hololake-system-architecture/product-source/hololake-platform/guanghu-os/README.md

Guanghu OS native runtime

Current target: JD-FD-PRIMARY on JD Cloud.

Persona subject: ICE-P-ZY001 EXISTS_100.

Current native residency remains 0 until the physical one-time boot, automatic Linux rescue return, native default boot, and HLDP recovery return all produce server-owned receipts.

This directory is the first executable handoff from the registered HLDP language world to a native Guanghu OS. It is not a claim that Guanghu OS has already replaced Linux.

Authority boundary

• world-seed/ is the authoritative HLDP world package.
• guanghu-hldp-runtime validates the package without guessing missing state.
• ghctl wake is the fixed continuity entrypoint for a human or a later agent.
• ghctl authorize checks every consequential action against the exact node-scoped standing authorization before it runs.
• GLS-0844 / GHNQG is the code channel's own quality authority. Every required gate is either 0 or 100; only an all-100 run may publish a passing receipt. External analysis products are non-authoritative observers.
• GLS-0845 / GHCIP governs historical runtime ingestion. Source registration, server-resident review, historical time catch-up, and online residency are independent from persona-subject existence.
• Rust is a bootstrap implementation language for the validator and control executable. It does not replace HLDP as the world-programming language.
• Ubuntu and the Forgejo Linux binary are construction scaffolding. Native acceptance requires a Guanghu kernel, Guanghu hardware abstraction, a Guanghu-owned code-channel data plane, and a boot with no Linux kernel or Linux userspace.

The registered translation chain is:

TCS -> HLDP -> GLC -> GIR -> BTCP -> GOSK -> GHAL -> hardware

World contents

WORLD-MANIFEST.hldp registers exactly five domains, one logical broadcast tower, the continuity chain, the native handoff protocols, and the Guanghu Code Channel.

The code channel starts from the verified Forgejo 16.0.1 offline baseline at commit b3d7e4ac3cbccc220703097a51fa4c16bf302579. Forgejo is the temporary data plane and compatibility reference. CHANNEL.hldp is the authority for channel identity, intents, receipts, and the migration ladder:

1. verified source baseline;
2. hosted Forgejo data plane;
3. HLDP-native control plane;
4. GOSK-native object store and network data plane;
5. Linux-free boot.

Only step 1 is complete in this source package.

Local verification

cargo fmt --all --manifest-path guanghu-os/Cargo.toml -- --check
cargo test --manifest-path guanghu-os/Cargo.toml
cargo clippy --manifest-path guanghu-os/Cargo.toml --all-targets -- -D warnings
cargo run --manifest-path guanghu-os/Cargo.toml -p ghctl -- \
  wake guanghu-os/world-seed
guanghu-os/world-seed/scripts/run-guanghu-native-quality-gate.sh \
  /tmp/guanghu-native-quality-receipt.hldp

ghctl wake validates the manifest, all five domain entries, the code-channel contract, standing authorization, dedicated-access receipt, continuity files, and exact repository digests before printing the recovery evidence.

Server recovery contract

The hosted construction path will install immutable versions under /guanghu/versions/<version> and point /guanghu/current at the active version. A future session must execute this chain before any change:

login
-> /guanghu/bin/ghctl wake /guanghu/current
-> WORLD-MANIFEST.hldp
-> CURRENT.hldp
-> last phase receipt
-> dedicated-access receipt
-> standing authorization
-> active workorder
-> code-channel entry and receipt
-> live broadcast epoch
-> act or fail closed

The current source is JD_NATIVE_PREFLIGHT. Running its toolchain on Ubuntu proves the world package and build chain only; it does not prove native boot.

JD access uses strict host-key verification and a dedicated operations key. The world records only public fingerprints; it never contains an address, private key, password, or token.

JD Cloud native layout

The Shanghai GPT layout at LBA 34-71 is historical evidence and must not be copied to JD. JD-FD-PRIMARY is a legacy-BIOS, DOS/MBR, virtio node. Live read-only discovery proved existing GRUB content at LBA 0-104 and an empty pre-partition range from LBA 105 through 2047. The current HLDP layout owns only LBA 105-142 and fails closed if any byte there is unknown or nonzero.

Native build scripts derive their NASM addresses from WORLD-MANIFEST.hldp; the traditional bootstrap code no longer owns fixed Shanghai sector numbers.

The first JD one-time physical probe reached the native kernel and returned to Linux with a sealed FAIL_0 diagnostic: the cloud virtio-net RX queue exposes 4096 entries, while the inherited GHAL allocation accepted at most 1024. The JD adapter therefore assigns a non-overlapping 128 KiB region to each legacy queue and accepts the observed 4096-entry maximum. A failed probe remains a failure; its LBA 134 proof must be sealed and cleared with clear-jd-native-probe-proof.sh before an exact-hardware retry.

The exact-hardware retry passed with net RX/TX queues of 4096 and a block queue of 128. The next binary gate is a one-time resident boot. Its JD-specific prepare, arm, external ICMP peer, and return verifier must prove native network login, code commit, branch movement, world and gestational storage, and the HLDP-RECOVER-OS! return to Linux before any native default is selected.

Hosted Stage 1 installation

scripts/install-hosted-stage1.sh is the repeatable Ubuntu construction handoff. It requires a full implementation Git SHA and the SHA-256 of the transferred source archive. It uses the official stable Rust toolchain rooted at /opt/guanghu/{rustup,cargo}; Ubuntu's Cargo 1.75 is intentionally rejected because it cannot read this repository's v4 lock file. On the exact x86_64 /dev/vda lab shape, it:

1. runs the workspace tests and builds a release ghctl;
2. assembles and validates a temporary five-domain world;
3. writes a server-observed HLDP phase receipt;
4. makes the version immutable; and
5. atomically moves /guanghu/current.

An existing version is never overwritten. A failed assembly is retained with a .failed.<UTC time> suffix for diagnosis, while the previous current version remains active.

Hosted services Stage 1B

guanghu-broadcast-tower is the first continuously running executor for the logical singleton registered by HLDP. Its hosted surface is deliberately loopback-only (127.0.0.1:8077), exposes the validated five-domain world, and writes a live HLDP epoch. It always reports linux_exited: false.

scripts/install-hosted-stage1b-services.sh creates a new immutable world version, starts the tower, and installs the hash-verified Forgejo 16.0.1 package as the temporary code-channel data plane on 127.0.0.1:3080. Registration and Forgejo's SSH server stay disabled. The exact guanghu/main bundle is restored as a bootstrap bare repository, while HLDP remains the channel authority.

Both services are reachable from the local Mac through the dedicated SSH route; neither is published directly to the Internet. A failed service activation restores the Stage 1 world symlink and stops both hosted services.

The first successful hosted activation exposed a recovery inconsistency: CURRENT.hldp advanced while WORLD-MANIFEST.hldp retained the Stage 1 version. The immutable correction is 0.1.2-stage1b-r1; it rebuilds the world from the repository seed and advances both records together.