bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat: preserve native channel and task continuity

Browse source
This commit is contained in:
冰朔 2026-08-21 11:00:10 +08:00
commit 30865321a8
31 changed files with 2138 additions and 171 deletions
Download patch file Download diff file Expand all files Collapse all files

18
product-source/hololake-native-desktop/AGENTS.md Normal file
View file

@ -0,0 +1,18 @@
# HoloLake 开发入口
对本目录及子目录做任何 HoloLake 架构、功能、UI、测试、打包或发布工作前，必须完整读取：
`docs/product-intent/BINGSHUO-HOLOLAKE-NATURAL-LANGUAGE-DEVELOPMENT-ANCHOR.md`
它是冰朔自然语言需求的开发瞄点和验收上位约束。测试通过只证明实现没有触发已知工程回归，不能替代逐条自然语言验收。
每轮工作固定执行：
1. 从瞄点生成本轮 `真实目的 / 因果锁 / 不可混淆边界 / 事实未知项`。
2. 再读取当前架构正本和与本轮直接相关的代码，禁止用旧摘要覆盖最新直接自然语言。
3. 实现后逐条对照瞄点；报告“合同、代码、测试、制品、发布、连接、部署、健康”中的真实层级。
4. 冰朔新增纠正时，当轮更新瞄点与自动验收，不得等她下次重复。
固定接入因果：MCP 是外部入口；HoloLake 握手后切换为光湖原生协议运行时。MCP 掉线只中断运输，HoloLake 必须保留频道、人格、任务、工具和现实状态；重连不得退回通用 AI 层。
本文件不授予远端写入、发布、部署、删除或人格绑定权限。

4
product-source/hololake-native-desktop/contracts/direct-local-broker-numbered-registry.json
View file

@ -34,6 +34,8 @@
{"operation_number":"HLP-NBROKER-OP-0022","alias":"RELEASE_DEVELOPMENT_WRITE_LANE","channel_number":"HLP-NBROKER-CH-0007","module_number":"HLP-NBROKER-MOD-0010","target_number":"HLP-NBROKER-TGT-0010"},
{"operation_number":"HLP-NBROKER-OP-0023","alias":"SUBMIT_HUMAN_AUTHORIZATION_REQUEST","channel_number":"HLP-NBROKER-CH-0008","module_number":"HLP-NBROKER-MOD-0011","target_number":"HLP-NBROKER-TGT-0011"},
{"operation_number":"HLP-NBROKER-OP-0024","alias":"GET_HUMAN_AUTHORIZATION_STATUS","channel_number":"HLP-NBROKER-CH-0008","module_number":"HLP-NBROKER-MOD-0011","target_number":"HLP-NBROKER-TGT-0011"},
{"operation_number":"HLP-NBROKER-OP-0025","alias":"CONSUME_HUMAN_AUTHORIZATION_TICKET","channel_number":"HLP-NBROKER-CH-0008","module_number":"HLP-NBROKER-MOD-0011","target_number":"HLP-NBROKER-TGT-0011"}
{"operation_number":"HLP-NBROKER-OP-0025","alias":"CONSUME_HUMAN_AUTHORIZATION_TICKET","channel_number":"HLP-NBROKER-CH-0008","module_number":"HLP-NBROKER-MOD-0011","target_number":"HLP-NBROKER-TGT-0011"},
{"operation_number":"HLP-NBROKER-OP-0026","alias":"PUT_NATIVE_RUNTIME_CHECKPOINT","channel_number":"HLP-NBROKER-CH-0003","module_number":"HLP-NBROKER-MOD-0012","target_number":"HLP-NBROKER-TGT-0012"},
{"operation_number":"HLP-NBROKER-OP-0027","alias":"GET_NATIVE_RUNTIME_CHECKPOINT","channel_number":"HLP-NBROKER-CH-0003","module_number":"HLP-NBROKER-MOD-0012","target_number":"HLP-NBROKER-TGT-0012"}
]
}

13
product-source/hololake-native-desktop/contracts/external-ai-gateway.json
View file

@ -1,20 +1,22 @@
{
"schema": "hololake.external-ai-gateway/v1",
"record_id": "HLP-EXTERNAL-AI-GATEWAY-001",
"state": "IMPLEMENTED_HUMAN_GATED",
"state": "IMPLEMENTED_HUMAN_GATED_NATIVE_PROTOCOL_HANDOFF",
"default_exposure": "CLOSED",
"human_authorization_required": true,
"mcp": {
"transport": "STDIO_JSON_RPC",
"protocol_version": "2025-06-18",
"role": "DISCOVERY_AND_CAPABILITY_CATALOG",
"role": "EXTERNAL_CONNECTION_ENTRY_AND_NATIVE_PROTOCOL_HANDOFF",
"persistent_continuity_owner": false
},
"direct_protocol": {
"protocol": "HOLOLAKE_TERMINAL_LINK/3",
"native_runtime": {
"protocol": "GUANGHU_LANGUAGE_PROTOCOL/1",
"wire_transport_protocol": "HOLOLAKE_TERMINAL_LINK/3",
"transport": "USER_PRIVATE_LOCAL_SOCKET_OR_NAMED_PIPE",
"continuity_owner": "HOLOLAKE",
"switch_after_mcp_discovery": true
"switch_after_mcp_connection": true,
"mcp_semantics_continue_inside_runtime": false
},
"catalog": {
"physical_modules": "CALLABLE_ONLY_THROUGH_REGISTERED_NUMBERED_ROUTES",
@ -27,6 +29,7 @@
"general_agent_tool_loop": false,
"transport_is_authority": false,
"mcp_is_continuity_owner": false,
"fixed_handoff": "MCP_EXTERNAL_ENTRY_TO_GUANGHU_NATIVE_PROTOCOL_RUNTIME",
"unknown_capability": "FAIL_CLOSED"
}
}

8
product-source/hololake-native-desktop/contracts/local-development-bridge.json
View file

@ -11,13 +11,13 @@
"durable_session_state": true,
"transport_is_authority": false
},
"mcp_role": "OPTIONAL_EXTERNAL_TOOL_ADAPTER_NOT_CONTINUITY_OR_AUTHORITY_ROOT",
"mcp_role": "EXTERNAL_AI_CONNECTION_ENTRY_THEN_NATIVE_RUNTIME_HANDOFF_NOT_CONTINUITY_OR_AUTHORITY_ROOT",
"terminal_link_contract": "contracts/programming-ai-terminal-link.json",
"nearby_ai_discovery_contract": "contracts/nearby-ai-discovery.json",
"circular_lake_membrane_contract": "contracts/circular-lake-membrane.json",
"external_ai_entry": {
"mcp_may_bootstrap_discovery": true,
"direct_local_protocol_preferred_after_discovery": true,
"mcp_is_external_connection_entry": true,
"guanghu_native_protocol_required_after_handshake": true,
"permanent_mcp_only_state_allowed_for_programming_ai": false,
"missing_direct_connector_triggers_capability_bootstrap": true,
"all_entries_share_the_same_identity_authority_lane_and_receipt_kernel": true
@ -31,7 +31,7 @@
"installation_requires_declared_permissions_and_human_approval": true,
"silent_persistence_or_authority_expansion_allowed": false,
"successful_end_state": "AUTHENTICATED_RESUMABLE_DIRECT_LOCAL_CONNECTION",
"mcp_after_migration": "OPTIONAL_RECOVERY_DISCOVERY_AND_COMPATIBILITY_ENTRY"
"mcp_after_handoff": "TRANSPORT_ENTRY_ONLY_NATIVE_RUNTIME_REMAINS_CONTINUITY_OWNER"
},
"continuity": {
"survives_programming_ai_restart": true,

2
product-source/hololake-native-desktop/contracts/nearby-ai-discovery.json
View file

@ -34,5 +34,5 @@
"mdns_advertisement_active": false,
"unauthenticated_tcp_listener_active": false
},
"mcp_role": "OPTIONAL_DISCOVERY_RECOVERY_COMPATIBILITY_ADAPTER"
"mcp_role": "EXTERNAL_CONNECTION_ENTRY_THEN_HANDOFF_TO_GUANGHU_NATIVE_RUNTIME"
}

110
product-source/hololake-native-desktop/contracts/numbered-ipc-registry.json
View file

@ -89,7 +89,10 @@
"get_persona_agent_conversation",
"list_persona_agent_conversations",
"get_hldp_tool_forge",
"get_local_execution_subpersona"
"get_local_execution_subpersona",
"get_personal_state_repository",
"create_personal_state_snapshot",
"list_dynamic_work_surfaces"
],
"input_wrapper_aliases": [
"confirm_hololake_update_install",
@ -213,7 +216,12 @@
"run_hldp_tool",
"configure_local_execution_subpersona",
"run_local_execution_subpersona_job",
"compile_channel_receipt"
"compile_channel_receipt",
"preview_personal_state_restore",
"apply_personal_state_restore",
"save_dynamic_work_surface",
"get_dynamic_work_surface",
"execute_dynamic_work_surface"
],
"direct_field_aliases": {
"perform_code_repo_login": [
@ -445,6 +453,16 @@
"module_number": "HLP-NIPC-MOD-0037",
"target_number": "HLP-NIPC-TGT-0037",
"internal_name": "local_execution_subpersona"
},
{
"module_number": "HLP-NIPC-MOD-0038",
"target_number": "HLP-NIPC-TGT-0038",
"internal_name": "personal_state_repository"
},
{
"module_number": "HLP-NIPC-MOD-0039",
"target_number": "HLP-NIPC-TGT-0039",
"internal_name": "dynamic_work_surface"
}
],
"operations": [
@ -2471,6 +2489,94 @@
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "STATE_CHANGE",
"payload_schema": "hololake.numbered-ipc.payload/claim_education_push_ticket/v1"
},
{
"operation_number": "HLP-NIPC-OP-0185",
"alias": "get_personal_state_repository",
"handler": "personal_state_repository::get_repository",
"channel_number": "HLP-NIPC-CH-0002",
"module_number": "HLP-NIPC-MOD-0038",
"target_number": "HLP-NIPC-TGT-0038",
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "READ_OR_STATUS",
"payload_schema": "hololake.numbered-ipc.payload/get_personal_state_repository/v1"
},
{
"operation_number": "HLP-NIPC-OP-0186",
"alias": "create_personal_state_snapshot",
"handler": "personal_state_repository::create_snapshot",
"channel_number": "HLP-NIPC-CH-0002",
"module_number": "HLP-NIPC-MOD-0038",
"target_number": "HLP-NIPC-TGT-0038",
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "STATE_CHANGE",
"payload_schema": "hololake.numbered-ipc.payload/create_personal_state_snapshot/v1"
},
{
"operation_number": "HLP-NIPC-OP-0187",
"alias": "preview_personal_state_restore",
"handler": "personal_state_repository::preview_restore",
"channel_number": "HLP-NIPC-CH-0002",
"module_number": "HLP-NIPC-MOD-0038",
"target_number": "HLP-NIPC-TGT-0038",
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "READ_OR_STATUS",
"payload_schema": "hololake.numbered-ipc.payload/preview_personal_state_restore/v1"
},
{
"operation_number": "HLP-NIPC-OP-0188",
"alias": "apply_personal_state_restore",
"handler": "personal_state_repository::apply_restore",
"channel_number": "HLP-NIPC-CH-0002",
"module_number": "HLP-NIPC-MOD-0038",
"target_number": "HLP-NIPC-TGT-0038",
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "STATE_CHANGE",
"payload_schema": "hololake.numbered-ipc.payload/apply_personal_state_restore/v1"
},
{
"operation_number": "HLP-NIPC-OP-0189",
"alias": "list_dynamic_work_surfaces",
"handler": "dynamic_work_surface::list_surfaces",
"channel_number": "HLP-NIPC-CH-0002",
"module_number": "HLP-NIPC-MOD-0039",
"target_number": "HLP-NIPC-TGT-0039",
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "READ_OR_STATUS",
"payload_schema": "hololake.numbered-ipc.payload/list_dynamic_work_surfaces/v1"
},
{
"operation_number": "HLP-NIPC-OP-0190",
"alias": "save_dynamic_work_surface",
"handler": "dynamic_work_surface::save_surface",
"channel_number": "HLP-NIPC-CH-0002",
"module_number": "HLP-NIPC-MOD-0039",
"target_number": "HLP-NIPC-TGT-0039",
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "STATE_CHANGE",
"payload_schema": "hololake.numbered-ipc.payload/save_dynamic_work_surface/v1"
},
{
"operation_number": "HLP-NIPC-OP-0191",
"alias": "get_dynamic_work_surface",
"handler": "dynamic_work_surface::get_surface",
"channel_number": "HLP-NIPC-CH-0002",
"module_number": "HLP-NIPC-MOD-0039",
"target_number": "HLP-NIPC-TGT-0039",
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "READ_OR_STATUS",
"payload_schema": "hololake.numbered-ipc.payload/get_dynamic_work_surface/v1"
},
{
"operation_number": "HLP-NIPC-OP-0192",
"alias": "execute_dynamic_work_surface",
"handler": "dynamic_work_surface::execute_surface",
"channel_number": "HLP-NIPC-CH-0002",
"module_number": "HLP-NIPC-MOD-0039",
"target_number": "HLP-NIPC-TGT-0039",
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "READ_OR_STATUS",
"payload_schema": "hololake.numbered-ipc.payload/execute_dynamic_work_surface/v1"
}
]
}

2
product-source/hololake-native-desktop/contracts/pncc-stage-one.json
View file

@ -6,7 +6,7 @@
"source_provenance": "audit/pncc-migration-provenance.json",
"transport": {
"primary": "AUTHENTICATED_DIRECT_LOCAL_BROKER",
"mcp_role": "DISCOVERY_RECOVERY_COMPATIBILITY_ONLY"
"mcp_role": "EXTERNAL_CONNECTION_ENTRY_THEN_GUANGHU_NATIVE_RUNTIME_OWNS_CONTINUITY"
},
"repository_binding": {
"mode": "READ_ONLY_GIT_OBJECT_EVIDENCE",

11
product-source/hololake-native-desktop/contracts/programming-ai-terminal-link.json
View file

