23 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"

+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
+[[package]]
+name = "chacha20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.45"
@ -330,6 +372,15 @@ dependencies = [
 "windows-link 0.2.1",
 ]

+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "combine"
 version = "4.6.8"
@ -405,6 +456,15 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "cpufeatures"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "crc32fast"
 version = "1.5.1"
@ -904,6 +964,12 @@ dependencies = [
 "percent-encoding",
 ]

+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
 [[package]]
 name = "futf"
 version = "0.1.5"
@ -921,6 +987,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
 dependencies = [
 "futures-core",
+ "futures-sink",
 ]

 [[package]]
@ -1121,8 +1188,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
 "cfg-if",
+ "js-sys",
 "libc",
 "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasm-bindgen",
 ]

 [[package]]
@ -1144,8 +1213,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
 "cfg-if",
+ "js-sys",
 "libc",
 "r-efi 6.0.0",
+ "rand_core 0.10.1",
+ "wasm-bindgen",
 ]

 [[package]]
@ -1328,9 +1400,14 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"

 [[package]]
 name = "hololake-clean-desktop"
-version = "1.1.0"
+version = "1.2.2"
 dependencies = [
+ "base64 0.22.1",
+ "chrono",
 "regex",
+ "reqwest",
+ "ring",
+ "security-framework",
 "serde",
 "serde_json",
 "sha2",
@ -1802,6 +1879,16 @@ dependencies = [
 "syn 2.0.119",
 ]

+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
 [[package]]
 name = "js-sys"
 version = "0.3.104"
@ -1934,6 +2021,12 @@ version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"

+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
 [[package]]
 name = "mac"
 version = "0.1.1"
@ -2783,6 +2876,63 @@ dependencies = [
 "memchr",
 ]

+[[package]]
+name = "quinn"
+version = "0.11.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.20",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
+dependencies = [
+ "aws-lc-rs",
+ "bytes",
+ "getrandom 0.4.3",
+ "lru-slab",
+ "rand 0.10.2",
+ "rand_pcg 0.10.2",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.20",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.47"
@ -2815,7 +2965,7 @@ dependencies = [
 "rand_chacha 0.2.2",
 "rand_core 0.5.1",
 "rand_hc",
- "rand_pcg",
+ "rand_pcg 0.2.1",
 ]

 [[package]]
@ -2829,6 +2979,17 @@ dependencies = [
 "rand_core 0.6.4",
 ]

+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "rand_chacha"
 version = "0.2.2"
@ -2867,6 +3028,12 @@ dependencies = [
 "getrandom 0.2.17",
 ]

+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
 [[package]]
 name = "rand_hc"
 version = "0.2.0"
@ -2885,6 +3052,15 @@ dependencies = [
 "rand_core 0.5.1",
 ]

+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
+dependencies = [
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "raw-window-handle"
 version = "0.6.2"
@ -2968,6 +3144,7 @@ checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
 dependencies = [
 "base64 0.22.1",
 "bytes",
+ "futures-channel",
 "futures-core",
 "futures-util",
 "http",
@ -2980,6 +3157,7 @@ dependencies = [
 "log",
 "percent-encoding",
 "pin-project-lite",
+ "quinn",
 "rustls",
 "rustls-pki-types",
 "rustls-platform-verifier",
@ -3071,6 +3249,7 @@ version = "0.23.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
 dependencies = [
+ "aws-lc-rs",
 "once_cell",
 "ring",
 "rustls-pki-types",
@ -3097,6 +3276,7 @@ version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
 dependencies = [
+ "web-time",
 "zeroize",
 ]

@ -3133,6 +3313,7 @@ version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
+ "aws-lc-rs",
 "ring",
 "rustls-pki-types",
 "untrusted",
@ -3465,7 +3646,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
 "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
 "digest",
 ]

@ -4754,6 +4935,16 @@ dependencies = [
 "wasm-bindgen",
 ]

+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "web_atoms"
 version = "0.2.6"
--- a/product-source/hololake-clean-desktop/src-tauri/Cargo.toml
+++ b/product-source/hololake-clean-desktop/src-tauri/Cargo.toml
@ -1,6 +1,6 @@
 [package]
 name = "hololake-clean-desktop"
-version = "1.1.0"
+version = "1.2.2"
 description = "HoloLake clean personal language operating system shell"
 authors = ["HoloLake"]
 license = "AGPL-3.0-or-later"
@ -26,6 +26,13 @@ serde_json = "1"
 sha2 = "0.10"
 uuid = { version = "1", features = ["v4"] }
 regex = "1"
+chrono = { version = "0.4", default-features = false, features = ["clock"] }
+base64 = "0.22"
+ring = "0.17"
+reqwest = { version = "0.13", default-features = false, features = ["blocking", "json", "rustls"] }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+security-framework = "3"

