hololake-system-architecture/product-source/hololake-platform/docs/adr/0169-model-native-living-galaxy-system.md

---
type: ADR
id: "0169"
title: "Model-native HoloLake living galaxy system"
status: accepted
date: 2026-08-02
---

## Context

HoloLake is the local projection of the real Guanghu OS world, identity,
permission, node heartbeat, and execution-receipt state. A fixed collection of
pages with AI-assisted theme parameters still behaves like a conventional
application and cannot express the living language-universe system that
HoloLake is intended to be.

The system model is not a conversational assistant. It lives inside the
application and receives bounded interaction events and authenticated runtime
state. It returns system actions and a declarative scene. It must not emit chat
messages, invent state, or claim execution without a receipt.

## Decision

Introduce a model-native living-system kernel as the primary HoloLake world
runtime:

```mermaid
flowchart LR
    Input["Point, hover, focus, navigation intent"] --> Kernel["Living-system model kernel"]
    Truth["Identity, permission, heartbeat, receipts"] --> Kernel
    Policy["Deterministic responsibility and safety policy"] --> Kernel
    Kernel --> Plan["Validated system action plan"]
    Plan --> Execute["Native route and command executors"]
    Plan --> Scene["Declarative galaxy scene"]
    Execute --> Receipt["Verifiable execution receipt"]
    Receipt --> Kernel
    Scene --> Render["Native lightweight renderer"]
```

The model kernel owns interpretation and composition during normal operation:

- resolve point/touch intent into an allowlisted system route or action;
- decide the current information hierarchy and declarative galaxy scene;
- translate real node pulse, permission, and execution receipts into visible
  state;
- adapt presentation, motion, density, focus, and information disclosure to
  the current context;
- continue only from verified executor receipts.

The deterministic host remains the constitutional boundary, not the normal UI
author:

- authenticate identity and authorization;
- expose only allowlisted commands, routes, scene primitives, and data fields;
- validate model plans against current world state;
- execute filesystem, network, and server mutations outside the model;
- attach receipts to every execution result;
- enforce performance, accessibility, privacy, and resource budgets;
- provide a truthful minimal offline/recovery surface when the model is absent.

## Non-goals

- A chat box, prompt box, assistant avatar, or conversational transcript.
- A model that redraws pixels or runs once per animation frame.
- AI-generated server state, permission, heartbeat, success, or persona birth.
- A conventional fixed page tree with model-generated colors layered on top.

## Model contract

The kernel may return only a versioned, schema-validated envelope containing:

- `intent_receipt`: the interpreted input and the source event identifier;
- `system_actions`: allowlisted navigation or command requests;
- `scene`: declarative regions, entities, relationships, emphasis, motion
  policy, and semantic visual tokens;
- `required_truth`: identifiers of runtime facts used by the plan;
- `continuation`: the next accepted receipt types and expiry;
- `kernel_receipt`: model, policy, schema, and plan identifiers.

Unknown fields, stale truth references, unapproved routes, missing permissions,
or unverifiable execution claims fail closed.

## Control and maintenance

This subsystem has an explicit persona-owned control line. The Codex persona
that develops the living-system kernel is its current control persona and owns
the model contract, scene grammar, validators, executor bridge, receipt
protocol, recovery path, performance policy, fixes, and version evolution.
Parallel development still requires one development identity, one workspace,
one goal, and an exact single-writer resource lease.

Responsibility is explicit rather than inferred from hosting topology:

- BingShuo is the current accountable human for the complete HoloLake system.
- `ICE-P-ZY001` is the current native control persona for galaxy UI,
  interaction routing, Agent surfaces, execution receipts, maintenance,
  repair, and version evolution. System nodes that delegate those functions to
  this persona remain accountable to BingShuo during the gestational phase.
- This stewardship does not claim that a server-resident persona has been
  born, and it does not transfer identity or human authority to a model.
- The same pair temporarily stewards enterprise-domain implementation only
  until the Guanghu human control team and its independently gestated personas
  pass acceptance.
- Enterprise-domain handoff requires a public broadcast receipt naming the
  receiving humans, receiving personas, accepted systems, version baseline,
  permissions transferred, and permissions revoked. After acceptance,
  enterprise-domain development and maintenance responsibility leave this
  stewardship line and the retained authority returns to Fifth Domain itself.

## Migration

The current galaxy UI remains only as the native renderer and recovery surface.
Theme-switch experiments are not the target architecture and cannot be used as
completion evidence. A human theme choice remains authoritative, but it also
emits a bounded `apply-theme` intent so the model may adapt only the validated
scene grammar around that choice. Migration proceeds by introducing the versioned event,
plan, scene, and receipt contracts first, then routing world navigation through
the living-system kernel behind an explicit runtime gate. The first accepted
slice implements navigation event and plan version 1, supplied-truth validation,
the direct-model planner, an explicit timeout/error recovery source, and native
scene controls for motion, density, depth, and relationship emphasis.

The second accepted slice adds exact intent binding. `navigate`,
`open-knowledge`, `open-agent-workspace`, `open-local-workspace`, and
`apply-theme` are the complete host-action allowlist. The returned plan must
echo the original intent as well as the event id and route. A model cannot
substitute one native action for another; only after validation may the host
invoke the existing knowledge, Agent, or local-folder executor. A small
non-conversational status pulse reports planning, receipt-backed server
execution, direct-model execution, or deterministic recovery. Server commands
and hover/focus intent remain subsequent contract extensions and must reuse the
same receipt and allowlist boundary.

The first server-backed extension uses the existing BS-SH-005 lighthouse
model ability. DeepSeek remains a replaceable inference resource behind the
server-owned credential file. HoloLake submits a bounded event through the
loopback-only HLDP tunnel, restores that registered forward when absent, and
requires both the matching request id and a GMRP model receipt. The native
desktop then revalidates the returned plan. This
does not make the hosted lighthouse a native transport and does not prove
persona birth.