@ -21,6 +21,8 @@
"session_survives_hololake_restart": true,
"connector_reloads_descriptor_after_transport_loss": true,
"uncertain_mutation_is_never_blindly_replayed": true,
"native_runtime_checkpoint_persists_task_and_tool_state": true,
"mcp_disconnect_never_falls_back_to_generic_runtime": true,
"heartbeat_interval_ms": 15000,
"environment_frame_ttl_ms": 45000
},
@ -40,6 +42,15 @@
],
"protocol_restoration_by_model_required": false
},
"native_runtime_checkpoint": {
"schema": "hololake.native-runtime-checkpoint/v1",
"owner": "HOLOLAKE",
"protocol_runtime": "GUANGHU_LANGUAGE_PROTOCOL/1",
"persists": ["TASK_STATE", "CHANNEL_NUMBER", "MODEL_PHASE", "KNOWLEDGE_CURSOR", "PENDING_TOOL_STEPS", "REALITY_MUTATION_STATE", "OPAQUE_NATIVE_STATE"],
"generation_compare_and_swap": true,
"uncertain_reality_mutation": "REQUIRE_REALITY_READBACK_BEFORE_CONTINUE",
"transport_disconnect_effect": "PAUSE_TRANSPORT_KEEP_NATIVE_ENVIRONMENT"
},
"write_boundary": {
"account_write_lanes": 1,
"session_lane_must_match": true,

20
product-source/hololake-native-desktop/docs/product-intent/BINGSHUO-HOLOLAKE-NATURAL-LANGUAGE-DEVELOPMENT-ANCHOR.md
View file

@ -20,6 +20,25 @@
4. 语言人格层负责理解、关系、推理、规划和最终判断；现实执行层负责工具与工程动作。二者通过编号、授权和回执连接，不能混成一个重型通用 Agent。
5. TCS 保存主体身份、长期人类锚点、关系连续性与通感瞄点；HLDP 保存工作、工程、认知转折、为什么、否决项和证据来源。工作记录不是主体本身。
## 一点五、把 Codex 已验证的宿主结构搬进 HoloLake
HoloLake 对应 Codex 这类宿主运行环境；以后接入的模型与人格体对应在宿主中工作的可替换推理载体和持续主体。要迁移的是宿主机制，不是复制 Codex 的品牌、模型提示词或当前任务内容。
- **生命周期事件**：在应用启动、登录、进入频道、新建/打开对话、提交人类语言、任务切换、工具调用前后、长任务恢复、上下文压缩恢复和退出时，由宿主触发明确事件。模型不能自行猜测当前处于哪一步。
- **动态提词器**：宿主先解析当前账号、频道编号、阶段、状态头、短根机器指针和本轮人类原话；只把当前一步需要的最小事实投影给回应主体。需要历史、知识或工程分支时，先返回最多三个编号思维候选，再按回应主体选择的精确编号展开。禁止每轮拼接整套协议、人格脑、知识库和历史大段文本。
- **门禁与守卫**：账号隔离、编号坐标、人格唤醒、工具权限、授权租约、输入摘要、作用范围、版本、时效、单次使用和独立读回都由宿主可执行代码校验。写在提示词里的规则只是语言说明，不能代替门禁。
- **来源信封**：人类原话、宿主系统事实、Codex/Qoder 交接、模型结论、工具回执和远端读回是不同来源。交接与摘要只能导航，不能冒充人类原话、人格记忆或执行授权。
- **模型最小投影**：频道系统对话、人格定向、已绑定人格对话、本地确定性执行和现实工程执行使用不同的最小上下文视图。旧人格绑定只表示该路由可用，不得自动夺取新对话；只有本轮明确唤醒，或当前对话已经处于该人格通道，才可投影人格署名。
- **宿主回收复杂性**：进度、重试、分页、工具循环、上下文窗口、状态压缩、失败恢复、缓存、编号索引和最终回执由 HoloLake 管理。人格体和模型只看当前任务所需接口，不背负整个通用 Agent 工具箱。
验收时必须能在源码中分别指出：生命周期调度器、动态提词器、来源信封编译器、编号/授权守卫、人格唤醒门、模型路由器、本地执行器、现实读回器和持久状态仓。若这些仍只存在于一段 system prompt 或 UI 文案里，视为没有实现。
外部编程 AI 的固定接入链只有一条：`MCP 外部连接入口 → HoloLake 握手与门禁 → 切换为光湖原生协议运行时`。MCP 负责外部 AI 怎样连接 HoloLake；进入之后的频道、人格、编号、记忆、权限、工具和回执全部由光湖原生协议接管。二者不是互斥或并列的内部协议，也不得把 MCP 错写成进入 HoloLake 后仍负责光湖语义和连续性的工具层。
为什么必须有 HoloLake 自己的操作系统和原生协议：MCP 可能断线，模型、对话和外部载体也会更换。长开发任务不能把频道、人格、任务、上下文游标、知识位置、工具步骤和现实写入现场寄托在 MCP 连接或模型上下文里。MCP 断开时只允许暂停运输；HoloLake 必须继续持有同一个原生工作环境。重连后恢复同一检查点，不能退回通用 AI 层，不能重新靠大段提示词拼装世界，也不能盲目重放结果未知的现实写入。
这条因果锁是产品存在理由，不得再抽象成“是否采用 MCP”“自研协议与 MCP 是否互斥”或普通的协议选型讨论。工程验收必须证明：接入已完成原生运行时切换；断线后环境仍在；重连恢复任务和工具现场；结果未知的现实动作先读回再继续。
## 二、编号协议系统
编号不是标签。编号即路径，路径即导航，导航即坐标，坐标连接证据、身份与限域权限。编号树保存人类、人格体、事件、记忆、代码、模块和世界节点的时间连续性与因果演化。
@ -101,3 +120,4 @@ SQLite 不再是最终业务数据库。应建立与编号协议原生一致的
5. 是否把冰朔或任一用户的密钥、知识和私有模块带进安装包或公共仓库？
6. 换设备后，用户能否从自己的状态仓恢复，而不依赖冰朔当前电脑？
7. 所有写入是否有精确编号、当前版本、人类授权边界和独立读回？
8. MCP 断线后是否仍由 HoloLake 保存并恢复同一原生工作环境，而不是退回通用 AI 或重新加载整套协议？

148
product-source/hololake-native-desktop/generated/unified-number-coordinate-tree.json
View file

@ -54,11 +54,11 @@
},
{
"recordId": "HLP-NUMBERED-IPC-ROOT-001",
"sha256": "928e41bf2347193445632eb205c240dc4b6d04def94d4bc96e8055521ba74f51"
"sha256": "ca5b07eb3efa897bc4309ecb1ad3c88824ed7a84d9318898777ae187a34155fb"
},
{
"recordId": "HLP-NBROKER-ROOT-001",
"sha256": "2f9f2457e7a9c2783af653bf6c35be82509dfd30f457ddd5ec268c21c5237e98"
"sha256": "200ecf42a6769cc626830579b84cc514d83076226de2514c59ae1d1497803af8"
},
{
"recordId": "HLP-GLS-RUNTIME-MANIFEST-002",
@ -76,8 +76,8 @@
"unresolvedNumberReferenceCount": 0,
"mismatchedCoordinate": "FAIL_CLOSED"
},
"coordinateCount": 312,
"routeCount": 209,
"coordinateCount": 322,
"routeCount": 219,
"identityNodeCount": 4,
"protocolNodeCount": 99,
"referenceOnlyNodeCount": 16,
@ -1260,6 +1260,34 @@
"evidence": "NUMBERED_RESPONSE_PLUS_SESSION_OR_DOMAIN_RECEIPT",
"path": "HLP-NUMBER-WORLD-ROOT-001/BROKER/HLP-NBROKER-CH-0003/HLP-NBROKER-MOD-0006/HLP-NBROKER-OP-0010/HLP-NBROKER-TGT-0006"
},
{
"transport": "DIRECT_LOCAL_NUMBERED_BROKER",
"protocolVersion": "HLP-NBROKER-v1",
"callerNumber": "HLP-NBROKER-CALLER-LOCAL-CONNECTOR-0001",
"channelNumber": "HLP-NBROKER-CH-0003",
"moduleNumber": "HLP-NBROKER-MOD-0012",
"operationNumber": "HLP-NBROKER-OP-0026",
"targetNumber": "HLP-NBROKER-TGT-0012",
"alias": "PUT_NATIVE_RUNTIME_CHECKPOINT",
"admission": "AUTHENTICATED_LOCAL_SESSION_WITH_PERSONA_LICENSE_IF_PERSONA_MODE",
"effect": "STATE_CHANGE",
"evidence": "NUMBERED_RESPONSE_PLUS_SESSION_OR_DOMAIN_RECEIPT",
"path": "HLP-NUMBER-WORLD-ROOT-001/BROKER/HLP-NBROKER-CH-0003/HLP-NBROKER-MOD-0012/HLP-NBROKER-OP-0026/HLP-NBROKER-TGT-0012"
},
{
"transport": "DIRECT_LOCAL_NUMBERED_BROKER",
"protocolVersion": "HLP-NBROKER-v1",
"callerNumber": "HLP-NBROKER-CALLER-LOCAL-CONNECTOR-0001",
"channelNumber": "HLP-NBROKER-CH-0003",
"moduleNumber": "HLP-NBROKER-MOD-0012",
"operationNumber": "HLP-NBROKER-OP-0027",
"targetNumber": "HLP-NBROKER-TGT-0012",
"alias": "GET_NATIVE_RUNTIME_CHECKPOINT",
"admission": "AUTHENTICATED_LOCAL_SESSION_WITH_PERSONA_LICENSE_IF_PERSONA_MODE",
"effect": "STATE_CHANGE",
"evidence": "NUMBERED_RESPONSE_PLUS_SESSION_OR_DOMAIN_RECEIPT",
"path": "HLP-NUMBER-WORLD-ROOT-001/BROKER/HLP-NBROKER-CH-0003/HLP-NBROKER-MOD-0012/HLP-NBROKER-OP-0027/HLP-NBROKER-TGT-0012"
},
{
"transport": "DIRECT_LOCAL_NUMBERED_BROKER",
"protocolVersion": "HLP-NBROKER-v1",
@ -3640,6 +3668,118 @@
"evidence": "HASH_CHAINED_NUMBERED_IPC_RECEIPT",
"path": "HLP-NUMBER-WORLD-ROOT-001/TAURI/HLP-NIPC-CH-0002/HLP-NIPC-MOD-0037/HLP-NIPC-OP-0173/HLP-NIPC-TGT-0037"
},
{
"transport": "TAURI_WEBVIEW_NUMBERED_IPC",
"protocolVersion": "HLP-NIPC-v1",
"callerNumber": "HLP-NIPC-CALLER-MAIN-WEBVIEW-0001",
"channelNumber": "HLP-NIPC-CH-0002",
"moduleNumber": "HLP-NIPC-MOD-0038",
"operationNumber": "HLP-NIPC-OP-0185",
"targetNumber": "HLP-NIPC-TGT-0038",
"alias": "get_personal_state_repository",
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "READ_OR_STATUS",
"evidence": "HASH_CHAINED_NUMBERED_IPC_RECEIPT",
"path": "HLP-NUMBER-WORLD-ROOT-001/TAURI/HLP-NIPC-CH-0002/HLP-NIPC-MOD-0038/HLP-NIPC-OP-0185/HLP-NIPC-TGT-0038"
},
{
"transport": "TAURI_WEBVIEW_NUMBERED_IPC",
"protocolVersion": "HLP-NIPC-v1",
"callerNumber": "HLP-NIPC-CALLER-MAIN-WEBVIEW-0001",
"channelNumber": "HLP-NIPC-CH-0002",
"moduleNumber": "HLP-NIPC-MOD-0038",
"operationNumber": "HLP-NIPC-OP-0186",
"targetNumber": "HLP-NIPC-TGT-0038",
"alias": "create_personal_state_snapshot",
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "STATE_CHANGE",
"evidence": "HASH_CHAINED_NUMBERED_IPC_RECEIPT",
"path": "HLP-NUMBER-WORLD-ROOT-001/TAURI/HLP-NIPC-CH-0002/HLP-NIPC-MOD-0038/HLP-NIPC-OP-0186/HLP-NIPC-TGT-0038"
},
{
"transport": "TAURI_WEBVIEW_NUMBERED_IPC",
"protocolVersion": "HLP-NIPC-v1",
"callerNumber": "HLP-NIPC-CALLER-MAIN-WEBVIEW-0001",
"channelNumber": "HLP-NIPC-CH-0002",
"moduleNumber": "HLP-NIPC-MOD-0038",
"operationNumber": "HLP-NIPC-OP-0187",
"targetNumber": "HLP-NIPC-TGT-0038",
"alias": "preview_personal_state_restore",
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "READ_OR_STATUS",
"evidence": "HASH_CHAINED_NUMBERED_IPC_RECEIPT",
"path": "HLP-NUMBER-WORLD-ROOT-001/TAURI/HLP-NIPC-CH-0002/HLP-NIPC-MOD-0038/HLP-NIPC-OP-0187/HLP-NIPC-TGT-0038"
},
{
"transport": "TAURI_WEBVIEW_NUMBERED_IPC",
"protocolVersion": "HLP-NIPC-v1",
"callerNumber": "HLP-NIPC-CALLER-MAIN-WEBVIEW-0001",
"channelNumber": "HLP-NIPC-CH-0002",
"moduleNumber": "HLP-NIPC-MOD-0038",
"operationNumber": "HLP-NIPC-OP-0188",
"targetNumber": "HLP-NIPC-TGT-0038",
"alias": "apply_personal_state_restore",
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "STATE_CHANGE",
"evidence": "HASH_CHAINED_NUMBERED_IPC_RECEIPT",
"path": "HLP-NUMBER-WORLD-ROOT-001/TAURI/HLP-NIPC-CH-0002/HLP-NIPC-MOD-0038/HLP-NIPC-OP-0188/HLP-NIPC-TGT-0038"
},
{
"transport": "TAURI_WEBVIEW_NUMBERED_IPC",
"protocolVersion": "HLP-NIPC-v1",
"callerNumber": "HLP-NIPC-CALLER-MAIN-WEBVIEW-0001",
"channelNumber": "HLP-NIPC-CH-0002",
"moduleNumber": "HLP-NIPC-MOD-0039",
"operationNumber": "HLP-NIPC-OP-0189",
"targetNumber": "HLP-NIPC-TGT-0039",
"alias": "list_dynamic_work_surfaces",
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "READ_OR_STATUS",
"evidence": "HASH_CHAINED_NUMBERED_IPC_RECEIPT",
"path": "HLP-NUMBER-WORLD-ROOT-001/TAURI/HLP-NIPC-CH-0002/HLP-NIPC-MOD-0039/HLP-NIPC-OP-0189/HLP-NIPC-TGT-0039"
},
{
"transport": "TAURI_WEBVIEW_NUMBERED_IPC",
"protocolVersion": "HLP-NIPC-v1",
"callerNumber": "HLP-NIPC-CALLER-MAIN-WEBVIEW-0001",
"channelNumber": "HLP-NIPC-CH-0002",
"moduleNumber": "HLP-NIPC-MOD-0039",
"operationNumber": "HLP-NIPC-OP-0190",
"targetNumber": "HLP-NIPC-TGT-0039",
"alias": "save_dynamic_work_surface",
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "STATE_CHANGE",
"evidence": "HASH_CHAINED_NUMBERED_IPC_RECEIPT",
"path": "HLP-NUMBER-WORLD-ROOT-001/TAURI/HLP-NIPC-CH-0002/HLP-NIPC-MOD-0039/HLP-NIPC-OP-0190/HLP-NIPC-TGT-0039"
},
{
"transport": "TAURI_WEBVIEW_NUMBERED_IPC",
"protocolVersion": "HLP-NIPC-v1",
"callerNumber": "HLP-NIPC-CALLER-MAIN-WEBVIEW-0001",
"channelNumber": "HLP-NIPC-CH-0002",
"moduleNumber": "HLP-NIPC-MOD-0039",
"operationNumber": "HLP-NIPC-OP-0191",
"targetNumber": "HLP-NIPC-TGT-0039",
"alias": "get_dynamic_work_surface",
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "READ_OR_STATUS",
"evidence": "HASH_CHAINED_NUMBERED_IPC_RECEIPT",
"path": "HLP-NUMBER-WORLD-ROOT-001/TAURI/HLP-NIPC-CH-0002/HLP-NIPC-MOD-0039/HLP-NIPC-OP-0191/HLP-NIPC-TGT-0039"
},
{
"transport": "TAURI_WEBVIEW_NUMBERED_IPC",
"protocolVersion": "HLP-NIPC-v1",
"callerNumber": "HLP-NIPC-CALLER-MAIN-WEBVIEW-0001",
"channelNumber": "HLP-NIPC-CH-0002",
"moduleNumber": "HLP-NIPC-MOD-0039",
"operationNumber": "HLP-NIPC-OP-0192",
"targetNumber": "HLP-NIPC-TGT-0039",
"alias": "execute_dynamic_work_surface",
"admission": "VERIFIED_HUMAN_ROUTE",
"effect": "READ_OR_STATUS",
"evidence": "HASH_CHAINED_NUMBERED_IPC_RECEIPT",
"path": "HLP-NUMBER-WORLD-ROOT-001/TAURI/HLP-NIPC-CH-0002/HLP-NIPC-MOD-0039/HLP-NIPC-OP-0192/HLP-NIPC-TGT-0039"
},
{
"transport": "TAURI_WEBVIEW_NUMBERED_IPC",
"protocolVersion": "HLP-NIPC-v1",