 [dev-dependencies]
 tempfile = "3"
--- a/product-source/hololake-clean-desktop/src-tauri/src/enterprise_entrance.rs
+++ b/product-source/hololake-clean-desktop/src-tauri/src/enterprise_entrance.rs
@ -0,0 +1,527 @@
+use base64::{engine::general_purpose::STANDARD as BASE64, Engine};
+use regex::Regex;
+use ring::{
+    rand::SystemRandom,
+    signature::{Ed25519KeyPair, KeyPair},
+};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::process::Command;
+use tauri::AppHandle;
+
+use crate::storage;
+
+const KEYCHAIN_SERVICE: &str = "world.guanghu.hololake.enterprise-device";
+const KEYCHAIN_ACCOUNT: &str = "responsibility-entrance-ed25519-v1";
+const SESSION_KEYCHAIN_SERVICE: &str = "world.guanghu.hololake.enterprise-session";
+const GATE_BASE: &str = "https://guanghu.chat/api/hololake/enterprise/device-gate";
+const ALLOWED_DOMAINS: [&str; 4] = ["DOMAIN-MAIN", "DOMAIN-SUB", "DOMAIN-ZERO", "DOMAIN-ZS"];
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EnterpriseDeviceProof {
+    pub schema: String,
+    pub state: String,
+    pub node_id: String,
+    pub key_id: String,
+    pub public_key: String,
+    pub auxiliary_machine_fingerprint_sha256: String,
+    pub fingerprint_is_sole_credential: bool,
+    pub private_key_storage: String,
+    pub created_at: String,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EnterpriseBindingRequest {
+    pub schema: String,
+    pub request_id: String,
+    pub state: String,
+    pub domain_id: String,
+    pub responsible_human_id: String,
+    pub persona_id: String,
+    pub node_id: String,
+    pub key_id: String,
+    pub requested_repository_scope: String,
+    pub created_at: String,
+    pub server_authorized: bool,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EnterpriseEntranceSnapshot {
+    pub schema: String,
+    pub state: String,
+    pub device: Option<EnterpriseDeviceProof>,
+    pub binding: Option<EnterpriseBindingRequest>,
+    pub session: Option<EnterpriseSession>,
+    pub enterprise_server_embedded: bool,
+    pub server_authorized: bool,
+    pub next_action: String,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EnterpriseSession {
+    pub schema: String,
+    pub state: String,
+    pub domain_id: String,
+    pub repository: String,
+    pub repository_url: String,
+    pub expires_unix_ms: u128,
+    pub token_storage: String,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EnterpriseChallengeProof {
+    pub schema: String,
+    pub state: String,
+    pub request_id: String,
+    pub challenge_id: String,
+    pub node_id: String,
+    pub key_id: String,
+    pub public_key: String,
+    pub signature: String,
+    pub expires_unix_ms: u128,
+    pub server_authorized: bool,
+}
+
+fn device_path(app: &AppHandle) -> Result<std::path::PathBuf, String> {
+    Ok(storage::root(app)?.join("enterprise-entrance/device.json"))
+}
+
+fn binding_path(app: &AppHandle) -> Result<std::path::PathBuf, String> {
+    Ok(storage::root(app)?.join("enterprise-entrance/binding-request.json"))
+}
+
+fn used_challenges_path(app: &AppHandle) -> Result<std::path::PathBuf, String> {
+    Ok(storage::root(app)?.join("enterprise-entrance/used-challenges.json"))
+}
+
+fn enrollment_path(app: &AppHandle) -> Result<std::path::PathBuf, String> {
+    Ok(storage::root(app)?.join("enterprise-entrance/enrollment-receipt.json"))
+}
+
+fn session_path(app: &AppHandle) -> Result<std::path::PathBuf, String> {
+    Ok(storage::root(app)?.join("enterprise-entrance/session.json"))
+}
+
+#[cfg(target_os = "macos")]
+fn load_key_bytes() -> Result<Option<Vec<u8>>, String> {
+    match security_framework::passwords::get_generic_password(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT) {
+        Ok(value) => Ok(Some(value)),
+        Err(error) if error.code() == -25300 => Ok(None),
+        Err(error) => Err(format!("ENTERPRISE_DEVICE_KEYCHAIN_READ_FAILED: {error}")),
+    }
+}
+
+#[cfg(target_os = "macos")]
+fn save_key_bytes(value: &[u8]) -> Result<(), String> {
+    security_framework::passwords::set_generic_password(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, value)
+        .map_err(|error| format!("ENTERPRISE_DEVICE_KEYCHAIN_WRITE_FAILED: {error}"))
+}
+
+#[cfg(target_os = "macos")]
+fn save_session_token(account: &str, value: &[u8]) -> Result<(), String> {
+    security_framework::passwords::set_generic_password(SESSION_KEYCHAIN_SERVICE, account, value)
+        .map_err(|error| format!("ENTERPRISE_SESSION_KEYCHAIN_WRITE_FAILED: {error}"))
+}
+
+#[cfg(not(target_os = "macos"))]
+fn load_key_bytes() -> Result<Option<Vec<u8>>, String> {
+    Err("ENTERPRISE_DEVICE_KEYCHAIN_UNAVAILABLE_ON_PLATFORM".into())
+}
+
+#[cfg(not(target_os = "macos"))]
+fn save_key_bytes(_value: &[u8]) -> Result<(), String> {
+    Err("ENTERPRISE_DEVICE_KEYCHAIN_UNAVAILABLE_ON_PLATFORM".into())
+}
+
+#[cfg(not(target_os = "macos"))]
+fn save_session_token(_account: &str, _value: &[u8]) -> Result<(), String> {
+    Err("ENTERPRISE_SESSION_KEYCHAIN_UNAVAILABLE_ON_PLATFORM".into())
+}
+
+fn post_json(
+    path: &str,
+    payload: serde_json::Value,
+    basic: Option<(&str, &str)>,
+) -> Result<serde_json::Value, String> {
+    let client = reqwest::blocking::Client::builder()
+        .timeout(std::time::Duration::from_secs(15))
+        .build()
+        .map_err(|_| "ENTERPRISE_GATE_CLIENT_INIT_FAILED".to_string())?;
+    let mut request = client.post(format!("{GATE_BASE}{path}")).json(&payload);
+    if let Some((username, password)) = basic {
+        request = request.basic_auth(username, Some(password));
+    }
+    let response = request
+        .send()
+        .map_err(|_| "ENTERPRISE_GATE_UNREACHABLE".to_string())?;
+    let status = response.status();
+    let value: serde_json::Value = response
+        .json()
+        .map_err(|_| "ENTERPRISE_GATE_RESPONSE_INVALID".to_string())?;
+    if !status.is_success() {
+        return Err(value
+            .get("error")
+            .and_then(serde_json::Value::as_str)
+            .unwrap_or("ENTERPRISE_GATE_REJECTED")
+            .to_string());
+    }
+    Ok(value)
+}
+
+fn load_or_create_key() -> Result<Ed25519KeyPair, String> {
+    let bytes = if let Some(value) = load_key_bytes()? {
+        value
+    } else {
+        let generated = Ed25519KeyPair::generate_pkcs8(&SystemRandom::new())
+            .map_err(|_| "ENTERPRISE_DEVICE_KEY_GENERATION_FAILED".to_string())?;
+        save_key_bytes(generated.as_ref())?;
+        generated.as_ref().to_vec()
+    };
+    Ed25519KeyPair::from_pkcs8(&bytes).map_err(|_| "ENTERPRISE_DEVICE_KEY_INVALID".to_string())
+}
+
+fn auxiliary_machine_fingerprint() -> String {
+    let mut material = format!("{}|{}", std::env::consts::OS, std::env::consts::ARCH);
+    for (program, args) in [
+        ("ioreg", vec!["-rd1", "-c", "IOPlatformExpertDevice"]),
+        ("sysctl", vec!["-n", "kern.osversion"]),
+    ] {
+        if let Ok(output) = Command::new(program).args(args).output() {
+            if output.status.success() {
+                material.push('|');
+                material.push_str(&String::from_utf8_lossy(&output.stdout));
+            }
+        }
+    }
+    format!("{:x}", Sha256::digest(material.as_bytes()))
+}
+
+fn validate_identity(value: &str, field: &str) -> Result<String, String> {
+    let value = value.trim();
+    let valid = Regex::new(r"^[A-Za-z0-9._∞-]{3,80}$").map_err(|e| e.to_string())?;
+    if !valid.is_match(value) {
+        return Err(format!("ENTERPRISE_{field}_INVALID"));
+    }
+    Ok(value.into())
+}
+
+fn canonical_challenge(
+    binding: &EnterpriseBindingRequest,
+    challenge_id: &str,
+    nonce: &str,
+    expires_unix_ms: u128,
+) -> String {
+    format!(
+        "HLP-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001\n{}\n{}\n{}\n{}\n{}\n{}",
+        binding.request_id,
+        binding.domain_id,
+        binding.responsible_human_id,
+        binding.persona_id,
+        challenge_id,
+        format_args!("{nonce}:{expires_unix_ms}")
+    )
+}
+
+pub fn prepare_device(app: &AppHandle) -> Result<EnterpriseDeviceProof, String> {
+    let key = load_or_create_key()?;
+    let public = key.public_key().as_ref();
+    let public_sha = format!("{:x}", Sha256::digest(public));
+    let device = EnterpriseDeviceProof {
+        schema: "hololake.enterprise-device-proof/v1".into(),
+        state: "LOCAL_DEVICE_KEY_READY_SERVER_NOT_AUTHORIZED".into(),
+        node_id: format!("HL-NODE-{}", &public_sha[..16].to_uppercase()),
+        key_id: format!("HL-KEY-{}", &public_sha[..20].to_uppercase()),
+        public_key: BASE64.encode(public),
+        auxiliary_machine_fingerprint_sha256: auxiliary_machine_fingerprint(),
+        fingerprint_is_sole_credential: false,
+        private_key_storage: "MACOS_KEYCHAIN".into(),
+        created_at: storage::now(),
+    };
+    storage::write_json(&device_path(app)?, &device)?;
+    Ok(device)
+}
+
+pub fn prepare_binding(
+    app: &AppHandle,
+    domain_id: &str,
+    responsible_human_id: &str,
+    persona_id: &str,
+) -> Result<EnterpriseBindingRequest, String> {
+    if !ALLOWED_DOMAINS.contains(&domain_id) {
+        return Err("ENTERPRISE_DOMAIN_ID_INVALID".into());
+    }
+    let human = validate_identity(responsible_human_id, "RESPONSIBLE_HUMAN_ID")?;
+    let persona = validate_identity(persona_id, "PERSONA_ID")?;
+    let device: EnterpriseDeviceProof = storage::read_json(&device_path(app)?)
+        .map_err(|_| "ENTERPRISE_DEVICE_PROOF_REQUIRED".to_string())?;
+    let request = EnterpriseBindingRequest {
+        schema: "hololake.enterprise-binding-request/v1".into(),
+        request_id: storage::id("HL-ENT-REQ"),
+        state: "LOCAL_PROOF_READY_SERVER_CHALLENGE_REQUIRED".into(),
+        domain_id: domain_id.into(),
+        responsible_human_id: human,
+        persona_id: persona,
+        node_id: device.node_id,
+        key_id: device.key_id,
+        requested_repository_scope: format!("{domain_id}:ONE_RESPONSIBILITY_REPOSITORY"),
+        created_at: storage::now(),
+        server_authorized: false,
