{
  "schema": "guanghu.jd-native-public-projection-contract/v1",
  "contract_id": "GHOS-JD-NATIVE-PUBLIC-PROJECTION-001",
  "state": "SOURCE_AND_ISOLATED_TEST_ONLY",
  "causal_route": [
    "JD-FD-PRIMARY",
    "BS-SG-003",
    "BS-GZ-006"
  ],
  "why": {
    "problem": "The current BS-GZ-006 public route depends on SSH tunnels terminated by JD Linux and therefore cannot survive Guanghu native residency.",
    "separation": "The native heartbeat proves current liveness only; public bytes come from a pinned repository snapshot and never from relay input.",
    "transport": "A dedicated SSH identity and forced command carry only a bounded ready or dormant state transition from BS-SG-003 to BS-GZ-006.",
    "failure_mode": "Missing, malformed, mismatched, dormant, future-dated, or stale state fails closed with HTTP 503."
  },
  "bindings": {
    "native_node": "JD-FD-PRIMARY",
    "relay_node": "BS-SG-003",
    "front_door_node": "BS-GZ-006",
    "native_candidate_sha256": "9807fa751616d4b421c103d60eecface1c5eb8013cbd89417ef9e027da281fb3",
    "snapshot_repository_id": "REPO-012",
    "snapshot_branch": "main",
    "snapshot_source_commit": "fb1096c5ecdcfb36015d51273f487c2f36d9c9cd",
    "expected_native_nat_source": "111.228.0.139"
  },
  "authentication": {
    "native_to_relay": {
      "evidence": "EXISTING_SOURCE_BOUND_SIX_SEQUENCE_NATIVE_HEARTBEAT",
      "meaning": "NATIVE_LIVENESS_AND_RESIDENCY_ONLY",
      "may_supply_public_content": false,
      "max_receipt_age_seconds": 15
    },
    "relay_to_front_door": {
      "transport": "DEDICATED_SSH_KEY_WITH_FORCED_COMMAND",
      "allowed_actions": [
        "ready",
        "dormant"
      ],
      "pty": false,
      "port_forwarding": false,
      "agent_forwarding": false,
      "x11_forwarding": false,
      "command_fields_are_exact_and_pinned": true
    }
  },
  "public_bytes": {
    "provenance": "PINNED_REPO_012_SNAPSHOT",
    "relay_may_supply_or_mutate_bytes": false,
    "anchor_schema": "guanghu.public-navigation-anchor/v1",
    "code_schema": "guanghu.native-code-channel-read-only/v1",
    "full_forgejo_equivalence": false
  },
  "front_door_projection": {
    "listen_scope": "LOOPBACK_ONLY",
    "shadow_port": 19223,
    "state_max_age_seconds": 15,
    "paths": [
      "/api/ai/v1/anchor",
      "/api/ai/v1/code-channel"
    ],
    "methods": [
      "GET",
      "HEAD"
    ],
    "stale_or_invalid_http_status": 503,
    "nginx_route_switch_authorized": false
  },
  "acceptance_gates": {
    "contract_source": 100,
    "isolated_end_to_end_test": 100,
    "bs_gz_shadow_receiver_deployed": 0,
    "bs_sg_authenticated_projector_deployed": 0,
    "live_native_freshness_readback": 0,
    "nginx_public_route_switched": 0,
    "public_native_anchor_equivalence": 0,
    "public_native_code_channel_equivalence": 0,
    "full_forgejo_equivalence": 0,
    "production_native_cutover": 0
  },
  "prohibited_claims": [
    "HEARTBEAT_IS_CONTENT_PROVENANCE",
    "RELAY_ACK_IS_NATIVE_AUTHORIZATION",
    "SHADOW_LOOPBACK_DEPLOYMENT_IS_PUBLIC_CUTOVER",
    "READ_ONLY_CODE_SNAPSHOT_IS_FULL_FORGEJO",
    "SOURCE_AND_TEST_PASS_IS_LIVE_SERVER_DEPLOYMENT",
    "PUBLIC_LINUX_TUNNEL_PROVES_NATIVE_RESIDENCY"
  ]
}