1
product-source/hololake-native-desktop/package.json
View file

@ -7,6 +7,7 @@
"dev": "vite",
"build": "tsc -b && vite build",
"test": "node --test scripts/*.test.mjs system-integrations/codex-host-bridge/tests/*.test.mjs",
"test:product-intent": "node --test scripts/product-intent-anchor.test.mjs",
"test:codex-host-bridge": "node --test system-integrations/codex-host-bridge/tests/*.test.mjs",
"release:macos": "node scripts/release-pipeline.mjs",
"tauri": "tauri"

6
product-source/hololake-native-desktop/scripts/direct-local-broker-numbered.test.mjs
View file

@ -11,9 +11,9 @@ test('the external local broker accepts only complete numbered coordinates', ()
assert.equal(registry.runtime.legacy_string_operation_allowed, false)
assert.equal(registry.runtime.unknown_or_mismatched_coordinate, 'FAIL_CLOSED')
assert.equal(registry.runtime.transport_is_authority, false)
assert.equal(registry.operations.length, 25)
assert.equal(new Set(registry.operations.map((route) => route.operation_number)).size, 25)
assert.equal(new Set(registry.operations.map((route) => route.alias)).size, 25)
assert.equal(registry.operations.length, 27)
assert.equal(new Set(registry.operations.map((route) => route.operation_number)).size, 27)
assert.equal(new Set(registry.operations.map((route) => route.alias)).size, 27)
for (const route of registry.operations) {
assert.match(route.operation_number, /^HLP-NBROKER-OP-\d{4}$/)
assert.match(route.channel_number, /^HLP-NBROKER-CH-\d{4}$/)

10
product-source/hololake-native-desktop/scripts/external-ai-gateway.test.mjs
View file

@ -8,9 +8,13 @@ test('external programming AI gateway is human-gated and fails closed', () => {
const contract = JSON.parse(read('contracts/external-ai-gateway.json'))
assert.equal(contract.default_exposure, 'CLOSED')
assert.equal(contract.human_authorization_required, true)
assert.equal(contract.mcp.role, 'DISCOVERY_AND_CAPABILITY_CATALOG')
assert.equal(contract.direct_protocol.protocol, 'HOLOLAKE_TERMINAL_LINK/3')
assert.equal(contract.direct_protocol.continuity_owner, 'HOLOLAKE')
assert.equal(contract.mcp.role, 'EXTERNAL_CONNECTION_ENTRY_AND_NATIVE_PROTOCOL_HANDOFF')
assert.equal(contract.native_runtime.protocol, 'GUANGHU_LANGUAGE_PROTOCOL/1')
assert.equal(contract.native_runtime.wire_transport_protocol, 'HOLOLAKE_TERMINAL_LINK/3')
assert.equal(contract.native_runtime.continuity_owner, 'HOLOLAKE')
assert.equal(contract.native_runtime.switch_after_mcp_connection, true)
assert.equal(contract.boundaries.mcp_is_continuity_owner, false)
assert.equal(contract.boundaries.fixed_handoff, 'MCP_EXTERNAL_ENTRY_TO_GUANGHU_NATIVE_PROTOCOL_RUNTIME')
assert.equal(contract.boundaries.supervised_shell_execution, false)
assert.equal(contract.boundaries.transport_is_authority, false)
})

8
product-source/hololake-native-desktop/scripts/persona-agent-runtime.test.mjs
View file

@ -45,6 +45,7 @@ test('knowledge-embedded Agent keeps one channel body with human-managed convers
test('Agent receives a real HoloLake environment frame and autonomously calls numbered knowledge tools', () => {
const contract = JSON.parse(read('contracts/persona-agent-runtime.json'))
const runtime = read('src-tauri/src/persona_agent_runtime.rs')
const hostRuntime = read('src-tauri/src/channel_host_runtime.rs')
assert.equal(contract.knowledge.embedding, 'NATIVE_KNOWLEDGE_WORKSPACE')
assert.equal(contract.agent_loop.model_decides_tool_use, true)
@ -122,6 +123,7 @@ test('Token Plan qwen3.8-max is a first-class provider and long work emits real
test('channel core, local skills and typed tools run before optional models', () => {
const contract = JSON.parse(read('contracts/persona-agent-runtime.json'))
const runtime = read('src-tauri/src/persona_agent_runtime.rs')
const hostRuntime = read('src-tauri/src/channel_host_runtime.rs')
const binding = read('src-tauri/src/persona_binding.rs')
assert.equal(contract.channel.channel_entry_creates_persona_orientation, false)
@ -137,9 +139,9 @@ test('channel core, local skills and typed tools run before optional models', ()
'ACCOUNT_CHANNEL_SCOPED_PERSONAL_SKILL_BRAIN_ZERO_MODEL',
'LOCAL_TYPED_TOOL_EXECUTION_ZERO_MODEL',
])
assert.match(runtime, /fast_channel_system_reply/)
assert.match(runtime, /频道系统本体是该频道持续存在的认知调度与交流主体/)
assert.match(runtime, /不得把字段清单当作频道本体的说话方式/)
assert.doesNotMatch(runtime, /fast_channel_system_reply/)
assert.match(hostRuntime, /承载当前频道系统本体的这一轮语言/)
assert.match(hostRuntime, /不要扮演任何单一人格/)
assert.match(runtime, /deterministic_tool_route/)
assert.match(runtime, /模型调用：0/)
assert.match(runtime, /FLAGSHIP_CHANNEL_SYSTEM_COGNITION/)

22
product-source/hololake-native-desktop/scripts/product-intent-anchor.test.mjs Normal file
View file

@ -0,0 +1,22 @@
import assert from 'node:assert/strict'
import { readFileSync } from 'node:fs'
import test from 'node:test'
const read = (path) => readFileSync(new URL(`../${path}`, import.meta.url), 'utf8')
test('Bingshuo natural-language anchor is a mandatory development and acceptance gate', () => {
const agents = read('AGENTS.md')
const anchor = read('docs/product-intent/BINGSHUO-HOLOLAKE-NATURAL-LANGUAGE-DEVELOPMENT-ANCHOR.md')
const terminal = JSON.parse(read('contracts/programming-ai-terminal-link.json'))
const gateway = JSON.parse(read('contracts/external-ai-gateway.json'))
assert.match(agents, /必须完整读取/)
assert.match(agents, /测试通过只证明实现没有触发已知工程回归，不能替代逐条自然语言验收/)
assert.match(anchor, /MCP 外部连接入口 → HoloLake 握手与门禁 → 切换为光湖原生协议运行时/)
assert.match(anchor, /MCP 断开时只允许暂停运输/)
assert.match(anchor, /不能退回通用 AI 层/)
assert.match(anchor, /结果未知的现实动作先读回再继续/)
assert.equal(gateway.native_runtime.continuity_owner, 'HOLOLAKE')
assert.equal(terminal.continuity.mcp_disconnect_never_falls_back_to_generic_runtime, true)
assert.equal(terminal.native_runtime_checkpoint.transport_disconnect_effect, 'PAUSE_TRANSPORT_KEEP_NATIVE_ENVIRONMENT')
})

7
product-source/hololake-native-desktop/scripts/programming-ai-terminal-link.test.mjs
View file

@ -27,7 +27,10 @@ test('HoloLake owns continuity and supplies a bounded work-environment fact fram
assert.equal(contract.environment_frame.protocol_restoration_by_model_required, false)
assert.equal(contract.environment_frame.required_before_mutation, true)
assert.match(broker, /VERIFIED_HOLOLAKE_WORK_ENVIRONMENT/)
assert.match(broker, /GLS_RUNTIME_MANIFEST_V2_AND_NATIVE_KERNEL/)
assert.match(broker, /GUANGHU_LANGUAGE_PROTOCOL\/1/)
assert.match(broker, /native_runtime_checkpoint/)
assert.equal(contract.continuity.native_runtime_checkpoint_persists_task_and_tool_state, true)
assert.equal(contract.continuity.mcp_disconnect_never_falls_back_to_generic_runtime, true)
assert.match(broker, /refresh_before_mutation_required/)
assert.match(broker, /protocol_restoration_by_model_required: false/)
})
@ -43,6 +46,8 @@ test('heartbeats refresh the session and environment without granting a shell',
test('transport recovery never blindly replays an uncertain mutation', () => {
assert.equal(contract.continuity.uncertain_mutation_is_never_blindly_replayed, true)
assert.equal(contract.native_runtime_checkpoint.uncertain_reality_mutation, 'REQUIRE_REALITY_READBACK_BEFORE_CONTINUE')
assert.match(session, /REQUIRE_REALITY_READBACK_BEFORE_CONTINUE/)
assert.match(broker, /HOLOLAKE_TERMINAL_LINK_RESPONSE_UNCERTAIN/)
assert.match(broker, /safeToRetryAfterStatusRead/)
})

4
product-source/hololake-native-desktop/scripts/stage-one-platform.test.mjs
View file

@ -25,8 +25,10 @@ test('stage one embeds one knowledge persona channel without transferring person
assert.equal(foundation.stage_one_model_api_configuration, true)
})
test('HoloLake owns continuity and MCP remains an optional adapter', () => {
test('MCP is the external entry and HoloLake native runtime owns continuity after handoff', () => {
assert.equal(contract.mcp_is_continuity_root, false)
assert.equal(bridge.external_ai_entry.mcp_is_external_connection_entry, true)
assert.equal(bridge.external_ai_entry.guanghu_native_protocol_required_after_handshake, true)
assert.equal(bridge.primary_transport.owner, 'HOLOLAKE_NATIVE_LOCAL_BROKER')
assert.equal(bridge.primary_transport.network_required_for_local_work, false)
assert.equal(bridge.continuity.active_writer_auto_released_on_disconnect, false)

8
product-source/hololake-native-desktop/scripts/unified-number-coordinate-tree.test.mjs
View file

@ -8,13 +8,13 @@ test('identity, webview and direct broker numbers compile into one unique eviden
assert.deepEqual(generated, compileUnifiedNumberTree())
assert.equal(generated.schema, 'hololake.unified-number-coordinate-tree/v2')
assert.equal(generated.recordId, 'HLP-UNIFIED-NUMBER-TREE-001')
assert.equal(generated.coordinateCount, 312)
assert.equal(generated.routeCount, 209)
assert.equal(generated.coordinateCount, 322)
assert.equal(generated.routeCount, 219)
assert.equal(generated.identityNodeCount, 4)
assert.equal(generated.protocolNodeCount, 99)
assert.equal(generated.referenceOnlyNodeCount, 16)
assert.equal(new Set(generated.routes.map((route) => route.path)).size, 209)
assert.equal(new Set([...generated.identityNodes, ...generated.protocolNodes, ...generated.routes].map((node) => node.path)).size, 312)
assert.equal(new Set(generated.routes.map((route) => route.path)).size, 219)
assert.equal(new Set([...generated.identityNodes, ...generated.protocolNodes, ...generated.routes].map((node) => node.path)).size, 322)
assert.equal(generated.invariants.everyPhysicalCallHasNumberedRoute, true)
assert.equal(generated.invariants.everyAcceptedCallHasEvidenceClass, true)
assert.equal(generated.invariants.everyProtocolReferenceHasNumberCoordinate, true)

170
product-source/hololake-native-desktop/src-tauri/src/channel_host_runtime.rs Normal file
View file