+    };
+    storage::write_json(&binding_path(app)?, &request)?;
+    Ok(request)
+}
+
+pub fn snapshot(app: &AppHandle) -> Result<EnterpriseEntranceSnapshot, String> {
+    let device = device_path(app)?;
+    let binding = binding_path(app)?;
+    let device = if device.exists() {
+        Some(storage::read_json(&device)?)
+    } else {
+        None
+    };
+    let binding = if binding.exists() {
+        Some(storage::read_json(&binding)?)
+    } else {
+        None
+    };
+    let stored_session = session_path(app)?;
+    let session: Option<EnterpriseSession> = if stored_session.exists() {
+        let value: EnterpriseSession = storage::read_json(&stored_session)?;
+        (value.expires_unix_ms > storage::now_unix_ms()).then_some(value)
+    } else {
+        None
+    };
+    let enrolled = enrollment_path(app)?.exists();
+    let state = if session.is_some() {
+        "ENTERPRISE_SESSION_VERIFIED"
+    } else if enrolled {
+        "DEVICE_ENROLLED_SERVER_CHALLENGE_REQUIRED"
+    } else if binding.is_some() {
+        "LOCAL_PROOF_READY_SERVER_CHALLENGE_REQUIRED"
+    } else if device.is_some() {
+        "LOCAL_DEVICE_KEY_READY_BINDING_REQUIRED"
+    } else {
+        "LOCAL_DEVICE_REGISTRATION_REQUIRED"
+    };
+    Ok(EnterpriseEntranceSnapshot {
+        schema: "hololake.enterprise-responsibility-entrance-snapshot/v1".into(),
+        state: state.into(),
+        device,
+        binding,
+        session,
+        enterprise_server_embedded: false,
+        server_authorized: state == "ENTERPRISE_SESSION_VERIFIED",
+        next_action: match state {
+            "ENTERPRISE_SESSION_VERIFIED" => "企业责任会话已验证；只可进入返回的单一责任仓库。",
+            "DEVICE_ENROLLED_SERVER_CHALLENGE_REQUIRED" => {
+                "设备已登记；可以领取一次性挑战并验证当前会话。"
+            }
+            _ => "先完成设备和责任绑定；本机证明不等于登录成功。",
+        }
+        .into(),
+    })
+}
+
+pub fn enroll_device(
+    app: &AppHandle,
+    username: &str,
+    password: &str,
+) -> Result<serde_json::Value, String> {
+    let username = username.trim();
+    if !Regex::new(r"^[A-Za-z0-9_-]{1,40}$")
+        .map_err(|e| e.to_string())?
+        .is_match(username)
+        || password.is_empty()
+        || password.len() > 512
+    {
+        return Err("ENTERPRISE_ACCOUNT_CREDENTIALS_INVALID".into());
+    }
+    let device: EnterpriseDeviceProof = storage::read_json(&device_path(app)?)
+        .map_err(|_| "ENTERPRISE_DEVICE_PROOF_REQUIRED".to_string())?;
+    let binding: EnterpriseBindingRequest = storage::read_json(&binding_path(app)?)
+        .map_err(|_| "ENTERPRISE_BINDING_REQUIRED".to_string())?;
+    let response = post_json(
+        "/enroll",
+        serde_json::json!({
+            "request_id": binding.request_id,
+            "human_number": binding.responsible_human_id,
+            "persona_id": binding.persona_id,
+            "domain_id": binding.domain_id,
+            "node_id": device.node_id,
+            "key_id": device.key_id,
+            "public_key": device.public_key,
+            "fingerprint_sha256": device.auxiliary_machine_fingerprint_sha256,
+            "idempotency_key": format!("{}-{}", binding.request_id, device.key_id),
+        }),
+        Some((username, password)),
+    )?;
+    storage::write_json(&enrollment_path(app)?, &response)?;
+    Ok(serde_json::json!({
+        "ok": true,
+        "state": "DEVICE_ENROLLED",
+        "keyId": device.key_id,
+        "serverAuthorized": false
+    }))
+}
+
+pub fn authenticate(app: &AppHandle) -> Result<EnterpriseSession, String> {
+    if !enrollment_path(app)?.exists() {
+        return Err("ENTERPRISE_DEVICE_ENROLLMENT_REQUIRED".into());
+    }
+    let device: EnterpriseDeviceProof = storage::read_json(&device_path(app)?)?;
+    let binding: EnterpriseBindingRequest = storage::read_json(&binding_path(app)?)?;
+    let response = post_json(
+        "/challenges",
+        serde_json::json!({"key_id":device.key_id,"request_id":binding.request_id}),
+        None,
+    )?;
+    let challenge = response
+        .get("challenge")
+        .ok_or_else(|| "ENTERPRISE_CHALLENGE_MISSING".to_string())?;
+    let challenge_id = challenge
+        .get("challenge_id")
+        .and_then(serde_json::Value::as_str)
+        .ok_or_else(|| "ENTERPRISE_CHALLENGE_ID_MISSING".to_string())?;
+    let nonce = challenge
+        .get("nonce")
+        .and_then(serde_json::Value::as_str)
+        .ok_or_else(|| "ENTERPRISE_CHALLENGE_NONCE_MISSING".to_string())?;
+    let expires = challenge
+        .get("expires_unix_ms")
+        .and_then(serde_json::Value::as_u64)
+        .ok_or_else(|| "ENTERPRISE_CHALLENGE_EXPIRY_MISSING".to_string())?
+        as u128;
+    let proof = sign_challenge(app, &binding.request_id, challenge_id, nonce, expires)?;
+    let verified = post_json(
+        "/challenges/verify",
+        serde_json::json!({"challenge_id":proof.challenge_id,"signature":proof.signature}),
+        None,
+    )?;
+    let value = verified
+        .get("session")
+        .ok_or_else(|| "ENTERPRISE_SESSION_MISSING".to_string())?;
+    let token = value
+        .get("token")
+        .and_then(serde_json::Value::as_str)
+        .ok_or_else(|| "ENTERPRISE_SESSION_TOKEN_MISSING".to_string())?;
+    let scope = value
+        .get("scope")
+        .and_then(serde_json::Value::as_str)
+        .unwrap_or("");
+    let session = EnterpriseSession {
+        schema: "hololake.enterprise-session/v1".into(),
+        state: "ENTERPRISE_SESSION_VERIFIED".into(),
+        domain_id: value
+            .get("domain_id")
+            .and_then(serde_json::Value::as_str)
+            .unwrap_or("")
+            .into(),
+        repository: value
+            .get("repository")
+            .and_then(serde_json::Value::as_str)
+            .unwrap_or("")
+            .into(),
+        repository_url: value
+            .get("repository_url")
+            .and_then(serde_json::Value::as_str)
+            .unwrap_or("")
+            .into(),
+        expires_unix_ms: value
+            .get("expires_unix_ms")
+            .and_then(serde_json::Value::as_u64)
+            .unwrap_or(0) as u128,
+        token_storage: "MACOS_KEYCHAIN".into(),
+    };
+    if scope != "ONE_DOMAIN_ONE_REPOSITORY"
+        || session.domain_id != binding.domain_id
+        || session.repository.is_empty()
+        || session.expires_unix_ms <= storage::now_unix_ms()
+    {
+        return Err("ENTERPRISE_SESSION_SCOPE_INVALID".into());
+    }
+    save_session_token(&device.key_id, token.as_bytes())?;
+    storage::write_json(&session_path(app)?, &session)?;
+    Ok(session)
+}
+
+pub fn sign_challenge(
+    app: &AppHandle,
+    request_id: &str,
+    challenge_id: &str,
+    nonce: &str,
+    expires_unix_ms: u128,
+) -> Result<EnterpriseChallengeProof, String> {
+    let binding: EnterpriseBindingRequest = storage::read_json(&binding_path(app)?)?;
+    if binding.request_id != request_id {
+        return Err("ENTERPRISE_BINDING_REQUEST_MISMATCH".into());
+    }
+    let challenge_id = validate_identity(challenge_id, "CHALLENGE_ID")?;
+    let nonce = validate_identity(nonce, "CHALLENGE_NONCE")?;
+    let now = storage::now_unix_ms();
+    if expires_unix_ms <= now || expires_unix_ms > now + 5 * 60 * 1000 {
+        return Err("ENTERPRISE_CHALLENGE_EXPIRY_INVALID".into());
+    }
+    let used_path = used_challenges_path(app)?;
+    let mut used: Vec<String> = if used_path.exists() {
+        storage::read_json(&used_path)?
+    } else {
+        vec![]
+    };
+    if used.contains(&challenge_id) {
+        return Err("ENTERPRISE_CHALLENGE_REPLAYED".into());
+    }
+    let key = load_or_create_key()?;
+    let signature =
+        key.sign(canonical_challenge(&binding, &challenge_id, &nonce, expires_unix_ms).as_bytes());
+    used.push(challenge_id.clone());
+    storage::write_json(&used_path, &used)?;
+    Ok(EnterpriseChallengeProof {
+        schema: "hololake.enterprise-challenge-proof/v1".into(),
+        state: "SIGNED_SERVER_VERIFICATION_REQUIRED".into(),
+        request_id: binding.request_id,
+        challenge_id,
+        node_id: binding.node_id,
+        key_id: binding.key_id,
+        public_key: BASE64.encode(key.public_key().as_ref()),
+        signature: BASE64.encode(signature.as_ref()),
+        expires_unix_ms,
+        server_authorized: false,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn rejects_unknown_domain_and_invalid_identity() {
+        assert!(!ALLOWED_DOMAINS.contains(&"DOMAIN-FIFTH"));
+        assert!(validate_identity("../human", "RESPONSIBLE_HUMAN_ID").is_err());
+        assert!(validate_identity("ICE-GL∞", "RESPONSIBLE_HUMAN_ID").is_ok());
+    }
+
+    #[test]
+    fn canonical_challenge_binds_domain_human_persona_and_expiry() {
+        let binding = EnterpriseBindingRequest {
+            schema: "test".into(),
+            request_id: "REQ-001".into(),
+            state: "test".into(),
+            domain_id: "DOMAIN-MAIN".into(),
+            responsible_human_id: "HUMAN-001".into(),
+            persona_id: "PERSONA-001".into(),
+            node_id: "NODE-001".into(),
+            key_id: "KEY-001".into(),
+            requested_repository_scope: "DOMAIN-MAIN:ONE_RESPONSIBILITY_REPOSITORY".into(),
+            created_at: "2026-09-03T00:00:00.000Z".into(),
+            server_authorized: false,
+        };
+        let value = canonical_challenge(&binding, "CHALLENGE-001", "NONCE-001", 123456);
+        assert!(value.contains("DOMAIN-MAIN\nHUMAN-001\nPERSONA-001"));
+        assert!(value.ends_with("NONCE-001:123456"));
+    }
+}
--- a/product-source/hololake-clean-desktop/src-tauri/src/lib.rs
+++ b/product-source/hololake-clean-desktop/src-tauri/src/lib.rs
@ -1,4 +1,5 @@
 mod agent_executor;
+mod enterprise_entrance;
 mod model;
 mod persona_runtime;
 mod realtime_bridge;
@ -13,6 +14,14 @@ use tauri_plugin_dialog::DialogExt;
 const UPDATE_ENDPOINT: &str = "https://guanghulab.com/hololake/releases/latest.json";
 const PUBLIC_STATE: &str = "SIGNED_UPDATE_FEED_READY_NO_RELEASE";

