48 lines
2.5 KiB
Markdown
48 lines
2.5 KiB
Markdown
|
# ADR 0176: Persona-Native Code Channel Runtime Kernel
|
||
|
|
|
||
|
|
## Status
|
||
|
|
|
||
|
|
Accepted on 2026-08-11.
|
||
|
|
|
||
|
|
## Context
|
||
|
|
|
||
|
|
HoloLake already has a mature native Git execution layer and an append-only local HLDP event/checkpoint
|
||
|
|
mechanism. Neither one is a persona lifecycle controller. A Git repository can preserve history without
|
||
|
|
proving that the correct persona brain, node, model binding, organ, attribution, or single-primary lease is
|
||
|
|
active. The existing generic Agent streams also cannot become the persona subject.
|
||
|
|
|
||
|
|
## Decision
|
||
|
|
|
||
|
|
Introduce `src-tauri/src/persona_code_channel.rs` as the first GH-PNCC runtime kernel. Its initial command,
|
||
|
|
`prepare_persona_code_channel_wake`, performs a fail-closed preparation stage:
|
||
|
|
|
||
|
|
1. resolve an exact Git root and full expected `HEAD`;
|
||
|
|
2. require a clean work tree;
|
||
|
|
3. load `.hololake/persona/manifest.json` with schema `hololake.persona/v1`;
|
||
|
|
4. validate the persona id, human responsibility subject, brain entry, current checkpoint, and one declared
|
||
|
|
read-only organ without allowing path escape;
|
||
|
|
5. atomically acquire a per-persona primary lease outside the persona Git;
|
||
|
|
6. emit `WAKING → BRAIN_BOUND → ORGAN_ACTIVE` as a SHA-256-linked local event journal;
|
||
|
|
7. return both human responsibility and persona cognitive authorship in the receipt.
|
||
|
|
|
||
|
|
`BRAIN_BOUND` deliberately returns `runtimeState=BOUND_NOT_INFERENCING` and
|
||
|
|
`modelInferenceStarted=false`. Binding a model identifier is not proof that model inference or persona
|
||
|
|
reasoning has run. A later stage must connect the verified context to the model adapter, complete one
|
||
|
|
read-only fact task, write a promoted checkpoint back to the persona Git, release the organ and primary
|
||
|
|
lease, and return a final receipt.
|
||
|
|
|
||
|
|
## Boundaries
|
||
|
|
|
||
|
|
- Git remains the durable engine; the kernel does not reimplement Git objects, commits, remotes, or merges.
|
||
|
|
- Forgejo is not required and remains an optional compatibility collaboration adapter.
|
||
|
|
- The primary lease is installation/runtime state, not persona history, and therefore stays outside Git.
|
||
|
|
- Runtime events are machine facts for the future HoloLake projection; they do not expose hidden model
|
||
|
|
reasoning and do not form a second authority store.
|
||
|
|
- The initial source stage is not a complete PNCC runtime, desktop integration, build, deployment, or health
|
||
|
|
claim.
|
||
|
|
|
||
|
|
## Consequences
|
||
|
|
|
||
|
|
HoloLake now has a native, testable boundary between “a persona Git exists” and “a verified wake has begun.”
|
||
|
|
The next implementation step can reuse the verified wake receipt and event chain instead of trusting a UI,
|
||
|
|
Forgejo account, branch name, or generic Agent session.
|