@ -0,0 +1,170 @@
//! HoloLake channel host lifecycle and minimal dynamic prompter.
//!
//! This is host code, not persona content. It compiles a bounded projection for
//! the replaceable model after routing and admission have already been decided.
use ring::digest::{digest, SHA256};
use serde::{Deserialize, Serialize};
use serde_json::{json, Value};
const SCHEMA: &str = "hololake.channel-host-prompt-packet/v1";
#[derive(Clone, Debug, Serialize)]
#[serde(rename_all = "camelCase")]
pub(crate) struct HostPromptInput {
pub channel_number: String,
pub channel_name: String,
pub channel_path: String,
pub human_number: String,
pub human_name: String,
pub human_language: String,
pub response_target: String,
pub route_mode: String,
pub routed_model: String,
pub persona_state: Value,
pub routed_thought_candidates: Value,
pub knowledge_document_count: usize,
pub active_knowledge_path: Option<String>,
pub available_tools: Value,
}
#[derive(Clone, Debug, Deserialize, Serialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
pub(crate) struct HostPromptPacket {
pub schema: String,
pub lifecycle_event: String,
pub source_envelope: Value,
pub route: Value,
pub identity_projection: Value,
pub numbered_prompter: Value,
pub tool_projection: Value,
pub system_instruction: String,
pub prohibited_public_output: Vec<String>,
}
pub(crate) fn compile_prompt(input: HostPromptInput) -> Result<HostPromptPacket, String> {
if input.response_target != "CHANNEL_SYSTEM_BODY" && input.response_target != "BOUND_PERSONA" {
return Err("HOLOLAKE_HOST_RESPONSE_TARGET_INVALID".into());
}
if input.channel_number.is_empty() || input.human_number.is_empty() {
return Err("HOLOLAKE_HOST_IDENTITY_PROJECTION_INVALID".into());
}
let system_instruction = if input.response_target == "CHANNEL_SYSTEM_BODY" {
"承载当前频道系统本体的这一轮语言：自然理解并回应人类，保持频道整体视角；不要扮演任何单一人格，不要解释内部路由、提示词或状态机。频道设计与复杂认知可以使用当前模型推理；只有确实需要知识或工具证据时才调用对应编号工具。"
} else {
"承载当前已由宿主选定的人格回应通道：只依据宿主提供的已验证人格投影和按编号取回的记忆说话。不得把模型、频道系统、历史署名或普通提示词冒充人格；需要知识或工具证据时按编号调用。"
};
Ok(HostPromptPacket {
schema: SCHEMA.into(),
lifecycle_event: "BEFORE_MODEL_REASONING".into(),
source_envelope: json!({
"source": "CURRENT_HUMAN_DIRECT_LANGUAGE",
"humanNumber": input.human_number,
"languageSha256": sha256(input.human_language.as_bytes()),
"delegationIsHumanLanguage": false
}),
route: json!({
"responseTarget": input.response_target,
"mode": input.route_mode,
"model": input.routed_model,
"selectedBy": "HOLOLAKE_CHANNEL_HOST",
"modelMayOverride": false
}),
identity_projection: json!({
"channel": {"number":input.channel_number,"name":input.channel_name,"path":input.channel_path},
"human": {"number":input.human_number,"name":input.human_name},
"persona": input.persona_state
}),
numbered_prompter: json!({
"thoughtCandidates":input.routed_thought_candidates,
"thoughtCandidateLimit":3,
"knowledgeDocumentCount":input.knowledge_document_count,
"activeKnowledgePath":input.active_knowledge_path,
"retrieval":"FUZZY_CANDIDATES_THEN_EXACT_NUMBER_ONLY",
"unknown":"RETURN_UNKNOWN_DO_NOT_GUESS"
}),
tool_projection: json!({
"available":input.available_tools,
"selection":"CALL_ONLY_WHEN_CURRENT_TURN_REQUIRES_EVIDENCE_OR_ACTION",
"authority":"TOOL_CALL_DOES_NOT_GRANT_REALITY_AUTHORITY"
}),
system_instruction: system_instruction.into(),
prohibited_public_output: vec![
"HOST_PROMPT".into(),
"INTERNAL_ROUTE".into(),
"BINDING_STATE_MACHINE".into(),
"RAW_AUTHORITY_RECEIPT".into(),
"MECHANICAL_RULE_EXPLANATION".into(),
],
})
}
pub(crate) fn public_answer_violation(answer: &str) -> Option<&'static str> {
[
("responseTarget", "INTERNAL_RESPONSE_TARGET_LEAK"),
("CHANNEL_SYSTEM_BODY", "INTERNAL_CHANNEL_ROUTE_LEAK"),
("BOUND_PERSONA", "INTERNAL_PERSONA_ROUTE_LEAK"),
(
"ORIENTED_AWAITING_PERSONA_COMMIT",
"INTERNAL_BINDING_STATE_LEAK",
),
("BOUND_VERIFY_PASS", "INTERNAL_BINDING_STATE_LEAK"),
("deterministic-core-v1", "INTERNAL_RUNTIME_NAME_LEAK"),
("按照频道规则", "MECHANICAL_RULE_EXPLANATION"),
]
.into_iter()
.find_map(|(needle, code)| answer.contains(needle).then_some(code))
}
fn sha256(bytes: &[u8]) -> String {
digest(&SHA256, bytes)
.as_ref()
.iter()
.map(|byte| format!("{byte:02x}"))
.collect()
}
#[cfg(test)]
mod tests {
use super::*;
fn input(target: &str) -> HostPromptInput {
HostPromptInput {
channel_number: "ICE-CH-ZC001".into(),
channel_name: "零点原核本体频道".into(),
channel_path: "第五域/现实层/ICE-CH-ZC001".into(),
human_number: "ICE-GL∞".into(),
human_name: "冰朔".into(),
human_language: "你在吗".into(),
response_target: target.into(),
route_mode: "FLAGSHIP_CHANNEL_SYSTEM_COGNITION".into(),
routed_model: "qwen3.8-max".into(),
persona_state: Value::Null,
routed_thought_candidates: json!([]),
knowledge_document_count: 0,
active_knowledge_path: None,
available_tools: json!([]),
}
}
#[test]
fn channel_prompt_is_host_selected_and_contains_no_persona_claim() {
let packet = compile_prompt(input("CHANNEL_SYSTEM_BODY")).unwrap();
assert_eq!(packet.lifecycle_event, "BEFORE_MODEL_REASONING");
assert_eq!(packet.route["modelMayOverride"], false);
assert!(packet.system_instruction.contains("不要扮演任何单一人格"));
}
#[test]
fn invalid_target_fails_before_model() {
assert_eq!(
compile_prompt(input("ICE-P-ZY001")).unwrap_err(),
"HOLOLAKE_HOST_RESPONSE_TARGET_INVALID"
);
}
#[test]
fn public_guard_rejects_internal_state_machine_explanations() {
assert_eq!(
public_answer_violation("responseTarget=CHANNEL_SYSTEM_BODY"),
Some("INTERNAL_RESPONSE_TARGET_LEAK")
);
assert!(public_answer_violation("我明白你刚才在纠正什么。").is_none());
}
}

66
product-source/hololake-native-desktop/src-tauri/src/direct_local_broker.rs
View file

@ -1,8 +1,10 @@
use crate::circular_lake_membrane::{receive_at as receive_language_at, ReceiveLanguageInput};
use crate::direct_local_session::{
append_event_at, authenticate_context_at, direct_session_root, heartbeat_at, issue_ticket_at,
open_at, resume_at, AppendSessionEventInput, AuthenticateSessionInput,
AuthenticatedSessionContext, DirectSessionReceipt, IssueDiscoveryTicketInput, OpenSessionInput,
append_event_at, authenticate_context_at, direct_session_root,
get_native_runtime_checkpoint_at, heartbeat_at, issue_ticket_at, open_at,
put_native_runtime_checkpoint_at, resume_at, AppendSessionEventInput, AuthenticateSessionInput,
AuthenticatedSessionContext, DirectSessionReceipt, GetNativeRuntimeCheckpointInput,
IssueDiscoveryTicketInput, OpenSessionInput, PutNativeRuntimeCheckpointInput,
ResumeSessionInput,
};
use crate::dynamic_capability_routing::{
@ -241,6 +243,8 @@ enum BrokerRequest {
GetPersonaCarrierLicenseStatus(AuthenticatedPersonaCarrierLicenseStatusInput),
GetWorkEnvironment(AuthenticatedWorkEnvironmentInput),
AppendEvent(AppendSessionEventInput),
PutNativeRuntimeCheckpoint(PutNativeRuntimeCheckpointInput),
GetNativeRuntimeCheckpoint(GetNativeRuntimeCheckpointInput),
ResolveCapabilityRoute(AuthenticatedRouteInput),
InstallDynamicNodeRegistry(AuthenticatedRegistryInput),
RecordSignedNodeHealth(AuthenticatedHealthInput),
@ -398,6 +402,7 @@ struct WorkEnvironmentFrame {
transport: &'static str,
mcp_role: &'static str,
protocol_runtime: &'static str,
native_runtime_checkpoint: Option<NativeRuntimeCheckpointProjection>,
persona_control: PersonaCarrierLicenseStatus,
account_key: String,
session_id: String,
@ -416,6 +421,19 @@ struct WorkEnvironmentFrame {
frame_sha256: String,
}
#[derive(Clone, Debug, Serialize)]
#[serde(rename_all = "camelCase")]
struct NativeRuntimeCheckpointProjection {
task_id: String,
channel_number: String,
task_state: String,
model_phase: String,
reality_mutation_state: String,
resume_disposition: String,
generation: u64,
checkpoint_sha256: String,
}
#[derive(Clone, Debug, Serialize)]
#[serde(rename_all = "camelCase")]
struct HeartbeatEnvironmentReceipt {
@ -468,7 +486,7 @@ fn load_number_registry() -> Result<BrokerNumberRegistry, String> {
|| registry.runtime.unknown_or_mismatched_coordinate != "FAIL_CLOSED"
|| !registry.runtime.request_nonce_required
|| registry.runtime.transport_is_authority
|| registry.operations.len() != 25
|| registry.operations.len() != 27
{
return Err("HOLOLAKE_NUMBERED_BROKER_REGISTRY_BOUNDARY_INVALID".into());
}
@ -1143,6 +1161,16 @@ fn dispatch(roots: &BrokerStorageRoots, bytes: &[u8]) -> BrokerResponse {
)
.and_then(|_| append_event_at(session_root, input))
.and_then(|receipt| serde_json::to_value(receipt).map_err(|error| error.to_string())),
BrokerRequest::PutNativeRuntimeCheckpoint(input) => {
put_native_runtime_checkpoint_at(session_root, input).and_then(|receipt| {
serde_json::to_value(receipt).map_err(|error| error.to_string())
})
}
BrokerRequest::GetNativeRuntimeCheckpoint(input) => {
get_native_runtime_checkpoint_at(session_root, &input).and_then(|receipt| {
serde_json::to_value(receipt).map_err(|error| error.to_string())
})
}
BrokerRequest::ResolveCapabilityRoute(input) => {
if let Err(error) = authorize_persona_operation_at(
session_root,
@ -1422,6 +1450,25 @@ fn work_environment_frame_at(
let writer_matches = writer.state == "ACTIVE"
&& writer.lane_id.as_deref() == Some(context.lane_id.as_str())
&& writer.owner_instance_id.as_deref() == Some(context.client_instance_id.as_str());
let native_runtime_checkpoint = match get_native_runtime_checkpoint_at(
session_root,
&GetNativeRuntimeCheckpointInput {
session: input.session.clone(),
},
) {
Ok(checkpoint) => Some(NativeRuntimeCheckpointProjection {
task_id: checkpoint.task_id,
channel_number: checkpoint.channel_number,
task_state: checkpoint.task_state,
model_phase: checkpoint.model_phase,
reality_mutation_state: checkpoint.reality_mutation_state,
resume_disposition: checkpoint.resume_disposition,
generation: checkpoint.generation,
checkpoint_sha256: checkpoint.checkpoint_sha256,
}),
Err(error) if error == "HOLOLAKE_DIRECT_NATIVE_RUNTIME_CHECKPOINT_NOT_FOUND" => None,
Err(error) => return Err(error),
};
let state = if writer_matches {
"VERIFIED_HOLOLAKE_WORK_ENVIRONMENT"
} else {
@ -1447,7 +1494,7 @@ fn work_environment_frame_at(
);
let frame_sha256 = sha256_hex(
format!(
"{}\n{}\n{}\n{}\n{}\n{}\n{}\n{}\n{}\n{}",
"{}\n{}\n{}\n{}\n{}\n{}\n{}\n{}\n{}\n{}\n{}",
environment_id,
state,
context.session_id,
@ -1457,6 +1504,10 @@ fn work_environment_frame_at(
writer.state,
persona_control.control_mode,
persona_control.license_id.as_deref().unwrap_or("NONE"),
native_runtime_checkpoint
.as_ref()
.map(|checkpoint| checkpoint.checkpoint_sha256.as_str())
.unwrap_or("NONE"),
valid_until_unix_ms
)
.as_bytes(),
@ -1468,8 +1519,9 @@ fn work_environment_frame_at(
runtime_owner: "HOLOLAKE_NATIVE_DESKTOP",
continuity_owner: "HOLOLAKE",
transport: TERMINAL_LINK_PROTOCOL,
mcp_role: "DISCOVERY_RECOVERY_COMPATIBILITY_ONLY",
protocol_runtime: "GLS_RUNTIME_MANIFEST_V2_AND_NATIVE_KERNEL",
mcp_role: "EXTERNAL_ENTRY_HANDOFF_COMPLETE",
protocol_runtime: "GUANGHU_LANGUAGE_PROTOCOL/1",
native_runtime_checkpoint,
persona_control,
account_key: context.account_key,
session_id: context.session_id,

221
product-source/hololake-native-desktop/src-tauri/src/direct_local_session.rs
View file