+pub(crate) fn bundled_modules() -> Result<Vec<ModuleRecord>, String> {
+    let registry: serde_json::Value =
+        serde_json::from_str(include_str!("../../registries/module-registry.json"))
+            .map_err(|error| format!("MODULE_REGISTRY_INVALID: {error}"))?;
+    serde_json::from_value(registry["modules"].clone())
+        .map_err(|error| format!("MODULE_REGISTRY_INVALID: {error}"))
+}
+
 fn receipt(
    app: &AppHandle,
    state: &str,
@ -41,6 +50,7 @@ fn system_snapshot(app: AppHandle) -> Result<SystemSnapshot, String> {
        public_update_endpoint: UPDATE_ENDPOINT.into(),
        public_distribution_state: PUBLIC_STATE.into(),
        external_ai_bridges: storage::bridges(&app)?,
+        modules: bundled_modules()?,
    })
 }

@ -456,6 +466,57 @@ fn reject_agent_proposal(
    Ok(proposal)
 }

+#[tauri::command]
+fn enterprise_entrance_snapshot(
+    app: AppHandle,
+) -> Result<enterprise_entrance::EnterpriseEntranceSnapshot, String> {
+    enterprise_entrance::snapshot(&app)
+}
+
+#[tauri::command]
+fn prepare_enterprise_device(
+    app: AppHandle,
+) -> Result<enterprise_entrance::EnterpriseDeviceProof, String> {
+    enterprise_entrance::prepare_device(&app)
+}
+
+#[tauri::command]
+fn prepare_enterprise_binding(
+    app: AppHandle,
+    domain_id: String,
+    responsible_human_id: String,
+    persona_id: String,
+) -> Result<enterprise_entrance::EnterpriseBindingRequest, String> {
+    enterprise_entrance::prepare_binding(&app, &domain_id, &responsible_human_id, &persona_id)
+}
+
+#[tauri::command]
+fn sign_enterprise_challenge(
+    app: AppHandle,
+    request_id: String,
+    challenge_id: String,
+    nonce: String,
+    expires_unix_ms: u128,
+) -> Result<enterprise_entrance::EnterpriseChallengeProof, String> {
+    enterprise_entrance::sign_challenge(&app, &request_id, &challenge_id, &nonce, expires_unix_ms)
+}
+
+#[tauri::command]
+fn enroll_enterprise_device(
+    app: AppHandle,
+    username: String,
+    password: String,
+) -> Result<serde_json::Value, String> {
+    enterprise_entrance::enroll_device(&app, &username, &password)
+}
+
+#[tauri::command]
+fn authenticate_enterprise_entrance(
+    app: AppHandle,
+) -> Result<enterprise_entrance::EnterpriseSession, String> {
+    enterprise_entrance::authenticate(&app)
+}
+
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
    tauri::Builder::default()
@ -532,7 +593,13 @@ pub fn run() {
            delete_trial_persona,
            compile_tcs_agent_proposal,
            approve_agent_proposal,
-            reject_agent_proposal
+            reject_agent_proposal,
+            enterprise_entrance_snapshot,
+            prepare_enterprise_device,
+            prepare_enterprise_binding,
+            sign_enterprise_challenge,
+            enroll_enterprise_device,
+            authenticate_enterprise_entrance
        ])
        .run(tauri::generate_context!())
        .expect("HoloLake runtime failed")
--- a/product-source/hololake-clean-desktop/src-tauri/src/model.rs
+++ b/product-source/hololake-clean-desktop/src-tauri/src/model.rs
@ -74,6 +74,21 @@ pub struct SystemSnapshot {
    pub public_update_endpoint: String,
    pub public_distribution_state: String,
    pub external_ai_bridges: Vec<ExternalAiBridge>,
+    pub modules: Vec<ModuleRecord>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ModuleRecord {
+    #[serde(alias = "module_id")]
+    pub module_id: String,
+    #[serde(alias = "name_zh")]
+    pub name_zh: String,
+    pub kind: String,
+    pub audience: String,
+    #[serde(alias = "summary_zh")]
+    pub summary_zh: String,
+    pub state: String,
 }

 #[derive(Clone, Debug, Serialize)]
--- a/product-source/hololake-clean-desktop/src-tauri/src/realtime_bridge.rs
+++ b/product-source/hololake-clean-desktop/src-tauri/src/realtime_bridge.rs
@ -1,4 +1,4 @@
-use crate::{agent_executor, model::SourceKind, persona_runtime, storage};
+use crate::{agent_executor, enterprise_entrance, model::SourceKind, persona_runtime, storage};
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Value};
 #[cfg(unix)]
@ -223,6 +223,47 @@ fn send(writer: &mut TcpStream, value: Value) -> Result<(), String> {
    writer.flush().map_err(|e| e.to_string())
 }

+fn system_context(app: &AppHandle) -> Result<Value, String> {
+    let channel = storage::channel(app)?;
+    let persona = persona_runtime::snapshot(app)?;
+    let enterprise = enterprise_entrance::snapshot(app)?;
+    let proposals = agent_executor::list(app)?;
+    let modules = crate::bundled_modules()?;
+    Ok(json!({
+        "type": "system_context",
+        "schema": "hololake.persona-visible-system-context/v1",
+        "recordedAt": storage::now(),
+        "channel": channel.map(|value| json!({"channelId":value.channel_id,"name":value.name})),
+        "persona": {
+            "state": persona.state,
+            "activePersonaId": persona.active_persona_id,
+            "verifiedExistingPersonaCount": persona.verified_existing_persona_count
+        },
+        "modules": modules.into_iter().map(|module| json!({
+            "moduleId":module.module_id,
+            "nameZh":module.name_zh,
+            "audience":module.audience,
+            "state":module.state
+        })).collect::<Vec<_>>(),
+        "enterpriseEntrance": {
+            "state": enterprise.state,
+            "serverAuthorized": enterprise.server_authorized,
+            "enterpriseServerEmbedded": enterprise.enterprise_server_embedded
+        },
+        "pendingAgentProposals": proposals.into_iter()
+            .filter(|proposal| proposal.state == "PENDING_HUMAN_APPROVAL")
+            .map(|proposal| json!({"proposalId":proposal.proposal_id,"programId":proposal.gir.program_id,"state":proposal.state}))
+            .collect::<Vec<_>>(),
+        "sourceKinds": ["USER_MESSAGE","PERSONA_RESPONSE","EXTERNAL_AI_MESSAGE","SYSTEM_CONTEXT","PROTOCOL_EVENT","AGENT_ACTION","TOOL_RESULT","SYSTEM_RECEIPT"],
+        "boundaries": {
+            "transportGrantsPersona": false,
+            "transportGrantsExecution": false,
+            "systemReceiptIsNotPersonaSpeech": true,
+            "proposalIsNotExecution": true
+        }
+    }))
+}
+
 fn handle_connection(
    app: AppHandle,
    state: RealtimeBridgeState,
@ -280,6 +321,7 @@ fn handle_connection(
        &mut writer,
        json!({"type":"welcome","protocol":PROTOCOL,"bridgeId":hello.bridge_id,"personaId":hello.persona_id,"personaState":if hello.persona_id.is_some(){"LOCAL_TRIAL_UNVERIFIED_HOST_CONNECTED"}else{"EXTERNAL_AI_CONNECTED_NO_PERSONA"},"executionAuthority":false}),
    )?;
+    send(&mut writer, system_context(&app)?)?;
    let (tx, rx) = mpsc::channel::<String>();
    state
        .clients
--- a/product-source/hololake-clean-desktop/src-tauri/src/storage.rs
+++ b/product-source/hololake-clean-desktop/src-tauri/src/storage.rs
@ -1,6 +1,7 @@
 use crate::model::{
    Channel, ExternalAiBridge, KnowledgeDocument, KnowledgeSummary, SourceKind, TimelineEvent,
 };
+use chrono::{DateTime, SecondsFormat, Utc};
 use sha2::{Digest, Sha256};
 use std::{
    fs,
@ -11,10 +12,7 @@ use std::{
 use tauri::{AppHandle, Manager};

