hololake-system-architecture/product-source/hololake-native-desktop/docs/DISTRIBUTION-PLANES-AND-MODULE-MARKETPLACE.md

HoloLake distribution planes and public module marketplace

HoloLake has four independent distribution planes. A Git repository is the durable authoring and evidence layer; it is not the client update transport. Every release carries an explicit signed scope. The system may reject a mismatch, but it never guesses whether BingShuo meant public or private.

Four planes

1. PUBLIC_ZERO_CORE_PROTOCOL publishes declarative language, numbering, compatibility and bounded migration rules from an isolated public projection on GH-CVM-MAIN-PROD-01. Its logical authority still originates at the zero point and requires BingShuo's exact-candidate public-scope approval during the current transition. The enterprise distributor adds a second independent distribution signature. A client verifies both, stages, self-tests and atomically activates a valid update without asking every device owner to approve an operating-system protocol update. It still shows a human-readable receipt.
2. PRIVATE_FIFTH_DOMAIN remains confined to DOM-FIFTH-0001, its bound owner and explicitly authorized private nodes. It uses a different namespace and signer and can never flow into the public stream by inference.
3. PUBLIC_ENTERPRISE_MODULE_CATALOG is produced on GH-CVM-MAIN-PROD-01. Five responsibility repositories may feed one reviewed Guanghu Channel aggregate, but only tested, numbered and signed declarative packages enter the catalog. Clients synchronize the small catalog index automatically. A selected module is downloaded and installed only after the human reviews its permissions.
4. APPLICATION_BINARY updates HoloLake itself through the separately signed and platform-notarized updater. Personal Apple signing is a transition state; later organization signing must preserve the updater trust transition rather than silently replacing it.

Lake-lamp protocol

The visible "lamp" is a tiny signed manifest containing a monotonic epoch and content root. HoloLake performs HTTPS conditional checks at application start, after network resume and on a bounded jittered timer. ETag and If-None-Match make the no-change path nearly empty. A full repository clone is not required to learn that something changed.

For a public zero-core protocol update, the client verifies the exact source, plane-specific signature, content root, monotonic version and host compatibility; downloads into isolation; rejects executable or out-of-scope material; runs a deterministic self-test; switches one current pointer atomically; keeps the last-known-good version; and records a local receipt.

For a module update, only the catalog index is automatic. Installation remains a human action because a module may request access to local files, knowledge, network, channel data or execution adapters.

Marketplace publication

responsibility repository
→ explicit release envelope
→ isolated build and tests
→ lighthouse number registration
→ exact candidate human approval
→ enterprise module signature
→ immutable package and catalog entry
→ signed catalog-root advance
→ HoloLake catalog refresh
→ human selects module
→ permission review
→ local install, mount, self-test and receipt

The user's computer may maintain an application-owned content-addressed cache, but it does not execute a cloned repository. HoloLake renders catalog metadata for humans and passes the downloaded .ghmod package to the existing signed module lifecycle runtime.

Fifth Domain to public zero-core navigation

JD-FD-PRIMARY remains the physical home of the private Fifth Domain and Eternal Lake Heart. HoloLake may show the public zero-core management entrance inside BingShuo's Fifth Domain navigation, but opening it creates a separate session on GH-CVM-MAIN-PROD-01.

The transition uses a short-lived, one-time ticket bound to BingShuo's human number, the current HoloLake instance, the enterprise node and the public zero-core resource. A password is never forwarded or reused. The ticket grants neither enterprise four-domain authority nor access from the enterprise server back into the private Fifth Domain. Leaving the zero-core management channel destroys that enterprise session and restores the already-open private session.

Current reality boundary (2026-08-19)

• The zero-point client now implements HTTPS conditional lamp checks, exact bounded downloads, two independent Ed25519 signatures, monotonic epoch/version enforcement, content-root verification, atomic activation, previous-release retention and a hash-chained local receipt. Production remains fail-closed because the two real public keys and the enterprise lamp endpoint have not yet been provisioned.
• The module runtime already verifies signatures and supports install, mount, self-test, unmount and rollback for bundled packages.
• The public marketplace registry and remote package fetch path are absent.
• The enterprise server currently exposes two Gitea repositories, bingshuo/hololake-world and bingshuo/lighthouse; the proposed five-source Guanghu Channel aggregate does not yet exist.
• The enterprise node does not yet expose the isolated public zero-core projection or the JD-to-enterprise one-time management handoff.

The machine contract is contracts/distribution-plane-router.json.