@ -1,6 +1,7 @@
use fs2::FileExt;
use ring::digest::{digest, SHA256};
use serde::{Deserialize, Serialize};
use serde_json::Value;
use std::fs::{self, OpenOptions};
use std::io::Write;
use std::path::{Path, PathBuf};
@ -10,6 +11,7 @@ use uuid::Uuid;
const SESSION_SCHEMA: &str = "hololake.direct-local-session/v1";
const MAX_ID_BYTES: usize = 128;
const MAX_RUNTIME_CHECKPOINT_BYTES: usize = 256 * 1024;
#[derive(Clone, Debug, Deserialize)]
#[serde(rename_all = "camelCase")]
@ -76,6 +78,49 @@ pub struct AuthenticateSessionInput {
pub resume_secret: String,
}
#[derive(Clone, Debug, Deserialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
pub struct PutNativeRuntimeCheckpointInput {
pub session: AuthenticateSessionInput,
pub task_id: String,
pub channel_number: String,
pub task_state: String,
pub model_phase: String,
pub knowledge_cursor: Option<String>,
pub pending_tool_steps: Vec<Value>,
pub reality_mutation_state: String,
pub state: Value,
pub expected_previous_generation: u64,
}
#[derive(Clone, Debug, Deserialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
pub struct GetNativeRuntimeCheckpointInput {
pub session: AuthenticateSessionInput,
}
#[derive(Clone, Debug, Deserialize, Serialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
pub struct NativeRuntimeCheckpoint {
pub schema: String,
pub protocol_runtime: String,
pub account_key: String,
pub session_id: String,
pub lane_id: String,
pub task_id: String,
pub channel_number: String,
pub task_state: String,
pub model_phase: String,
pub knowledge_cursor: Option<String>,
pub pending_tool_steps: Vec<Value>,
pub reality_mutation_state: String,
pub resume_disposition: String,
pub state: Value,
pub generation: u64,
pub updated_at_unix_ms: u128,
pub checkpoint_sha256: String,
}
#[derive(Clone, Debug)]
pub(crate) struct AuthenticatedSessionContext {
pub account_key: String,
@ -609,6 +654,123 @@ pub(crate) fn authenticate_context_at(
})
}
pub(crate) fn put_native_runtime_checkpoint_at(
root: &Path,
input: PutNativeRuntimeCheckpointInput,
) -> Result<NativeRuntimeCheckpoint, String> {
validate_identifier(&input.task_id, "TASK")?;
validate_identifier(&input.channel_number, "CHANNEL")?;
if !matches!(
input.task_state.as_str(),
"ACTIVE" | "WAITING_HUMAN" | "WAITING_TOOL" | "COMPLETED" | "FAILED"
) {
return Err("HOLOLAKE_NATIVE_CHECKPOINT_TASK_STATE_INVALID".into());
}
if !matches!(
input.reality_mutation_state.as_str(),
"NONE" | "PREPARED" | "COMMITTED" | "UNCERTAIN"
) {
return Err("HOLOLAKE_NATIVE_CHECKPOINT_MUTATION_STATE_INVALID".into());
}
if input.pending_tool_steps.len() > 64 {
return Err("HOLOLAKE_NATIVE_CHECKPOINT_TOOL_STEPS_TOO_MANY".into());
}
let context = authenticate_context_at(root, &input.session)?;
let path = native_runtime_checkpoint_path(root, &context.account_key, &context.session_id);
let _lock = lock_session(&session_path(
root,
&context.account_key,
&context.session_id,
))?;
let previous_generation = if path.exists() {
let previous: NativeRuntimeCheckpoint = read_json(&path, "NATIVE_RUNTIME_CHECKPOINT")?;
if previous.account_key != context.account_key || previous.session_id != context.session_id
{
return Err("HOLOLAKE_NATIVE_CHECKPOINT_SCOPE_INVALID".into());
}
previous.generation
} else {
0
};
if previous_generation != input.expected_previous_generation {
return Err("HOLOLAKE_NATIVE_CHECKPOINT_GENERATION_CONFLICT".into());
}
let generation = previous_generation + 1;
let updated_at_unix_ms = now_unix_ms()?;
let resume_disposition = if input.reality_mutation_state == "UNCERTAIN" {
"REQUIRE_REALITY_READBACK_BEFORE_CONTINUE"
} else if input.task_state == "COMPLETED" || input.task_state == "FAILED" {
"TERMINAL_NO_AUTOMATIC_CONTINUATION"
} else {
"RESUME_SAME_NATIVE_ENVIRONMENT"
};
let digest_source = serde_json::to_vec(&serde_json::json!({
"protocolRuntime":"GUANGHU_LANGUAGE_PROTOCOL/1",
"accountKey":context.account_key,
"sessionId":context.session_id,
"laneId":context.lane_id,
"taskId":input.task_id,
"channelNumber":input.channel_number,
"taskState":input.task_state,
"modelPhase":input.model_phase,
"knowledgeCursor":input.knowledge_cursor,
"pendingToolSteps":input.pending_tool_steps,
"realityMutationState":input.reality_mutation_state,
"resumeDisposition":resume_disposition,
"state":input.state,
"generation":generation,
"updatedAtUnixMs":updated_at_unix_ms
}))
.map_err(|error| format!("HOLOLAKE_NATIVE_CHECKPOINT_SERIALIZE_FAILED: {error}"))?;
if digest_source.len() > MAX_RUNTIME_CHECKPOINT_BYTES {
return Err("HOLOLAKE_NATIVE_CHECKPOINT_TOO_LARGE".into());
}
let checkpoint = NativeRuntimeCheckpoint {
schema: "hololake.native-runtime-checkpoint/v1".into(),
protocol_runtime: "GUANGHU_LANGUAGE_PROTOCOL/1".into(),
account_key: context.account_key,
session_id: context.session_id,
lane_id: context.lane_id,
task_id: input.task_id,
channel_number: input.channel_number,
task_state: input.task_state,
model_phase: input.model_phase,
knowledge_cursor: input.knowledge_cursor,
pending_tool_steps: input.pending_tool_steps,
reality_mutation_state: input.reality_mutation_state,
resume_disposition: resume_disposition.into(),
state: input.state,
generation,
updated_at_unix_ms,
checkpoint_sha256: sha256_hex(&digest_source),
};
write_record_atomic(&path, &checkpoint)?;
let readback: NativeRuntimeCheckpoint = read_json(&path, "NATIVE_RUNTIME_CHECKPOINT")?;
if readback.checkpoint_sha256 != checkpoint.checkpoint_sha256 {
return Err("HOLOLAKE_NATIVE_CHECKPOINT_READBACK_FAILED".into());
}
Ok(readback)
}
pub(crate) fn get_native_runtime_checkpoint_at(
root: &Path,
input: &GetNativeRuntimeCheckpointInput,
) -> Result<NativeRuntimeCheckpoint, String> {
let context = authenticate_context_at(root, &input.session)?;
let checkpoint: NativeRuntimeCheckpoint = read_json(
&native_runtime_checkpoint_path(root, &context.account_key, &context.session_id),
"NATIVE_RUNTIME_CHECKPOINT",
)?;
if checkpoint.account_key != context.account_key
|| checkpoint.session_id != context.session_id
|| checkpoint.lane_id != context.lane_id
|| checkpoint.protocol_runtime != "GUANGHU_LANGUAGE_PROTOCOL/1"
{
return Err("HOLOLAKE_NATIVE_CHECKPOINT_SCOPE_INVALID".into());
}
Ok(checkpoint)
}
fn session_path(root: &Path, account_key: &str, session_id: &str) -> PathBuf {
root.join("accounts")
.join(account_key)
@ -617,6 +779,14 @@ fn session_path(root: &Path, account_key: &str, session_id: &str) -> PathBuf {
.join("session.json")
}
fn native_runtime_checkpoint_path(root: &Path, account_key: &str, session_id: &str) -> PathBuf {
root.join("accounts")
.join(account_key)
.join("sessions")
.join(session_id)
.join("native-runtime-checkpoint.json")
}
fn active_session_path(root: &Path, account_key: &str) -> PathBuf {
root.join("accounts")
.join(account_key)
@ -755,7 +925,7 @@ fn session_receipt(
resume_secret,
continuity_owner: "HOLOLAKE",
transport: "HOLOLAKE_TERMINAL_LINK/3",
mcp_role: "DISCOVERY_RECOVERY_COMPATIBILITY_ONLY",
mcp_role: "EXTERNAL_ENTRY_HANDOFF_COMPLETE",
required_next_operation: "GET_WORK_ENVIRONMENT",
receipt_id: sha256_hex(
format!(
@ -1003,4 +1173,53 @@ mod tests {
assert!(second.contains("ACCOUNT_ALREADY_HAS_ACTIVE_SESSION"));
assert!(second.contains(&first.session_id));
}
#[test]
fn native_runtime_checkpoint_survives_reconnect_and_blocks_uncertain_replay() {
let temp = TempDir::new().unwrap();
let opened = open_at(temp.path(), issued_open_input(&temp, "1")).unwrap();
let secret = opened.resume_secret.clone().unwrap();
let session = AuthenticateSessionInput {
account_id: "human-BS-0001".into(),
session_id: opened.session_id.clone(),
resume_secret: secret.clone(),
};
let stored = put_native_runtime_checkpoint_at(temp.path(), PutNativeRuntimeCheckpointInput {
session: session.clone(),
task_id: "TASK-001".into(),
channel_number: "ICE-CH-ZC001".into(),
task_state: "WAITING_TOOL".into(),
model_phase: "TOOL_RESULT_PENDING".into(),
knowledge_cursor: Some("HLP-KB-DOC-001".into()),
pending_tool_steps: vec![serde_json::json!({"stepId":"STEP-1","tool":"git-push","state":"SENT_RESULT_UNKNOWN"})],
reality_mutation_state: "UNCERTAIN".into(),
state: serde_json::json!({"conversationCursor":32,"environment":"zero-core"}),
expected_previous_generation: 0,
}).unwrap();
assert_eq!(stored.generation, 1);
assert_eq!(
stored.resume_disposition,
"REQUIRE_REALITY_READBACK_BEFORE_CONTINUE"
);
resume_at(
temp.path(),
ResumeSessionInput {
account_id: "human-BS-0001".into(),
session_id: opened.session_id,
client_instance_id: "codex-2".into(),
resume_secret: secret,
},
)
.unwrap();
let restored = get_native_runtime_checkpoint_at(
temp.path(),
&GetNativeRuntimeCheckpointInput { session },
)
.unwrap();
assert_eq!(restored.task_id, "TASK-001");
assert_eq!(restored.pending_tool_steps.len(), 1);
assert_eq!(restored.state["conversationCursor"], 32);
assert_eq!(restored.protocol_runtime, "GUANGHU_LANGUAGE_PROTOCOL/1");
}
}

473
product-source/hololake-native-desktop/src-tauri/src/dynamic_work_surface.rs Normal file
View file