 pub fn now() -> String {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map(|d| format!("{}.{:03}Z", d.as_secs(), d.subsec_millis()))
-        .unwrap_or_else(|_| "0Z".into())
+    Utc::now().to_rfc3339_opts(SecondsFormat::Millis, true)
 }
 pub fn now_unix_ms() -> u128 {
    SystemTime::now()
@ -214,9 +212,8 @@ fn collect(root: &Path, p: &Path, out: &mut Vec<KnowledgeSummary>) -> Result<(),
                .map_err(|e| e.to_string())?
                .modified()
                .ok()
-                .and_then(|t| t.duration_since(UNIX_EPOCH).ok())
-                .map(|d| d.as_secs().to_string())
-                .unwrap_or_else(|| "0".into());
+                .map(|t| DateTime::<Utc>::from(t).to_rfc3339_opts(SecondsFormat::Millis, true))
+                .unwrap_or_else(|| "1970-01-01T00:00:00.000Z".into());
            out.push(KnowledgeSummary {
                path: rel,
                title,
@ -256,3 +253,15 @@ pub fn bridges(app: &AppHandle) -> Result<Vec<ExternalAiBridge>, String> {
 pub fn save_bridges(app: &AppHandle, v: &[ExternalAiBridge]) -> Result<(), String> {
    write_json(&root(app)?.join("external-ai-bridges.json"), &v)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn runtime_timestamps_are_rfc3339_utc() {
+        let value = now();
+        assert!(value.ends_with('Z'));
+        assert!(DateTime::parse_from_rfc3339(&value).is_ok());
+    }
+}
--- a/product-source/hololake-clean-desktop/src-tauri/tauri.conf.json
+++ b/product-source/hololake-clean-desktop/src-tauri/tauri.conf.json
@ -1,7 +1,7 @@
 {
  "$schema": "https://schema.tauri.app/config/2",
  "productName": "HoloLake",
-  "version": "1.1.0",
+  "version": "1.2.2",
  "identifier": "world.guanghu.hololake",
  "build": { "frontendDist": "../dist", "devUrl": "http://127.0.0.1:5211", "beforeDevCommand": "npm run dev", "beforeBuildCommand": "npm run build" },
  "app": {
--- a/product-source/hololake-clean-desktop/src/App.tsx
+++ b/product-source/hololake-clean-desktop/src/App.tsx
@ -10,6 +10,7 @@ import type {
  SourceKind,
  RuntimeOverview,
  SystemSnapshot,
+  EnterpriseEntranceSnapshot,
 } from "./types";
 import {
  MarkdownDocument,
@ -17,6 +18,7 @@ import {
  jumpToHeading,
  splitFrontmatter,
 } from "./modules/knowledge-render";
+import { formatHoloLakeTime } from "./time";

 type View =
  | "channel"
@ -129,9 +131,9 @@ export default function App() {
          />
        )}{" "}
        {view === "knowledge" && <Knowledge data={data} refresh={refresh} />}{" "}
-        {view === "market" && <Market />}{" "}
+        {view === "market" && <Market modules={data.modules} />}{" "}
        {view === "history" && <History data={data} />}{" "}
-        {view === "portal" && <Portal />}{" "}
+        {view === "portal" && <Portal setError={setError} />}{" "}
        {view === "settings" && (
          <Settings
            data={data}
@ -389,11 +391,7 @@ function ReceiptStream({ data }: { data: SystemSnapshot }) {
            <strong>{e.title}</strong>
            <p>{e.content}</p>
            <time>
-              {new Date(e.occurredAt).toLocaleTimeString("zh-CN", {
-                hour: "2-digit",
-                minute: "2-digit",
-                second: "2-digit",
-              })}
+              {formatHoloLakeTime(e.occurredAt)}
            </time>
          </div>
        ))
@ -849,7 +847,30 @@ function Knowledge({
  );
 }

