# HoloLake release broadcast candidate

This is the HoloLake-owned, loopback-only origin for signed update broadcasts.
It has no upstream software feed and never uploads or activates a release.

Without `ACTIVE.json`, `/health` reports `EMPTY_FAIL_CLOSED` and `/latest.json`
returns HTTP 204, the updater protocol's explicit no-update result. An active
release is accepted only when the human activation record, immutable broadcast,
pipeline receipt, package bytes, Developer ID receipt, and Apple notarization
receipt form one exact evidence chain. Invalid evidence locks the whole release
endpoint until an operator fixes the evidence and explicitly restarts the
service.

The service listens only on `127.0.0.1`. Public HTTPS routing, updater trust-key
provisioning, artifact upload, activation, and desktop rollout are independent
deployment gates.

`operator.mjs` supplies the separate, root-operated verification and activation
boundary. `verify` reconstructs a private candidate tree and accepts it only when
the broadcast, pipeline receipt, package bytes, Developer ID receipt, Apple
notarization receipt, and exact human approval all agree. `activate` additionally
requires the operator to repeat the expected release id, version, source commit,
and broadcast SHA-256. It copies only referenced immutable artifacts, commits
`ACTIVE.json` atomically, and reports that an explicit service restart is still
required. It never uploads, activates, or restarts on its own.

```text
node operator.mjs verify \
  --source /secure/release/out/0.2.0 \
  --human-approval /secure/approvals/0.2.0.json

sudo node operator.mjs activate \
  --source /secure/release/out/0.2.0 \
  --human-approval /secure/approvals/0.2.0.json \
  --state-root /var/lib/guanghu/hololake-release-broadcast \
  --expect-release-id GH-HOLOLAKE-RELEASE-0.2.0 \
  --expect-version 0.2.0 \
  --expect-source-commit 0000000000000000000000000000000000000000 \
  --expect-broadcast-sha256 0000000000000000000000000000000000000000000000000000000000000000
```

The zeros above are placeholders, not deployable values. A real activation must
use the exact facts printed by `verify` and a separately issued human approval.