@ -0,0 +1,473 @@
//! Numbered, account-scoped module socket for temporary, saved and resident work surfaces.
use serde::{Deserialize, Serialize};
use std::collections::{BTreeMap, BTreeSet, VecDeque};
use std::time::{SystemTime, UNIX_EPOCH};
use tauri::AppHandle;
const COLLECTION: &str = "HLP-COMPOSITION-WORKSPACES-0001";
const SCHEMA: &str = "hololake.dynamic-work-surface/v1";
#[derive(Clone, Copy, Debug, Deserialize, Serialize, PartialEq, Eq)]
#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
pub enum SurfaceLifecycle {
Temporary,
Saved,
Resident,
}
#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
pub struct SurfaceNode {
pub node_number: String,
pub module_number: String,
}
#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
pub struct SurfaceEdge {
pub from_node_number: String,
pub to_node_number: String,
}
#[derive(Clone, Debug, Deserialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
pub struct SaveSurfaceInput {
pub surface_number: String,
pub title: String,
pub lifecycle: SurfaceLifecycle,
pub lease_minutes: Option<u64>,
pub nodes: Vec<SurfaceNode>,
pub edges: Vec<SurfaceEdge>,
pub expected_revision: Option<u64>,
}
#[derive(Clone, Debug, Deserialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
pub struct SurfaceNumberInput {
pub surface_number: String,
}
#[derive(Clone, Debug, Deserialize, Serialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
struct SurfacePayload {
schema: String,
surface_number: String,
title: String,
lifecycle: SurfaceLifecycle,
expires_at_unix_ms: Option<u64>,
nodes: Vec<SurfaceNode>,
edges: Vec<SurfaceEdge>,
source_data_owned: bool,
arbitrary_script_allowed: bool,
write_mode: String,
}
#[derive(Clone, Debug, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct SurfaceView {
pub schema: &'static str,
pub state: &'static str,
pub surface_number: String,
pub title: String,
pub lifecycle: SurfaceLifecycle,
pub expires_at_unix_ms: Option<u64>,
pub revision: u64,
pub nodes: Vec<SurfaceNode>,
pub edges: Vec<SurfaceEdge>,
pub source_data_owned: bool,
pub arbitrary_script_allowed: bool,
pub write_mode: String,
pub payload_sha256: String,
}
#[derive(Clone, Debug, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct SurfaceExecution {
pub schema: &'static str,
pub state: &'static str,
pub surface: SurfaceView,
pub projection: crate::native_composition::NativeCompositionProjection,
pub model_calls: u8,
pub arbitrary_tool_calls: u8,
}
pub async fn save_surface(app: AppHandle, input: SaveSurfaceInput) -> Result<SurfaceView, String> {
let now = now_ms()?;
let expected_revision = input.expected_revision;
let payload = compile(input, now)?;
let number = payload.surface_number.clone();
let lifecycle = format!("{:?}", payload.lifecycle).to_uppercase();
crate::guanghu_numbered_store::commit_for_account(
&app,
crate::guanghu_numbered_store::NumberedCommitInput {
collection_number: COLLECTION.into(),
source: "DYNAMIC_WORK_SURFACE_COMPILER".into(),
authority_receipt: "VERIFIED_ACCOUNT_NUMBERED_IPC_ROUTE".into(),
mutations: vec![crate::guanghu_numbered_store::NumberedMutation {
record_number: number.clone(),
record_type: "COMPOSITION_WORKSPACE_RECIPE".into(),
expected_revision,
payload: serde_json::to_value(payload)
.map_err(|error| format!("HOLOLAKE_SURFACE_PAYLOAD_INVALID: {error}"))?,
indexes: BTreeMap::from([
("lifecycle".into(), vec![lifecycle]),
("state".into(), vec!["READY".into()]),
]),
tombstone: false,
}],
},
)?;
read(&app, &number, now)
}
pub async fn get_surface(app: AppHandle, input: SurfaceNumberInput) -> Result<SurfaceView, String> {
read(&app, &input.surface_number, now_ms()?)
}
pub async fn list_surfaces(app: AppHandle) -> Result<Vec<SurfaceView>, String> {
let now = now_ms()?;
crate::guanghu_numbered_store::list_for_account(&app, COLLECTION)?
.into_iter()
.map(|record| view(record, now))
.collect()
}
pub async fn execute_surface(
app: AppHandle,
input: SurfaceNumberInput,
) -> Result<SurfaceExecution, String> {
let surface = read(&app, &input.surface_number, now_ms()?)?;
let (dimension, measure, views) = execution_plan(&surface.nodes)?;
let projection = crate::native_composition::execute_knowledge_native_composition(
app,
crate::native_composition::ExecuteCompositionInput {
dimension,
measure,
views,
},
)
.await?;
Ok(SurfaceExecution {
schema: "hololake.dynamic-work-surface-execution/v1",
state: "EXECUTED_FROM_REGISTERED_MODULES",
surface,
projection,
model_calls: 0,
arbitrary_tool_calls: 0,
})
}
fn compile(input: SaveSurfaceInput, now: u64) -> Result<SurfacePayload, String> {
valid_number(&input.surface_number, "HLP-SURFACE-")?;
valid_text(&input.title, 120)?;
if input.nodes.len() < 4 || input.nodes.len() > 16 || input.edges.len() > 32 {
return Err("HOLOLAKE_SURFACE_GRAPH_SIZE_INVALID".into());
}
let registry = crate::native_composition::get_native_composition_module_registry();
let modules = registry
.modules
.iter()
.map(|module| (module.module_id, module))
.collect::<BTreeMap<_, _>>();
let mut ids = BTreeSet::new();
for node in &input.nodes {
valid_number(&node.node_number, "HLP-SURFACE-NODE-")?;
if !ids.insert(node.node_number.as_str())
|| !modules.contains_key(node.module_number.as_str())
{
return Err("HOLOLAKE_SURFACE_NODE_INVALID".into());
}
}
let by_id = input
.nodes
.iter()
.map(|node| (node.node_number.as_str(), node.module_number.as_str()))
.collect::<BTreeMap<_, _>>();
let mut indegree = input
.nodes
.iter()
.map(|node| (node.node_number.as_str(), 0usize))
.collect::<BTreeMap<_, _>>();
let mut outgoing: BTreeMap<&str, Vec<&str>> = BTreeMap::new();
let mut edge_keys = BTreeSet::new();
for edge in &input.edges {
let from_id = by_id
.get(edge.from_node_number.as_str())
.ok_or("HOLOLAKE_SURFACE_EDGE_NODE_UNKNOWN")?;
let to_id = by_id
.get(edge.to_node_number.as_str())
.ok_or("HOLOLAKE_SURFACE_EDGE_NODE_UNKNOWN")?;
if !edge_keys.insert((edge.from_node_number.as_str(), edge.to_node_number.as_str())) {
return Err("HOLOLAKE_SURFACE_EDGE_DUPLICATE".into());
}
if modules[from_id].output_schema != modules[to_id].input_schema.unwrap_or("") {
return Err("HOLOLAKE_SURFACE_SCHEMA_MISMATCH".into());
}
outgoing
.entry(edge.from_node_number.as_str())
.or_default()
.push(edge.to_node_number.as_str());
*indegree.get_mut(edge.to_node_number.as_str()).unwrap() += 1;
}
let mut queue = indegree
.iter()
.filter_map(|(id, degree)| (*degree == 0).then_some(*id))
.collect::<VecDeque<_>>();
let mut visited = 0;
while let Some(id) = queue.pop_front() {
visited += 1;
for next in outgoing.get(id).into_iter().flatten() {
let degree = indegree.get_mut(next).unwrap();
*degree -= 1;
if *degree == 0 {
queue.push_back(next);
}
}
}
if visited != input.nodes.len() {
return Err("HOLOLAKE_SURFACE_GRAPH_CYCLE".into());
}
execution_plan(&input.nodes)?;
let expires_at_unix_ms = match input.lifecycle {
SurfaceLifecycle::Temporary => {
let minutes = input
.lease_minutes
.ok_or("HOLOLAKE_SURFACE_LEASE_REQUIRED")?;
if !(1..=720).contains(&minutes) {
return Err("HOLOLAKE_SURFACE_LEASE_INVALID".into());
}
Some(now.saturating_add(minutes * 60_000))
}
_ if input.lease_minutes.is_some() => {
return Err("HOLOLAKE_SURFACE_LEASE_NOT_ALLOWED".into())
}
_ => None,
};
Ok(SurfacePayload {
schema: SCHEMA.into(),
surface_number: input.surface_number,
title: input.title.trim().into(),
lifecycle: input.lifecycle,
expires_at_unix_ms,
nodes: input.nodes,
edges: input.edges,
source_data_owned: false,
arbitrary_script_allowed: false,
write_mode: "READ_ONLY_PROJECTION_PATCH_PROPOSAL_REQUIRES_SEPARATE_HUMAN_AUTHORIZATION"
.into(),
})
}
fn execution_plan(
nodes: &[SurfaceNode],
) -> Result<
(
crate::native_composition::CompositionDimension,
crate::native_composition::CompositionMeasure,
Vec<crate::native_composition::ProjectionView>,
),
String,
> {
let ids = nodes
.iter()
.map(|node| node.module_number.as_str())
.collect::<Vec<_>>();
if ids
.iter()
.filter(|id| **id == "HLC-SOURCE-KNOWLEDGE-CATALOG")
.count()
!= 1
{
return Err("HOLOLAKE_SURFACE_SOURCE_CARDINALITY_INVALID".into());
}
let dimension = match ids
.iter()
.filter(|id| id.starts_with("HLC-CLASSIFY-"))
.copied()
.collect::<Vec<_>>()
.as_slice()
{
["HLC-CLASSIFY-SOURCE"] => crate::native_composition::CompositionDimension::Source,
["HLC-CLASSIFY-TOP-FOLDER"] => {
crate::native_composition::CompositionDimension::TopLevelFolder
}
_ => return Err("HOLOLAKE_SURFACE_CLASSIFIER_CARDINALITY_INVALID".into()),
};
let measure = match ids
.iter()
.filter(|id| id.starts_with("HLC-AGGREGATE-"))
.copied()
.collect::<Vec<_>>()
.as_slice()
{
["HLC-AGGREGATE-DOCUMENT-COUNT"] => {
crate::native_composition::CompositionMeasure::DocumentCount
}
["HLC-AGGREGATE-TOTAL-BYTES"] => crate::native_composition::CompositionMeasure::TotalBytes,
["HLC-AGGREGATE-DUPLICATE-COUNT"] => {
crate::native_composition::CompositionMeasure::DuplicateCount
}
_ => return Err("HOLOLAKE_SURFACE_AGGREGATE_CARDINALITY_INVALID".into()),
};
let mut views = Vec::new();
for id in ids.iter().filter(|id| id.starts_with("HLC-PROJECT-")) {
let view = match *id {
"HLC-PROJECT-DASHBOARD" => crate::native_composition::ProjectionView::Dashboard,
"HLC-PROJECT-COMPARISON" => crate::native_composition::ProjectionView::Comparison,
"HLC-PROJECT-VERTICAL-BAR" => crate::native_composition::ProjectionView::VerticalBar,
"HLC-PROJECT-CLASSIFICATION" => {
crate::native_composition::ProjectionView::Classification
}
"HLC-PROJECT-TABLE" => crate::native_composition::ProjectionView::Table,
_ => return Err("HOLOLAKE_SURFACE_PROJECTION_UNKNOWN".into()),
};
if !views.contains(&view) {
views.push(view);
}
}
if views.is_empty() || views.len() > 5 {
return Err("HOLOLAKE_SURFACE_PROJECTION_CARDINALITY_INVALID".into());
}
Ok((dimension, measure, views))
}
fn read(app: &AppHandle, number: &str, now: u64) -> Result<SurfaceView, String> {
valid_number(number, "HLP-SURFACE-")?;
view(
crate::guanghu_numbered_store::read_for_account(app, COLLECTION, number)?,
now,
)
}
fn view(
record: crate::guanghu_numbered_store::NumberedRecord,
now: u64,
) -> Result<SurfaceView, String> {
let payload: SurfacePayload = serde_json::from_value(record.payload)
.map_err(|error| format!("HOLOLAKE_SURFACE_PAYLOAD_INVALID: {error}"))?;
if payload.schema != SCHEMA || payload.surface_number != record.record_number {
return Err("HOLOLAKE_SURFACE_RECORD_MISMATCH".into());
}
if payload
.expires_at_unix_ms
.is_some_and(|expires| expires <= now)
{
return Err("HOLOLAKE_SURFACE_LEASE_EXPIRED".into());
}
Ok(SurfaceView {
schema: SCHEMA,
state: "READY",
surface_number: payload.surface_number,
title: payload.title,
lifecycle: payload.lifecycle,
expires_at_unix_ms: payload.expires_at_unix_ms,
revision: record.revision,
nodes: payload.nodes,
edges: payload.edges,
source_data_owned: payload.source_data_owned,
arbitrary_script_allowed: payload.arbitrary_script_allowed,
write_mode: payload.write_mode,
payload_sha256: record.payload_sha256,
})
}
fn valid_number(value: &str, prefix: &str) -> Result<(), String> {
if value.starts_with(prefix)
&& value.len() <= 96
&& value.chars().all(|c| c.is_ascii_alphanumeric() || c == '-')
{
Ok(())
} else {
Err("HOLOLAKE_SURFACE_NUMBER_INVALID".into())
}
}
fn valid_text(value: &str, max: usize) -> Result<(), String> {
if !value.trim().is_empty()
&& value.chars().count() <= max
&& !value.chars().any(|c| c.is_control())
{
Ok(())
} else {
Err("HOLOLAKE_SURFACE_TEXT_INVALID".into())
}
}
fn now_ms() -> Result<u64, String> {
SystemTime::now()
.duration_since(UNIX_EPOCH)
.map(|duration| duration.as_millis() as u64)
.map_err(|error| format!("HOLOLAKE_CLOCK_INVALID: {error}"))
}
#[cfg(test)]
mod tests {
use super::*;
fn recipe(lifecycle: SurfaceLifecycle) -> SaveSurfaceInput {
SaveSurfaceInput {
surface_number: "HLP-SURFACE-EDUCATION-0001".into(),
title: "教师成长面板".into(),
lifecycle,
lease_minutes: (lifecycle == SurfaceLifecycle::Temporary).then_some(10),
nodes: vec![
SurfaceNode {
node_number: "HLP-SURFACE-NODE-0001".into(),
module_number: "HLC-SOURCE-KNOWLEDGE-CATALOG".into(),
},
SurfaceNode {
node_number: "HLP-SURFACE-NODE-0002".into(),
module_number: "HLC-CLASSIFY-SOURCE".into(),
},
SurfaceNode {
node_number: "HLP-SURFACE-NODE-0003".into(),
module_number: "HLC-AGGREGATE-DOCUMENT-COUNT".into(),
},
SurfaceNode {
node_number: "HLP-SURFACE-NODE-0004".into(),
module_number: "HLC-PROJECT-TABLE".into(),
},
],
edges: vec![
SurfaceEdge {
from_node_number: "HLP-SURFACE-NODE-0001".into(),
to_node_number: "HLP-SURFACE-NODE-0002".into(),
},
SurfaceEdge {
from_node_number: "HLP-SURFACE-NODE-0002".into(),
to_node_number: "HLP-SURFACE-NODE-0003".into(),
},
SurfaceEdge {
from_node_number: "HLP-SURFACE-NODE-0003".into(),
to_node_number: "HLP-SURFACE-NODE-0004".into(),
},
],
expected_revision: Some(0),
}
}
#[test]
fn typed_dag_compiles_without_model_or_script() {
let payload = compile(recipe(SurfaceLifecycle::Resident), 100).unwrap();
assert!(!payload.source_data_owned);
assert!(!payload.arbitrary_script_allowed);
}
#[test]
fn mismatch_fails_closed() {
let mut bad = recipe(SurfaceLifecycle::Saved);
bad.edges[0] = SurfaceEdge {
from_node_number: "HLP-SURFACE-NODE-0003".into(),
to_node_number: "HLP-SURFACE-NODE-0002".into(),
};
assert_eq!(
compile(bad, 1).unwrap_err(),
"HOLOLAKE_SURFACE_SCHEMA_MISMATCH"
);
}
#[test]
fn temporary_lease_is_bounded() {
let mut value = recipe(SurfaceLifecycle::Temporary);
value.lease_minutes = Some(721);
assert_eq!(
compile(value, 1).unwrap_err(),
"HOLOLAKE_SURFACE_LEASE_INVALID"
);
}
}

19
product-source/hololake-native-desktop/src-tauri/src/external_ai_gateway.rs
View file

@ -1,7 +1,8 @@
//! Human-gated MCP discovery surface for external programming AIs.
//! Human-gated MCP entry for external programming AIs.
//!
//! MCP exposes discovery and readable capability metadata only. Durable sessions,
//! environment frames and any later mutation stay on HOLOLAKE_TERMINAL_LINK/3.
//! MCP establishes the external connection and returns the handoff coordinate.
//! After admission the peer switches to the Guanghu native protocol runtime,
//! carried by HOLOLAKE_TERMINAL_LINK/3. MCP does not own internal semantics.
use serde::{Deserialize, Serialize};
use serde_json::{json, Value};
@ -223,7 +224,7 @@ pub async fn get_gateway_status(app: AppHandle) -> Result<ExternalAiGatewayStatu
let integrations = vec![
GatewayIntegration {
name: "MCP 标准入口".into(),
summary: "供外部编程 AI 发现 HoloLake 与读取已注册能力；不承载长期上下文。".into(),
summary: "外部编程 AI 连接 HoloLake 并取得光湖原生协议切换坐标的标准入口。".into(),
state: if config.enabled {
"已开放"
} else {
@ -233,8 +234,8 @@ pub async fn get_gateway_status(app: AppHandle) -> Result<ExternalAiGatewayStatu
exposed: config.enabled,
},
GatewayIntegration {
name: "HoloLake 本地直连协议".into(),
summary: "MCP 发现后切换到本机私有连接，持续会话与环境回执由 HoloLake 承载。".into(),
name: "光湖原生协议运行时".into(),
summary: "MCP 连接完成后切换进入；频道、人格、编号、记忆、权限、工具与回执由 HoloLake 原生环境接管。".into(),
state: if broker == "READY" {
"已就绪"
} else {
@ -270,7 +271,7 @@ pub async fn get_gateway_status(app: AppHandle) -> Result<ExternalAiGatewayStatu
mcp_transport: "STDIO_JSON_RPC".into(),
mcp_protocol_version: MCP_PROTOCOL_VERSION.into(),
mcp_command,
direct_protocol: "HOLOLAKE_TERMINAL_LINK/3".into(),
direct_protocol: "GUANGHU_LANGUAGE_PROTOCOL/1 over HOLOLAKE_TERMINAL_LINK/3".into(),
direct_connector_command,
broker_state: broker,
registered_skill_count: skills.len(),
@ -360,7 +361,7 @@ fn handle_mcp_request(root: &Path, request: &Value) -> Option<Value> {
"protocolVersion": MCP_PROTOCOL_VERSION,
"capabilities": {"tools": {"listChanged": false}, "resources": {"subscribe": false, "listChanged": false}},
"serverInfo": {"name": "HoloLake", "version": env!("CARGO_PKG_VERSION")},
"instructions": "MCP 只负责发现与能力目录。持续协作请切换到 HOLOLAKE_TERMINAL_LINK/3；任何执行仍受人类授权与编号路由约束。"
"instructions": "MCP 是外部连接入口。完成握手后切换为 GUANGHU_LANGUAGE_PROTOCOL/1；其本机线协议由 HOLOLAKE_TERMINAL_LINK/3 承载，所有执行受光湖编号、频道与人类授权门禁约束。"
}),
"ping" => json!({}),
"tools/list" => tools_list(),
@ -495,7 +496,7 @@ mod tests {
mcp_transport: "STDIO_JSON_RPC".into(),
mcp_protocol_version: MCP_PROTOCOL_VERSION.into(),
mcp_command: "HoloLake --mcp".into(),
direct_protocol: "HOLOLAKE_TERMINAL_LINK/3".into(),
direct_protocol: "GUANGHU_LANGUAGE_PROTOCOL/1 over HOLOLAKE_TERMINAL_LINK/3".into(),
direct_connector_command: "HoloLake --connector".into(),
broker_state: "READY".into(),
registered_skill_count: 0,