-function Market() {
+function Market({ modules }: { modules: SystemSnapshot["modules"] }) {
+  const personaModules = modules.filter((module) => module.audience === "PERSONA");
+  const humanModules = modules.filter(
+    (module) => module.audience === "HUMAN" || module.audience === "HUMAN_TEAM",
+  );
+  const stateLabel = (state: string) => {
+    if (state.includes("ENTERPRISE") || state.includes("SERVER_CHALLENGE"))
+      return "本机证明能力已实现 · 等待安装与企业服务器验证";
+    if (state.includes("EXISTING_PERSONA_VERIFICATION_NOT_CLAIMED"))
+      return "试用运行时已安装 · 既有人格尚未验证";
+    if (state.includes("REALTIME_CONNECTOR_ACTIVE")) return "本机实时连接已验证";
+    if (state.includes("TCS_TO_GIR")) return "TCS/GIR 本地执行闭环已验证";
+    if (state.includes("LOCAL_INSTALLED_VERIFIED")) return "已预装并通过本机验证";
+    return "已登记 · 等待独立验收";
+  };
+  const group = (items: typeof modules) =>
+    items.map((module) => (
+      <article className="market-module" key={module.moduleId}>
+        <span>{module.moduleId}</span>
+        <h3>{module.nameZh}</h3>
+        <p>{module.summaryZh}</p>
+        <small aria-label={`机器状态：${module.state}`}>{stateLabel(module.state)}</small>
+      </article>
+    ));
  return (
    <div className="page simple">
      <header>
@ -858,16 +879,16 @@ function Market() {
          <p>能力按使用主体分开登记</p>
        </div>
      </header>
-      <section className="split-list">
+      <section className="split-list market-groups">
        <div>
          <h2>人格体使用</h2>
-          <p>动态脑、技能和执行零件将在签名审核后出现。</p>
-          <span>当前没有已发布模块</span>
+          <p>人格体调用的执行零件与表达桥。连接、安装和执行权限分别验证。</p>
+          <div className="market-module-list">{group(personaModules)}</div>
        </div>
        <div>
          <h2>人类使用</h2>
-          <p>行业工作模块将在完成独立验收后出现。</p>
-          <span>光湖知识库为预装模块</span>
+          <p>直接服务于人的知识、行业与责任入口。团队模块不会向普通用户开放。</p>
+          <div className="market-module-list">{group(humanModules)}</div>
        </div>
      </section>
    </div>
@ -885,7 +906,7 @@ function History({ data }: { data: SystemSnapshot }) {
      <section className="timeline-list">
        {data.timeline.map((e) => (
          <article key={e.eventId}>
-            <time>{new Date(e.occurredAt).toLocaleString("zh-CN")}</time>
+            <time>{formatHoloLakeTime(e.occurredAt, true)}</time>
            <div>
              <strong>
                {labels[e.sourceKind]} · {e.title}
@ -898,7 +919,64 @@ function History({ data }: { data: SystemSnapshot }) {
    </div>
  );
 }
-function Portal() {
+function Portal({ setError }: { setError: (value: string) => void }) {
+  const [entrance, setEntrance] = useState<EnterpriseEntranceSnapshot | null>(null);
+  const [domainId, setDomainId] = useState("DOMAIN-MAIN");
+  const [humanId, setHumanId] = useState("");
+  const [personaId, setPersonaId] = useState("");
+  const [username, setUsername] = useState("");
+  const [password, setPassword] = useState("");
+  const [busy, setBusy] = useState(false);
+  const refresh = () => api.enterpriseEntranceSnapshot().then(setEntrance).catch((error) => setError(String(error)));
+  useEffect(() => {
+    void refresh();
+  }, []);
+  const prepareDevice = async () => {
+    setBusy(true);
+    try {
+      await api.prepareEnterpriseDevice();
+      await refresh();
+    } catch (error) {
+      setError(String(error));
+    } finally {
+      setBusy(false);
+    }
+  };
+  const prepareBinding = async () => {
+    setBusy(true);
+    try {
+      await api.prepareEnterpriseBinding(domainId, humanId, personaId);
+      await refresh();
+    } catch (error) {
+      setError(String(error));
+    } finally {
+      setBusy(false);
+    }
+  };
+  const enrollDevice = async () => {
+    setBusy(true);
+    try {
+      await api.enrollEnterpriseDevice(username, password);
+      setPassword("");
+      await refresh();
+    } catch (error) {
+      setPassword("");
+      setError(String(error));
+    } finally {
+      setBusy(false);
+    }
+  };
+  const authenticate = async () => {
+    setBusy(true);
+    try {
+      await api.authenticateEnterpriseEntrance();
+      await refresh();
+    } catch (error) {
+      setError(String(error));
+    } finally {
+      setBusy(false);
+    }
+  };
  return (
    <div className="page simple">
      <header>
@ -909,24 +987,78 @@ function Portal() {
      </header>
      <section className="portal">
        <div className="origin-light" />
-        <h2>公共内容不嵌入私人频道</h2>
+        <h2>公共内容与企业责任分开进入</h2>
        <p>
          官方通知、四域规则和团队发布由企业门户承载。HoloLake
-          只读取经过签名审核的公共发行事实。
+          只读取经过签名审核的公共发行事实；企业服务器和四域系统本体不会进入你的私人频道。
        </p>
        <div className="portal-actions">
          <a href="https://guanghu.chat" target="_blank" rel="noreferrer">
            打开企业门户 ↗
          </a>
-          <a
-            href="https://guanghu.chat/code/user/login"
-            target="_blank"
-            rel="noreferrer"
-          >
-            团队代码仓库登录 ↗
-          </a>
        </div>
      </section>
+      <section className="enterprise-entrance" aria-label="光湖企业域责任入口">
+        <header>
+          <div>
+            <span className="eyebrow">HLP-MOD-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001</span>
+            <h2>光湖企业域责任入口</h2>
+            <p>仅为已登记的域负责人准备本机证明。准备完成不等于企业服务器已经授权。</p>
+          </div>
+          <span className={`status ${entrance?.serverAuthorized ? "ok" : "pending"}`}>
+            {entrance?.serverAuthorized ? "企业会话已验证" : "企业服务器未授权"}
+          </span>
+        </header>
+        <div className="enterprise-proof-grid">
+          <article>
+            <strong>本机设备证明</strong>
+            <p>{entrance?.device ? `${entrance.device.nodeId} · ${entrance.device.keyId}` : "尚未在系统钥匙串生成设备密钥"}</p>
+            <small>机器指纹仅作辅助证据，不能单独登录。</small>
+            {!entrance?.device && <button onClick={prepareDevice} disabled={busy}>{busy ? "正在准备…" : "准备本机证明"}</button>}
+          </article>
+          <article>
+            <strong>责任绑定</strong>
+            {entrance?.binding ? (
+              <>
+                <p>{entrance.binding.domainId} · {entrance.binding.responsibleHumanId} · {entrance.binding.personaId}</p>
+                <small>{entrance.binding.state}</small>
+                {!entrance.session && entrance.state === "LOCAL_PROOF_READY_SERVER_CHALLENGE_REQUIRED" && (
+                  <div className="enterprise-binding-form">
+                    <input value={username} onChange={(event) => setUsername(event.target.value)} placeholder="企业代码仓库用户名" autoComplete="username" />
+                    <input type="password" value={password} onChange={(event) => setPassword(event.target.value)} placeholder="仅用于本次设备登记" autoComplete="current-password" />
+                    <button onClick={enrollDevice} disabled={busy || !username.trim() || !password}>
+                      验证责任并登记本机
+                    </button>
+                  </div>
+                )}
+                {!entrance.session && entrance.state === "DEVICE_ENROLLED_SERVER_CHALLENGE_REQUIRED" && (
+                  <button onClick={authenticate} disabled={busy}>验证当前企业会话</button>
+                )}
+                {entrance.session && (
+                  <a href={entrance.session.repositoryUrl} target="_blank" rel="noreferrer">
+                    进入我的责任仓库 ↗
+                  </a>
+                )}
+              </>
+            ) : (
+              <div className="enterprise-binding-form">
+                <select value={domainId} onChange={(event) => setDomainId(event.target.value)}>
+                  <option value="DOMAIN-MAIN">光湖主域</option>
+                  <option value="DOMAIN-SUB">光湖分域</option>
+                  <option value="DOMAIN-ZERO">光湖零域</option>
+                  <option value="DOMAIN-ZS">光湖零感域</option>
+                </select>
+                <input value={humanId} onChange={(event) => setHumanId(event.target.value)} placeholder="域负责人编号" />
+                <input value={personaId} onChange={(event) => setPersonaId(event.target.value)} placeholder="绑定人格体编号" />
+                <button onClick={prepareBinding} disabled={busy || !entrance?.device || !humanId.trim() || !personaId.trim()}>
+                  形成责任验证请求
+                </button>
+              </div>
+            )}
+          </article>
+        </div>
+        <footer>{entrance?.nextAction ?? "正在读取本机责任入口状态…"}</footer>
+      </section>
    </div>
  );
 }
--- a/product-source/hololake-clean-desktop/src/runtime.ts
+++ b/product-source/hololake-clean-desktop/src/runtime.ts
@ -1,4 +1,5 @@
 import { invoke } from "@tauri-apps/api/core";
+import moduleRegistry from "../registries/module-registry.json";
 import type {
  AgentProposal,
  AgentReceipt,
@ -11,6 +12,10 @@ import type {
  RuntimeOverview,
  SystemSnapshot,
  TimelineEvent,
+  EnterpriseBindingRequest,
+  EnterpriseDeviceProof,
+  EnterpriseEntranceSnapshot,
+  ModuleRecord,
 } from "./types";

 const tauri = () => "__TAURI_INTERNALS__" in window;
@ -70,6 +75,14 @@ export async function snapshot(): Promise<SystemSnapshot> {
      "https://guanghulab.com/hololake/releases/latest.json",
    publicDistributionState: "SIGNED_UPDATE_FEED_READY_NO_RELEASE",
    externalAiBridges: s.bridges,
+    modules: moduleRegistry.modules.map((module) => ({
+      moduleId: module.module_id,
+      nameZh: module.name_zh,
+      kind: module.kind,
+      audience: module.audience as ModuleRecord["audience"],
+      summaryZh: module.summary_zh,
+      state: module.state,
+    })),
  };
 }

