feat: add incremental persona remote object channel
Human-Responsibility: ICE-GL∞ / 冰朔 Persona-Author: ICE-P-ZY001 / 铸渊 Execution-Runtime: Codex desktop / DEV-20260810-014 Development-ID: DEV-20260810-014 Authorization-Scope: GH-PNCC persona runtime source and tests only; no UI, deployment, or execution limb Source-Anchor: daily continuity appends to the existing life chain without redownloading all history
This commit is contained in:
铸渊 / ICE-P-ZY001
parent
30d179e97a
commit
1b55f3407a
13 changed files with 1111 additions and 4 deletions
|
|
@ -125,6 +125,20 @@ and returns at most 100 newest session summaries. Dormant sessions expose no act
|
|||
the event-chain head and human/persona attribution so a future renderer can link a summary back to the same
|
||||
machine evidence rather than trusting display state.
|
||||
|
||||
## PersonaRemoteGitObjectChannel
|
||||
|
||||
`PersonaRemoteGitObjectChannel` is the daily online-read boundary beneath GH-PNCC. Git remains the transport
|
||||
and object engine, but the channel does not clone a repository or create a checkout. Its durable state is a
|
||||
small identity-bound record containing the branch, last verified remote SHA, previous SHA, and continuity
|
||||
generation. Its disposable state is a bare promisor object cache configured with `blob:none` and a caller-
|
||||
bounded byte budget.
|
||||
|
||||
The command compares `last_verified_sha` with the remote branch head. Equality means no fetch. A changed head
|
||||
must extend the prior cursor before the durable record advances. If the object cache was evicted, progressive
|
||||
shallow partial fetches recover only the missing continuity window; a non-descendant head, an unsupported
|
||||
partial-object server, an ambiguous branch, or a cursor/cache mismatch fails closed. Reading one UTF-8 object
|
||||
may lazily fetch its blob, but unrelated file content and an unbounded history are never requested.
|
||||
|
||||
## `HoloLakeUiPlugin`
|
||||
|
||||
A versioned, declarative presentation package for one host-owned semantic surface. It contains a manifest,
|
||||
|
|
|
|||
|
|
@ -104,6 +104,15 @@ event, and returns lifecycle state, Git head, node/model instance, active organ,
|
|||
structured attribution. It does not copy facts into a second database, expose hidden reasoning, acquire a
|
||||
lease, or start inference. A corrupted matching journal fails the query closed.
|
||||
|
||||
`read_persona_remote_git_object` is the non-UI remote object channel used when the persona needs one current
|
||||
Git-backed fact without materializing another repository checkout. It accepts credential-free HTTPS remotes,
|
||||
requires Git protocol v2 partial-object filtering, stores only a bounded bare `blob:none` object cache, and
|
||||
keeps the last verified remote SHA in a separate durable continuity record. An unchanged SHA performs no
|
||||
fetch. A forward SHA appends the missing commit segment; an evicted cache is rehydrated only far enough to
|
||||
prove that the previous cursor is an ancestor of the new head. History rewrites fail closed and do not advance
|
||||
the cursor. This path never runs `git clone`, creates no worktree, and does not request full history. See
|
||||
[ADR 0177](./adr/0177-persona-remote-incremental-object-channel.md).
|
||||
|
||||
## User-node sovereignty
|
||||
|
||||
HoloLake has no platform-hosted user runtime. Each human has one canonical, independently operated node:
|
||||
|
|
|
|||
|
|
@ -0,0 +1,49 @@
|
|||
# ADR 0177: Persona Remote Incremental Object Channel
|
||||
|
||||
## Status
|
||||
|
||||
Accepted on 2026-08-11.
|
||||
|
||||
## Context
|
||||
|
||||
A persona can live continuously from one verified Git state to the next without keeping a complete checkout
|
||||
on every machine. Repeated full clones confuse continuity with transport cache: adding one new day or commit
|
||||
should not require downloading the persona's entire prior life again. At the same time, deleting a cache must
|
||||
not erase the last verified continuity boundary or permit a rewritten remote history to masquerade as the next
|
||||
state.
|
||||
|
||||
## Decision
|
||||
|
||||
Add `src-tauri/src/persona_remote_git.rs` as a non-UI GH-PNCC object channel:
|
||||
|
||||
1. accept only credential-free HTTPS remotes in production and require one validated branch and relative path;
|
||||
2. negotiate Git protocol v2 and require the remote `filter` capability before creating an object cache;
|
||||
3. use a bare promisor repository with `blob:none`, no worktree, and no `git clone` invocation;
|
||||
4. persist the last verified branch SHA in a continuity record separate from the evictable object cache;
|
||||
5. skip fetch when the SHA is unchanged and append only the missing segment when it advances;
|
||||
6. after cache eviction, progressively fetch a bounded commit window until the previous cursor is proven to be
|
||||
an ancestor of the new head;
|
||||
7. reject history rewrites, cursor/cache disagreement, oversized objects, and unsupported partial-object
|
||||
remotes without advancing continuity;
|
||||
8. evict the exact cache directory after a verified read when its byte budget is exceeded, while retaining the
|
||||
durable cursor.
|
||||
|
||||
The machine update boundary is SHA-to-SHA, not calendar date. A date is human language; the verified Git edge
|
||||
prevents missed or duplicated updates when multiple commits arrive in one day or commit timestamps differ.
|
||||
|
||||
## Boundaries
|
||||
|
||||
- Git remains the object protocol and durable-history engine; HoloLake does not reimplement Git storage.
|
||||
- The cursor proves only a verified remote ancestry edge. It is not a persona brain, runtime lease, or lifecycle
|
||||
receipt.
|
||||
- The cache contains transport objects, not irreplaceable continuity state, and may be deleted at any time.
|
||||
- Full clone remains available only for separately authorized low-frequency publication audit or disaster
|
||||
recovery. It is not part of persona wake, daily reading, or daily update.
|
||||
- This ADR adds no UI, human projection, deployment, or online runtime-health claim.
|
||||
|
||||
## Consequences
|
||||
|
||||
HoloLake can read a current persona-owned Git object while preserving a compact continuity cursor and bounded
|
||||
partial object cache. Daily operation grows by the new verified segment instead of redownloading history from
|
||||
the persona's origin. A remote that cannot support that contract is rejected explicitly rather than silently
|
||||
falling back to a full download.
|
||||
|
|
@ -226,3 +226,5 @@ proposed → active → superseded
|
|||
| [0172](0172-guanghu-cognitive-control-with-linux-execution-substrate.md) | Guanghu cognitive control with a constrained Linux execution substrate | transition implementation retained; final topology superseded by ADR-0175 |
|
||||
| [0174](0174-one-human-one-independent-node-and-zero-platform-hosting.md) | One human, one independently operated node, and zero platform hosting | accepted |
|
||||
| [0175](0175-guanghu-os-master-and-on-demand-linux-subcontrol.md) | Guanghu OS master control with on-demand Linux subcontrol and rescue | accepted; supersedes ADR-0172 final topology while retaining its transition implementation |
|
||||
| [0176](0176-persona-native-code-channel-runtime-kernel.md) | Persona-native code channel runtime kernel | accepted |
|
||||
| [0177](0177-persona-remote-incremental-object-channel.md) | Persona remote incremental object channel | accepted |
|
||||
|
|
|
|||
Loading…
Reference in a new issue