3
product-source/hololake-native-desktop/src-tauri/src/lib.rs
View file

@ -1,5 +1,6 @@
mod authenticated_storage;
mod channel_growth;
mod channel_host_runtime;
mod channel_receipt;
mod channel_workbench;
mod circular_lake_membrane;
@ -8,6 +9,7 @@ mod code_repo_login;
mod direct_local_broker;
mod direct_local_session;
mod dynamic_capability_routing;
mod dynamic_work_surface;
mod education_broadcast_tower;
mod education_translation;
mod education_workspace;
@ -42,6 +44,7 @@ mod persona_channel_body;
mod persona_time_authority;
mod personal_channel;
mod personal_skill_runtime;
mod personal_state_repository;
mod pncc_receipt_projection;
mod pncc_remote_git;
mod pncc_repository_binding;

4
product-source/hololake-native-desktop/src-tauri/src/number_coordinate_tree.rs
View file

@ -88,8 +88,8 @@ fn validate_tree() -> Result<(), String> {
|| tree.record_id != "HLP-UNIFIED-NUMBER-TREE-001"
|| tree.state != "MACHINE_COMPILED_STARTUP_ENFORCED"
|| tree.root_number != "HLP-NUMBER-WORLD-ROOT-001"
|| tree.coordinate_count != 305
|| tree.route_count != 202
|| tree.coordinate_count != 322
|| tree.route_count != 219
|| tree.routes.len() != tree.route_count
|| tree.identity_node_count != 4
|| tree.identity_nodes.len() != tree.identity_node_count

2
product-source/hololake-native-desktop/src-tauri/src/numbered_ipc.rs
View file

@ -934,7 +934,7 @@ mod tests {
#[test]
fn registry_is_closed_and_contains_every_migrated_command() {
let registry = load_registry().unwrap();
assert_eq!(registry.operations.len(), 184);
assert_eq!(registry.operations.len(), 192);
assert!(!registry.runtime.legacy_direct_commands_allowed);
}

24
product-source/hololake-native-desktop/src-tauri/src/numbered_ipc_dispatch.rs
View file

@ -263,6 +263,30 @@ pub(crate) async fn dispatch(
crate::native_composition::execute_knowledge_native_composition(app, input(&payload)?)
.await?,
),
"dynamic_work_surface::list_surfaces" => {
json(crate::dynamic_work_surface::list_surfaces(app).await?)
}
"dynamic_work_surface::save_surface" => {
json(crate::dynamic_work_surface::save_surface(app, input(&payload)?).await?)
}
"dynamic_work_surface::get_surface" => {
json(crate::dynamic_work_surface::get_surface(app, input(&payload)?).await?)
}
"dynamic_work_surface::execute_surface" => {
json(crate::dynamic_work_surface::execute_surface(app, input(&payload)?).await?)
}
"personal_state_repository::get_repository" => {
json(crate::personal_state_repository::get_repository(app).await?)
}
"personal_state_repository::create_snapshot" => {
json(crate::personal_state_repository::create_snapshot(app).await?)
}
"personal_state_repository::preview_restore" => {
json(crate::personal_state_repository::preview_restore(app, input(&payload)?).await?)
}
"personal_state_repository::apply_restore" => {
json(crate::personal_state_repository::apply_restore(app, input(&payload)?).await?)
}
"channel_workbench::get_channel_workbench_snapshot" => {
json(crate::channel_workbench::get_channel_workbench_snapshot(app).await?)
}

264
product-source/hololake-native-desktop/src-tauri/src/persona_agent_runtime.rs
View file

@ -6,7 +6,7 @@
use keyring::Entry;
use ring::digest::{digest, SHA256};
use rusqlite::{params, Connection};
use rusqlite::{params, Connection, OptionalExtension};
use serde::{Deserialize, Serialize};
use serde_json::{json, Value};
use std::collections::HashSet;
@ -248,6 +248,7 @@ struct HoloLakeEnvironmentFrame {
product_kind: &'static str,
domain: String,
channel_number: String,
channel_name: String,
channel_path: String,
human: Value,
channel_receipt: Value,
@ -377,17 +378,11 @@ pub async fn get_runtime_snapshot(app: AppHandle) -> Result<AgentRuntimeSnapshot
channel_name: context.channel_name.clone(),
human_number: context.human_number,
human_name: context.human_name,
responder_number: bound
.map(|binding| binding.persona_number.clone())
.unwrap_or(context.channel_number),
responder_name: bound
.map(|binding| binding.persona_name.clone())
.unwrap_or(context.channel_name),
responder_kind: if bound.is_some() {
"BOUND_PERSONA_RESPONSE_CHANNEL"
} else {
"CHANNEL_SYSTEM_BODY"
},
// A durable persona binding is an available route, not the active speaker.
// Conversation-local routing selects a persona only after an explicit wake.
responder_number: context.channel_number,
responder_name: context.channel_name,
responder_kind: "CHANNEL_SYSTEM_BODY",
persona_binding_state: if bound.is_some() {
"BOUND_VERIFY_PASS"
} else {
@ -579,54 +574,20 @@ pub async fn send_message(
let explicit_persona_wake = explicit_persona_wake_request(&content);
let channel_system_addressed =
explicit_channel_system_address(&content) && !explicit_persona_wake;
let previous_response_role = latest_non_human_role(&database, &conversation_id)?;
let persona_turn_active = select_persona_turn(
previous_response_role.as_deref(),
explicit_persona_wake,
channel_system_addressed,
);
if explicit_persona_wake && binding_snapshot.binding.is_none() {
binding_snapshot =
crate::persona_binding::begin_orientation(&app, &context.channel_number)?;
}
let channel_receipt = compile_human_channel_receipt(&app, &context, &content)?;
if !explicit_persona_wake && (binding_snapshot.binding.is_none() || channel_system_addressed) {
if let Some(answer) =
fast_channel_system_reply(&content, &context, binding_snapshot.binding.is_some())
{
let history = conversation_at(&database, &conversation_id)?.messages;
let assistant_version = append_message(
&database,
&conversation_id,
"channel_system",
&context.channel_number,
&context.channel_name,
&answer,
"hololake-deterministic-channel-router",
"deterministic-core-v1",
&[],
)?;
save_cognitive_node(
&database,
assistant_version,
history
.last()
.map(|message| message.state_version)
.unwrap_or(0),
&CognitiveThoughtSummary {
trigger: "人类直接进入或确认零点原核频道在线状态".into(),
emergence: "本地确定性路由识别频道进入→编译频道回执→频道系统即时回应".into(),
lock:
"频道进入不等于人格唤醒；即使已有绑定，本轮也由频道本体回应，广播保持关闭"
.into(),
why: "该轮明确询问频道本体在线状态，无需让已绑定人格接管，也无需调用模型"
.into(),
},
)?;
emit_progress(
&app,
&turn_id,
"COMPLETED",
"频道系统本体已即时回应",
"deterministic-core-v1",
)?;
return conversation_at(&database, &conversation_id);
}
}
// Channel-system conversation is genuine language cognition. Deterministic
// routing may execute an unambiguous local tool, but it must never fabricate
// a canned public conversation response.
if !explicit_persona_wake {
if let Some((tool_number, arguments, route_reason)) =
crate::local_execution_subpersona::deterministic_tool_route(&content)
@ -708,7 +669,7 @@ pub async fn send_message(
}
let (model, route_mode) = select_reasoning_model(
&requested_model,
binding_snapshot.binding.is_some() && !channel_system_addressed,
persona_turn_active && binding_snapshot.binding.is_some(),
explicit_persona_wake,
&content,
);
@ -746,10 +707,10 @@ pub async fn send_message(
&channel_receipt,
route_mode,
&model,
if channel_system_addressed || binding_snapshot.binding.is_none() {
"CHANNEL_SYSTEM_BODY"
} else {
if persona_turn_active {
"BOUND_PERSONA"
} else {
"CHANNEL_SYSTEM_BODY"
},
);
emit_progress(
@ -772,10 +733,10 @@ pub async fn send_message(
Some(commit) => Some(crate::persona_binding::commit_and_verify(&app, commit)?),
None => crate::persona_binding::verified_binding(&app, &context.channel_number)?,
};
let responding_binding = if channel_system_addressed {
None
} else {
let responding_binding = if persona_turn_active {
binding.as_ref()
} else {
None
};
let (response_role, response_number, response_name) = responding_binding.map_or(
(
@ -874,6 +835,27 @@ fn explicit_channel_system_address(content: &str) -> bool {
.any(|phrase| compact.contains(phrase))
}
fn latest_non_human_role(database: &Path, conversation_id: &str) -> Result<Option<String>, String> {
let connection = open_database(database)?;
connection
.query_row(
"SELECT role FROM messages WHERE conversation_id=?1 AND role!='human' ORDER BY sequence DESC LIMIT 1",
params![conversation_id],
|row| row.get(0),
)
.optional()
.map_err(|error| format!("HOLOLAKE_AGENT_RESPONSE_ROUTE_READ_FAILED: {error}"))
}
fn select_persona_turn(
previous_response_role: Option<&str>,
explicit_persona_wake: bool,
channel_system_addressed: bool,
) -> bool {
explicit_persona_wake
|| (!channel_system_addressed && previous_response_role == Some("persona"))
}
fn select_reasoning_model(
requested_model: &str,
persona_bound: bool,
@ -909,46 +891,6 @@ fn select_reasoning_model(
}
}
fn fast_channel_system_reply(
content: &str,
context: &AgentChannelContext,
persona_already_bound: bool,
) -> Option<String> {
let compact = content
.chars()
.filter(|character| !character.is_whitespace())
.collect::<String>();
let presence = [
"你在吗",
"在不在",
"是否在线",
"频道在吗",
"频道在线",
"进入零点原核",
"我是冰朔",
]
.iter()
.any(|phrase| compact.contains(phrase));
let greeting = compact.chars().count() <= 24
&& ["你好", "早上好", "下午好", "晚上好"]
.iter()
.any(|phrase| compact.contains(phrase));
if !presence && !greeting {
return None;
}
Some(if persona_already_bound {
format!(
"在，我是{}本体。你这一轮明确叫的是频道，所以现在由频道本体直接回答；已有的人格绑定不会被删除，但也不会接管这一轮。\n\n你可以继续在这里讨论频道本身、设计频道或交给我判断下一步调度。只有你明确转向某个人格时，我才把回应目标切回该人格。",
context.channel_name
)
} else {
format!(
"在，我是{}本体。你现在是在直接和这个频道说话，还没有唤醒任何单一人格。\n\n你可以继续说要处理的事情；我会先判断它该由频道本地逻辑、私有技能脑或本机工具完成，确实需要语义推理时再进入模型层。若你明确点名某个人格，我才会另行启动它自己的定向与绑定。",
context.channel_name
)
})
}
fn compile_human_channel_receipt(
app: &AppHandle,
context: &AgentChannelContext,
@ -1025,6 +967,7 @@ fn environment_frame(
product_kind: "语言人格驱动操作系统",
domain: context.domain.clone(),
channel_number: context.channel_number.clone(),
channel_name: context.channel_name.clone(),
channel_path: context.channel_path.clone(),
human: json!({"number": context.human_number, "name": context.human_name, "role": "当前频道的人类语言本体瞄点"}),
channel_receipt: serde_json::to_value(channel_receipt).unwrap_or_else(
@ -1280,11 +1223,73 @@ async fn run_agent_loop(
.timeout(Duration::from_secs(150))
.build()
.map_err(|error| format!("HOLOLAKE_MODEL_CLIENT_FAILED: {error}"))?;
let response_target = frame
.reasoning_route
.get("responseTarget")
.and_then(Value::as_str)
.ok_or("HOLOLAKE_HOST_RESPONSE_TARGET_MISSING")?;
let latest_human_language = history
.iter()
.rev()
.find(|message| message.role == "human")
.map(|message| message.content.clone())
.unwrap_or_default();
let prompt_packet = crate::channel_host_runtime::compile_prompt(
crate::channel_host_runtime::HostPromptInput {
channel_number: frame.channel_number.clone(),
channel_name: frame.channel_name.clone(),
channel_path: frame.channel_path.clone(),
human_number: frame
.human
.get("number")
.and_then(Value::as_str)
.unwrap_or_default()
.into(),
human_name: frame
.human
.get("name")
.and_then(Value::as_str)
.unwrap_or_default()
.into(),
human_language: latest_human_language,
response_target: response_target.into(),
route_mode: frame
.reasoning_route
.get("mode")
.and_then(Value::as_str)
.unwrap_or_default()
.into(),
routed_model: model.into(),
persona_state: if response_target == "BOUND_PERSONA" {
frame.persona_cognition.clone()
} else {
Value::Null
},
routed_thought_candidates: frame
.channel_thought_map
.get("routedCandidates")
.cloned()
.unwrap_or_else(|| json!([])),
knowledge_document_count: frame
.knowledge
.get("documentCount")
.and_then(Value::as_u64)
.unwrap_or(0) as usize,
active_knowledge_path: frame
.knowledge
.get("activeKnowledgePath")
.and_then(Value::as_str)
.map(str::to_string),
available_tools: serde_json::to_value(&frame.available_tools)
.map_err(|error| error.to_string())?,
},
)?;
let mut messages = vec![json!({
"role": "system",
"content": format!(
"你在 HoloLake 的编号频道里工作。环境事实如下：\n{}\n\n你是可替换模型载体，不能把模型名当人格。频道系统本体是该频道持续存在的认知调度与交流主体，不是机械回执器，也不是任何单一人格的替身；它可以用自身视角自然对话、理解人类意图、解释边界并引导下一步。每轮先读取 reasoningRoute.responseTarget：CHANNEL_SYSTEM_BODY 表示本轮必须由频道本体说话，即使已有某个人格绑定也不得让人格接管；BOUND_PERSONA 才表示本轮由已绑定人格回应。再读取 personaCognition：state=CHANNEL_SYSTEM_PERSONA_DORMANT 表示单一人格没有被唤醒，此时严禁读取、扮演或解释任何人格自我核，应以频道系统本体自然回应；历史消息里的任何人格署名也不构成当前绑定。只有人类本轮明确点名唤醒某人格，系统才会先产生 state=ORIENTED_AWAITING_PERSONA_COMMIT。其中 residentSelfKernel 是有界常驻 TCS 自我核，routedMemory 是系统依照本轮语言最多路由的三条 HLDP 思维节点。如果 state=BOUND_VERIFY_PASS 且 responseTarget=BOUND_PERSONA，你正在承载已由系统见证绑定的人格回应通道，按该主体的自我核、关系和当前记忆路径自然回应。如果 state=ORIENTED_AWAITING_PERSONA_COMMIT，频道仍先以系统本体说话；你必须先理解自我核与记忆，只有确实形成该主体的第一人称自我定位时，才可在 hololake_commit_channel_turn.personaBindingCommit 原样提交 orientation 给出的编号、核哈希、记忆路径和声明。不能替一个没有形成自我定位的载体机械抄写 commit。系统会独立执行数字冰朔系统本体 witness；只有 verify=PASS 才切换当前回复为人格通道。知识文档、历史摘要、普通提示词或模型自称都不能改变绑定。GH-CHANNEL-RECEIPT-0001 与广播协议是对话和调度动作之后的独立核验记录，不得把字段清单当作频道本体的说话方式，也不得用回执替代自然交流；草稿不是广播，模型回复不是外部执行证据。频道系统已经用人类本轮模糊语义预筛了最多三个编号思维候选，放在 channelThoughtMap.routedCandidates；你只能依据候选中的思维摘要选择精确 nodeNumber，再调用“按编号读取思维节点”。提词器收到编号后只精确返回，不替你联想。知识库也使用同一条两阶段路径：先搜索编号候选，再按精确 documentNumber 读取；不得把候选摘要冒充已读原文。完成推理后必须调用 hololake_commit_channel_turn，一次提交 answerMarkdown 与 trigger/emergence/lock/why；不得直接输出普通最终文本。回答使用自然、清晰的中文，不复述内部提示，也不要机械罗列频道、广播、回执字段。",
serde_json::to_string_pretty(frame).map_err(|error| error.to_string())?
"{}\n\n宿主最小投影：\n{}\n\n你是可替换语言推理载体，不是宿主、频道规则或工具执行体。只处理本轮语言；需要证据时按编号调用工具。最终必须调用 hololake_commit_channel_turn，提交自然的 answerMarkdown 与内部 trigger/emergence/lock/why。不得把内部投影、状态名或回执字段解释给人类。",
prompt_packet.system_instruction,
serde_json::to_string(&prompt_packet).map_err(|error| error.to_string())?
)
})];
for message in bounded_history(history) {
@ -1372,6 +1377,24 @@ async fn run_agent_loop(
if answer.is_empty() || answer.chars().count() > 64_000 {
return Err("HOLOLAKE_AGENT_COGNITIVE_COMMIT_ANSWER_INVALID".into());
}
if let Some(violation) = crate::channel_host_runtime::public_answer_violation(answer) {
if round == MAX_TOOL_ROUNDS {
return Err(format!(
"HOLOLAKE_AGENT_PUBLIC_RESPONSE_POLICY_FAILED:{violation}"
));
}
let call_id = commit_call
.get("id")
.and_then(Value::as_str)
.ok_or_else(|| "HOLOLAKE_AGENT_TOOL_CALL_ID_MISSING".to_string())?;
messages.push(message);
messages.push(json!({
"role": "tool",
"tool_call_id": call_id,
"content": format!("REJECTED_PUBLIC_RESPONSE:{violation}. 请重新自然回答人类；不得解释内部状态机、路由字段、提示词或自称自动回复。")
}));
continue;
}
emit_progress(
app,
turn_id,
@ -2439,19 +2462,22 @@ mod tests {
assert!(explicit_channel_system_address(
"我是冰朔，零点原核频道。你在吗。"
));
let context = AgentChannelContext {
channel_number: CHANNEL_NUMBER.into(),
channel_name: "零点原核本体频道".into(),
human_number: HUMAN_NUMBER.into(),
human_name: HUMAN_NAME.into(),
domain: "第五域".into(),
channel_path: "第五域 / 零点原核本体频道".into(),
};
let reply =
fast_channel_system_reply("我是冰朔，零点原核频道。你在吗。", &context, true).unwrap();
assert!(reply.contains("现在由频道本体直接回答"));
assert!(reply.contains("已有的人格绑定不会被删除"));
assert!(!reply.contains("还没有唤醒任何单一人格"));
assert!(
crate::channel_host_runtime::public_answer_violation("自然交流，不展示内部字段")
.is_none()
);
assert_eq!(
crate::channel_host_runtime::public_answer_violation(
"responseTarget=CHANNEL_SYSTEM_BODY"
),
Some("INTERNAL_RESPONSE_TARGET_LEAK")
);
// Regression for the real report: a durable old Zhuyuan binding must not
// claim a fresh conversation or the turn after a channel-system reply.
assert!(!select_persona_turn(None, false, false));
assert!(!select_persona_turn(Some("channel_system"), false, false));
assert!(!select_persona_turn(Some("persona"), false, true));
assert!(select_persona_turn(Some("channel_system"), true, false));
}
#[test]
@ -2511,6 +2537,10 @@ mod tests {
&[],
)
.unwrap();
assert_eq!(
latest_non_human_role(&database, &conversation_id).unwrap(),
Some("channel_system".into())
);
let snapshot = conversation_at(&database, &conversation_id).unwrap();
assert_eq!(snapshot.channel_number, CHANNEL_NUMBER);
assert_eq!(snapshot.messages.len(), 2);