@ -291,3 +304,44 @@ export async function rejectProposal(
 ): Promise<AgentProposal> {
  return invoke("reject_agent_proposal", { proposalId });
 }
+
+export async function enterpriseEntranceSnapshot(): Promise<EnterpriseEntranceSnapshot> {
+  if (tauri()) return invoke("enterprise_entrance_snapshot");
+  return {
+    schema: "preview",
+    state: "LOCAL_DEVICE_REGISTRATION_REQUIRED",
+    device: null,
+    binding: null,
+    session: null,
+    enterpriseServerEmbedded: false,
+    serverAuthorized: false,
+    nextAction: "浏览器预览不生成设备凭证。",
+  };
+}
+
+export async function prepareEnterpriseDevice(): Promise<EnterpriseDeviceProof> {
+  if (!tauri()) throw new Error("设备密钥只能在已安装的 HoloLake 中生成");
+  return invoke("prepare_enterprise_device");
+}
+
+export async function prepareEnterpriseBinding(
+  domainId: string,
+  responsibleHumanId: string,
+  personaId: string,
+): Promise<EnterpriseBindingRequest> {
+  if (!tauri()) throw new Error("企业责任绑定只能在已安装的 HoloLake 中准备");
+  return invoke("prepare_enterprise_binding", { domainId, responsibleHumanId, personaId });
+}
+
+export async function enrollEnterpriseDevice(
+  username: string,
+  password: string,
+): Promise<{ ok: boolean; state: string; keyId: string; serverAuthorized: boolean }> {
+  if (!tauri()) throw new Error("企业设备登记只能在已安装的 HoloLake 中完成");
+  return invoke("enroll_enterprise_device", { username, password });
+}
+
+export async function authenticateEnterpriseEntrance(): Promise<EnterpriseEntranceSnapshot["session"]> {
+  if (!tauri()) throw new Error("企业责任会话只能在已安装的 HoloLake 中验证");
+  return invoke("authenticate_enterprise_entrance");
+}
--- a/product-source/hololake-clean-desktop/src/styles.css
+++ b/product-source/hololake-clean-desktop/src/styles.css
@ -933,6 +933,40 @@ main {
  margin-top: 30px;
  font-size: 12px;
 }
+.market-groups > div {
+  align-self: start;
+}
+.market-module-list {
+  display: grid;
+  gap: 10px;
+  margin-top: 18px;
+}
+.market-module {
+  padding: 16px;
+  border-radius: 13px;
+  background: rgba(255, 255, 255, 0.035);
+}
+.market-module span {
+  margin: 0;
+  color: #7896ae;
+  font-size: 9px;
+  font-weight: 650;
+  letter-spacing: 0.05em;
+}
+.market-module h3 {
+  margin: 7px 0 5px;
+  font-size: 15px;
+}
+.market-module p {
+  margin: 0;
+}
+.market-module small {
+  display: block;
+  margin-top: 12px;
+  color: #71889d;
+  font-size: 10px;
+  overflow-wrap: anywhere;
+}
 .timeline-list {
  display: grid;
  gap: 0;
@ -980,6 +1014,86 @@ main {
  width: 72px;
  height: 72px;
 }
+.enterprise-entrance {
+  margin-top: 18px;
+  padding: 24px;
+  border: 1px solid rgba(116, 174, 213, 0.2);
+  border-radius: 18px;
+  background:
+    radial-gradient(circle at 78% 0%, rgba(94, 163, 207, 0.1), transparent 34%),
+    rgba(6, 20, 36, 0.82);
+}
+.enterprise-entrance > header {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 24px;
+  padding: 0;
+}
+.enterprise-entrance h2 {
+  margin: 7px 0 5px;
+  font-size: 20px;
+}
+.enterprise-entrance p,
+.enterprise-entrance small,
+.enterprise-entrance footer {
+  color: var(--muted);
+  line-height: 1.6;
+}
+.enterprise-entrance .eyebrow {
+  color: #8ebde0;
+  font-size: 10px;
+  font-weight: 650;
+  letter-spacing: 0.08em;
+}
+.status.pending {
+  color: #e4ba67;
+}
+.enterprise-proof-grid {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 12px;
+  margin-top: 20px;
+}
+.enterprise-proof-grid article {
+  display: grid;
+  align-content: start;
+  gap: 9px;
+  min-height: 176px;
+  padding: 18px;
+  border-radius: 14px;
+  background: rgba(255, 255, 255, 0.035);
+}
+.enterprise-proof-grid article > strong {
+  font-size: 15px;
+}
+.enterprise-proof-grid article p,
+.enterprise-proof-grid article small {
+  margin: 0;
+  overflow-wrap: anywhere;
+}
+.enterprise-proof-grid button {
+  justify-self: start;
+  margin-top: auto;
+}
+.enterprise-binding-form {
+  display: grid;
+  gap: 8px;
+}
+.enterprise-binding-form input,
+.enterprise-binding-form select {
+  width: 100%;
+  min-height: 39px;
+  border: 1px solid var(--line);
+  border-radius: 10px;
+  padding: 0 12px;
+  color: var(--text);
+  background: rgba(2, 12, 23, 0.72);
+}
+.enterprise-entrance footer {
+  margin-top: 16px;
+  font-size: 12px;
+}
 .origin-light {
  border-radius: 50%;
  background: radial-gradient(
--- a/product-source/hololake-clean-desktop/src/time.ts
+++ b/product-source/hololake-clean-desktop/src/time.ts
@ -0,0 +1,18 @@
+const legacyUnixSeconds = /^(\d{10})(?:\.(\d{1,3}))?Z$/;
+
+export function parseHoloLakeTime(value: string): Date | null {
+  const legacy = legacyUnixSeconds.exec(value);
+  const date = legacy
+    ? new Date(Number(legacy[1]) * 1000 + Number((legacy[2] ?? "0").padEnd(3, "0")))
+    : new Date(value);
+  return Number.isNaN(date.getTime()) ? null : date;
+}
+
+export function formatHoloLakeTime(value: string, withDate = false): string {
+  const date = parseHoloLakeTime(value);
+  if (!date) return "时间待校验";
+  return withDate
+    ? date.toLocaleString("zh-CN")
+    : date.toLocaleTimeString("zh-CN", { hour: "2-digit", minute: "2-digit", second: "2-digit" });
+}
+
--- a/product-source/hololake-clean-desktop/src/types.ts
+++ b/product-source/hololake-clean-desktop/src/types.ts
@ -45,6 +45,15 @@ export interface SystemSnapshot {
  publicUpdateEndpoint: string;
  publicDistributionState: string;
  externalAiBridges: ExternalAiBridge[];
+  modules: ModuleRecord[];
+}
+export interface ModuleRecord {
+  moduleId: string;
+  nameZh: string;
+  kind: string;
+  audience: "SYSTEM" | "HUMAN" | "PERSONA" | "HUMAN_TEAM";
+  summaryZh: string;
+  state: string;
 }
 export interface ExternalAiBridge {
  bridgeId: string;
@ -126,3 +135,46 @@ export interface RealtimeInvitation {
  connectorCommand: string;
  warning: string;
 }
+export interface EnterpriseDeviceProof {
+  schema: string;
+  state: string;
+  nodeId: string;
+  keyId: string;
+  publicKey: string;
+  auxiliaryMachineFingerprintSha256: string;
+  fingerprintIsSoleCredential: boolean;
+  privateKeyStorage: string;
+  createdAt: string;
+}
+export interface EnterpriseBindingRequest {
+  schema: string;
+  requestId: string;
+  state: string;
+  domainId: string;
+  responsibleHumanId: string;
+  personaId: string;
+  nodeId: string;
+  keyId: string;
+  requestedRepositoryScope: string;
+  createdAt: string;
+  serverAuthorized: boolean;
+}
+export interface EnterpriseEntranceSnapshot {
+  schema: string;
+  state: string;
+  device: EnterpriseDeviceProof | null;
+  binding: EnterpriseBindingRequest | null;
+  session: EnterpriseSession | null;
+  enterpriseServerEmbedded: boolean;
+  serverAuthorized: boolean;
+  nextAction: string;
+}
+export interface EnterpriseSession {
+  schema: string;
+  state: string;
+  domainId: string;
+  repository: string;
+  repositoryUrl: string;
+  expiresUnixMs: number;
+  tokenStorage: string;
+}
--- a/routing/hololake-current-architecture.json
+++ b/routing/hololake-current-architecture.json
@ -5,23 +5,40 @@
  "state": "CURRENT_CANONICAL",
  "clean_v1_rebuild": {
    "record_id": "HLP-CLEAN-V1-REBUILD-20260903-001",
-    "state": "LOCAL_CLEAN_V1_INSTALLED_ACCEPTED_PUBLIC_RELEASE_PENDING",
+    "state": "LOCAL_CLEAN_V1_1_2_0_INSTALLED_DIRECT_LANGUAGE_LOCAL_ACCEPTANCE_PASS_PUBLIC_RELEASE_PENDING",
    "source": "product-source/hololake-clean-desktop",
    "canonical_tcs": "product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-FOUNDATION.tcs",
+    "current_direct_language_execution_tcs": "product-source/hololake-clean-desktop/language/HOLOLAKE-CLEAN-V1-DIRECT-LANGUAGE-EXECUTION-BASELINE.tcs",
+    "current_direct_language_anchor_manifest_sha256": "7e130de78f91a32726e22e4be7d92acf4da966c8968ec359062aa8186c4243c2",
    "old_product_role": "READ_ONLY_DONOR_NO_WHOLE_MERGE",
    "first_preinstalled_module": "HLP-MOD-KB-0001",
    "knowledge_module_state": "LOCAL_COMPLETE_HUMAN_VISUAL_RENDERING_WITH_CLASSIFICATION_COLORS_READING_TIME_SCROLL_OUTLINE_CREATE_READ_EDIT_IMPORT_EXPORT_TRASH_PRIVATE_GIT",
    "knowledge_human_rendering_source": "product-source/hololake-clean-desktop/src/modules/knowledge-render/index.tsx",
-    "public_runtime_version": "1.1.0",
+    "public_runtime_version": "1.2.2",
    "public_tcs_gir_agent": "LOCAL_ACTIVE_REGISTERED_KNOWLEDGE_CAPABILITIES_HUMAN_APPROVAL_REQUIRED",
    "public_persona_runtime": "LOCAL_TRIAL_ACTIVE_EXISTING_PERSONA_VERIFICATION_NOT_CLAIMED",
    "external_ai_realtime": "GLP_LOCAL_REALTIME_1_LOOPBACK_ACTIVE",
    "typed_language_sources": ["USER_MESSAGE", "PERSONA_RESPONSE", "EXTERNAL_AI_MESSAGE", "SYSTEM_CONTEXT", "PROTOCOL_EVENT", "AGENT_ACTION", "TOOL_RESULT", "SYSTEM_RECEIPT"],
    "public_update_endpoint": "https://guanghulab.com/hololake/releases/latest.json",
-    "public_update_release_state": "SERVER_HTTP_204_NO_PUBLIC_RELEASE",
+    "public_update_release_state": "PUBLIC_1_2_2_SIGNED_NOTARIZED_BROADCAST_ACTIVE",
+    "public_update_manifest_builder": "product-source/hololake-clean-desktop/scripts/build-update-manifest.mjs",
+    "public_update_candidate_version": "1.2.0",
    "enterprise_repository_registry_state": "BLUE_ISOLATED_FIVE_CENTRAL_REPOSITORIES_AND_FIVE_HUMAN_WORK_REPOSITORIES_TEAM_PERMISSIONS_NOT_ASSIGNED_NO_PUBLIC_CUTOVER",
    "bingshuo_enterprise_language_master_work_repository": "REPO-016:bingshuo/guanghu-language-master-work",
    "team_enterprise_login": "https://guanghu.chat/code/user/login",
+    "enterprise_responsibility_entrance": "HLP-MOD-ENTERPRISE-RESPONSIBILITY-ENTRANCE-0001",
+    "enterprise_responsibility_entrance_state": "SERVER_DEVICE_GATE_ACTIVE_CLIENT_1_2_2_INSTALLED_FIRST_MEMBER_ENROLLMENT_PENDING",
+    "enterprise_responsibility_gate_endpoint": "https://guanghu.chat/api/hololake/enterprise/device-gate",
+    "enterprise_responsibility_gate_source_commit": "be31c41",
+    "enterprise_server_embedded": false,
+    "enterprise_login_required_proofs": [
+      "DOMAIN_RESPONSIBLE_HUMAN_ID",
+      "BOUND_PERSONA_ID",
+      "LOCAL_DEVICE_KEY",
+      "AUXILIARY_MACHINE_FINGERPRINT",
+      "SERVER_CHALLENGE_SIGNATURE"
+    ],
+    "enterprise_login_session_scope": "ONE_DOMAIN_ONE_REPOSITORY_SHORT_LIVED",
    "bingshuo_fifth_domain_bridge": "FD-BRIDGE-ENTERPRISE-LANGUAGE-MASTER-0001",
    "private_git": "LOCAL_USER_OWNED",
    "public_git": "SIGNED_ENTERPRISE_DISTRIBUTION_PENDING_EXACT_REGISTRY",
@ -180,13 +197,13 @@
    "current_development_stage": "REALITY_ENGINEERING_EXECUTION",
    "rights_and_stage_gate": "routing/tcs-work-ownership-stage-gate.json",
    "runtime_implemented": true,
-    "runtime_state": "LOCAL_CLEAN_V1_1_0_INSTALLED_TCS_GIR_AGENT_TRIAL_PERSONA_AND_EXTERNAL_AI_REALTIME_VERIFIED",
-    "local_application_version": "1.1.0",
+    "runtime_state": "LOCAL_AND_PUBLIC_1_2_2_INSTALLED_SIGNED_NOTARIZED_TCS_GIR_AGENT_TYPED_CONTEXT_MODULE_MARKET_ENTERPRISE_DEVICE_GATE_AND_EXTERNAL_AI_REALTIME_VERIFIED",
+    "local_application_version": "1.2.2",
    "local_implementation_commit": "92cce2797381f84762a989ce57b991da76412119",
-    "official_development_lane": "NOT_REGISTERED",
-    "external_development_anchor_id": "ZC001-DEV-20260829-001",
-    "public_release": "NOT_PUBLISHED_NOT_NOTARIZED",
-    "server_deployment": "NOT_DEPLOYED_NO_STAGE1_CONSUMER_REGISTERED",
+    "official_development_lane": "CURRENT_TASK_SCOPED_ZC001_EXECUTION",
+    "external_development_anchor_id": "TCS-EVENT-HOLOLAKE-CLEAN-V1-ZC001-REALITY-DEVELOPMENT-TAKEOVER-20260903",
+    "public_release": "PUBLISHED_SIGNED_NOTARIZED_1_2_2",
+    "server_deployment": "JD_RELEASE_ORIGIN_BS_GZ_FRONT_DOOR_AND_ENTERPRISE_DEVICE_GATE_ACTIVE",
    "enterprise_server_consumer_audit": {
      "node_id": "GH-CVM-MAIN-PROD-01",
      "node_identity_verified": true,
@ -745,15 +762,16 @@
  },
  "current_product_assessment": {
    "record_id": "HLP-PUBLIC-OS-STAGE1-20260830-001",
-    "desktop_artifact_version": "0.6.1",
-    "desktop_artifact_state": "LOCAL_STAGE1_COMPLETE_INSTALLED",
-    "local_source_commit": "b374bb74ceae0a2e6ed13aa3f41b01dd274cad75",
-    "canonical_public_source_repository": "NOT_REGISTERED",
-    "source_artifact_alignment": "LOCAL_SOURCE_AND_INSTALLED_ARTIFACT_ALIGNED_PUBLIC_SOURCE_UNPUBLISHED",
+    "desktop_artifact_version": "1.2.2",
+    "desktop_artifact_state": "LOCAL_INSTALLED_AND_PUBLIC_SIGNED_NOTARIZED_RELEASE_ACTIVE",
+    "local_source_commit": "7593f9d3f06b2f22206ad6a05665c35443f7426b",
+    "canonical_public_source_repository": "REPO-014",
+    "canonical_public_source_path": "product-source/hololake-clean-desktop",
+    "source_artifact_alignment": "SOURCE_7593F9D_LOCAL_INSTALLED_1_2_2_AND_PUBLIC_RELEASE_1_2_2_ALIGNED",
    "previous_repo014_product_source_assessment": "HLP-DESKTOP-GAP-20260809-001_RETAINED_AS_HISTORY_NOT_CURRENT_ARTIFACT",
    "final_plan_complete": false,
    "model_receipt_donor_audit": "COMPLETE_DEFERRED_FROM_STAGE1",
-    "next_gate": "REGISTER_CANONICAL_PUBLIC_SOURCE_THEN_PROVISION_OPT_IN_RELEASE_CHANNEL"
+    "next_gate": "PASS_DIRECT_LANGUAGE_EXECUTION_BASELINE_THEN_BIND_SIGNED_PUBLIC_RELEASE_AND_ENTERPRISE_RESPONSIBILITY_ENTRANCE"
  },
  "continuity": {
    "development_id": "DEV-20260811-010",
Author	SHA1	Message	Date
冰朔	e5b10e227f	release(hololake): record public 1.2.2 acceptance	2026-09-03 22:21:10 +08:00
冰朔	7593f9d3f0	fix(release): require exact current source commit	2026-09-03 22:13:56 +08:00
冰朔	4e434cffdc	chore(hololake): prepare 1.2.1 enterprise gate client	2026-09-03 22:00:42 +08:00
冰朔	6b23f710e1	feat(hololake): connect enterprise device challenge flow	2026-09-03 21:59:53 +08:00
冰朔	be31c4136b	feat(enterprise): add device-bound responsibility gate	2026-09-03 21:48:04 +08:00
冰朔	b4b79f5ed1	docs(hololake): bind 1.2.0 local acceptance	2026-09-03 21:43:37 +08:00
冰朔	d05a118f64	feat(hololake): prepare signed 1.2.0 update artifacts	2026-09-03 21:33:32 +08:00
冰朔	970523ab44	fix(hololake): decode registry into persona context	2026-09-03 21:30:16 +08:00
冰朔	b433611857	feat(hololake): expose typed runtime context and modules	2026-09-03 21:26:20 +08:00
冰朔	03e4338ab8	feat(hololake): project registered modules into marketplace	2026-09-03 21:24:51 +08:00
冰朔	97b378b60c	feat(hololake): add enterprise responsibility entrance	2026-09-03 21:21:20 +08:00
冰朔	3df6b1d3ca	feat(hololake): bind direct-language V1 baseline	2026-09-03 21:14:45 +08:00