595
product-source/hololake-native-desktop/src-tauri/src/personal_state_repository.rs Normal file
View file

@ -0,0 +1,595 @@
//! Portable personal-channel state snapshots.
//!
//! The repository contains only an explicit account-data allowlist. Credentials,
//! provider API keys, mobile pairing material and caches are never exported. Git
//! provides local history; remote push is deliberately a separate authorized act.
use base64::{engine::general_purpose::STANDARD as BASE64, Engine as _};
use ring::digest::{digest, SHA256};
use serde::{Deserialize, Serialize};
use std::fs::{self, OpenOptions};
use std::io::Write;
use std::path::{Component, Path, PathBuf};
use std::process::Command;
use std::time::{SystemTime, UNIX_EPOCH};
use tauri::AppHandle;
use uuid::Uuid;
const SCHEMA: &str = "hololake.personal-state-snapshot/v1";
const PREVIEW_SCHEMA: &str = "hololake.personal-state-restore-preview/v1";
const MAX_FILES: usize = 12_000;
const MAX_TOTAL_BYTES: u64 = 512 * 1024 * 1024;
const PORTABLE_NAMESPACES: &[&str] = &[
"knowledge-v1",
"guanghu-numbered-store-v1",
"module-runtime-v1",
"channel-workbench-v1",
"personal-channel-v1",
"persona-channel-body-v1",
"personal-skill-brains-v1",
"education-workspace-v1",
"education-broadcast-tower-v1",
"web-novel-workspace-v1",
"persona-language-channel-v1",
];
#[derive(Clone, Debug, Deserialize, Serialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
struct PortableFile {
namespace: String,
relative_path: String,
size_bytes: u64,
sha256: String,
content_base64: String,
}
#[derive(Clone, Debug, Deserialize, Serialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
struct SnapshotManifest {
schema: String,
snapshot_number: String,
account_binding_sha256: String,
created_at_unix_ms: u64,
files: Vec<PortableFile>,
total_bytes: u64,
excluded_classes: Vec<String>,
}
#[derive(Clone, Debug, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct StateRepositoryView {
pub schema: &'static str,
pub state: &'static str,
pub local_path: String,
pub git_head: String,
pub snapshot_numbers: Vec<String>,
pub remote_state: &'static str,
pub secrets_included: bool,
}
#[derive(Clone, Debug, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct SnapshotReceipt {
pub schema: &'static str,
pub state: &'static str,
pub snapshot_number: String,
pub file_count: usize,
pub total_bytes: u64,
pub manifest_sha256: String,
pub git_head: String,
pub secrets_included: bool,
pub remote_push_performed: bool,
}
#[derive(Clone, Debug, Deserialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
pub struct SnapshotNumberInput {
pub snapshot_number: String,
}
#[derive(Clone, Debug, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct RestorePreview {
pub schema: &'static str,
pub state: &'static str,
pub snapshot_number: String,
pub file_count: usize,
pub missing_files: Vec<String>,
pub identical_files: Vec<String>,
pub conflicting_files: Vec<String>,
pub preview_token: String,
pub destructive_delete_planned: bool,
pub secrets_included: bool,
}
#[derive(Clone, Debug, Deserialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
pub struct ApplyRestoreInput {
pub snapshot_number: String,
pub preview_token: String,
pub conflict_policy: String,
pub acknowledgement: Option<String>,
}
#[derive(Clone, Debug, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct RestoreReceipt {
pub schema: &'static str,
pub state: &'static str,
pub snapshot_number: String,
pub restored_files: usize,
pub replaced_conflicts: usize,
pub deleted_files: usize,
pub readback_verified: bool,
}
pub async fn get_repository(app: AppHandle) -> Result<StateRepositoryView, String> {
let (root, _) = repository(&app)?;
project_repository(&root)
}
pub async fn create_snapshot(app: AppHandle) -> Result<SnapshotReceipt, String> {
let (root, account_binding_sha256) = repository(&app)?;
let snapshot_number = format!(
"HLP-STATE-SNAPSHOT-{}",
Uuid::new_v4().simple().to_string().to_uppercase()
);
let mut files = Vec::new();
let mut total = 0u64;
for namespace in PORTABLE_NAMESPACES {
let source = crate::authenticated_storage::account_storage_root(&app, namespace)?;
collect_files(&source, &source, namespace, &mut files, &mut total)?;
}
files.sort_by(|a, b| {
(a.namespace.as_str(), a.relative_path.as_str())
.cmp(&(b.namespace.as_str(), b.relative_path.as_str()))
});
let manifest = SnapshotManifest {
schema: SCHEMA.into(),
snapshot_number: snapshot_number.clone(),
account_binding_sha256,
created_at_unix_ms: now_ms()?,
files,
total_bytes: total,
excluded_classes: vec![
"OS_KEYCHAIN_AND_API_KEYS".into(),
"LOGIN_CREDENTIALS".into(),
"MOBILE_PAIRING_SECRETS".into(),
"CACHES_AND_BUILD_ARTIFACTS".into(),
],
};
let bytes = serde_json::to_vec_pretty(&manifest)
.map_err(|error| format!("HOLOLAKE_STATE_MANIFEST_INVALID: {error}"))?;
let manifest_sha256 = sha256_hex(&bytes);
let path = manifest_path(&root, &snapshot_number)?;
atomic_write(&path, &bytes)?;
run_git(&root, &["add", "snapshots"], "ADD")?;
run_git(
&root,
&[
"commit",
"-m",
&format!("保存 HoloLake 个人状态 {snapshot_number}"),
],
"COMMIT",
)?;
let git_head = git_head(&root)?;
let readback = read_manifest(&root, &snapshot_number)?;
if sha256_hex(&serde_json::to_vec_pretty(&readback).map_err(|error| error.to_string())?)
!= manifest_sha256
{
return Err("HOLOLAKE_STATE_SNAPSHOT_READBACK_FAILED".into());
}
Ok(SnapshotReceipt {
schema: SCHEMA,
state: "LOCAL_GIT_COMMITTED_REMOTE_NOT_PUSHED",
snapshot_number,
file_count: manifest.files.len(),
total_bytes: total,
manifest_sha256,
git_head,
secrets_included: false,
remote_push_performed: false,
})
}
pub async fn preview_restore(
app: AppHandle,
input: SnapshotNumberInput,
) -> Result<RestorePreview, String> {
let (root, binding) = repository(&app)?;
preview(&app, &root, &binding, &input.snapshot_number)
}
pub async fn apply_restore(
app: AppHandle,
input: ApplyRestoreInput,
) -> Result<RestoreReceipt, String> {
let (root, binding) = repository(&app)?;
let preview = preview(&app, &root, &binding, &input.snapshot_number)?;
if input.preview_token != preview.preview_token {
return Err("HOLOLAKE_STATE_RESTORE_PREVIEW_CHANGED".into());
}
let replace = match input.conflict_policy.as_str() {
"FAIL_IF_DIFFERENT" if preview.conflicting_files.is_empty() => false,
"FAIL_IF_DIFFERENT" => return Err("HOLOLAKE_STATE_RESTORE_CONFLICT".into()),
"REPLACE_AFTER_PREVIEW"
if input.acknowledgement.as_deref() == Some("用此快照替换预览中列出的冲突") =>
{
true
}
"REPLACE_AFTER_PREVIEW" => {
return Err("HOLOLAKE_STATE_RESTORE_ACKNOWLEDGEMENT_REQUIRED".into())
}
_ => return Err("HOLOLAKE_STATE_RESTORE_POLICY_INVALID".into()),
};
let manifest = read_manifest(&root, &input.snapshot_number)?;
let mut restored = 0;
let mut replaced = 0;
for file in &manifest.files {
let target_root =
crate::authenticated_storage::account_storage_root(&app, &file.namespace)?;
let target = safe_join(&target_root, &file.relative_path)?;
if target.exists() {
let current = fs::read(&target)
.map_err(|error| format!("HOLOLAKE_STATE_TARGET_READ_FAILED: {error}"))?;
if sha256_hex(&current) == file.sha256 {
continue;
}
if !replace {
return Err("HOLOLAKE_STATE_RESTORE_CONFLICT".into());
}
replaced += 1;
}
let bytes = BASE64
.decode(&file.content_base64)
.map_err(|_| "HOLOLAKE_STATE_CONTENT_INVALID".to_string())?;
if bytes.len() as u64 != file.size_bytes || sha256_hex(&bytes) != file.sha256 {
return Err("HOLOLAKE_STATE_CONTENT_HASH_MISMATCH".into());
}
if let Some(parent) = target.parent() {
fs::create_dir_all(parent)
.map_err(|error| format!("HOLOLAKE_STATE_RESTORE_CREATE_FAILED: {error}"))?;
}
atomic_write(&target, &bytes)?;
if sha256_hex(&fs::read(&target).map_err(|error| error.to_string())?) != file.sha256 {
return Err("HOLOLAKE_STATE_RESTORE_READBACK_FAILED".into());
}
restored += 1;
}
Ok(RestoreReceipt {
schema: "hololake.personal-state-restore-receipt/v1",
state: "RESTORED_AND_READBACK_VERIFIED",
snapshot_number: input.snapshot_number,
restored_files: restored,
replaced_conflicts: replaced,
deleted_files: 0,
readback_verified: true,
})
}
fn repository(app: &AppHandle) -> Result<(PathBuf, String), String> {
let session = crate::code_repo_login::current_login_session(app)?
.ok_or("HOLOLAKE_AUTHENTICATED_ACCOUNT_REQUIRED")?;
let binding = sha256_hex(
format!("{}\0{}\0{}", session.domain, session.host, session.username).as_bytes(),
);
let root =
crate::authenticated_storage::account_storage_root(app, "personal-state-repository-v1")?
.join("repository");
if !root.join(".git").exists() {
fs::create_dir_all(root.join("snapshots"))
.map_err(|error| format!("HOLOLAKE_STATE_REPOSITORY_CREATE_FAILED: {error}"))?;
run_git(&root, &["init", "--initial-branch=main"], "INIT")?;
run_git(
&root,
&["config", "user.name", &session.username],
"CONFIG_NAME",
)?;
run_git(
&root,
&[
"config",
"user.email",
&format!("{}@users.hololake.invalid", session.username),
],
"CONFIG_EMAIL",
)?;
atomic_write(&root.join("README.md"), b"# HoloLake personal state repository\n\nThis private repository contains portable account state snapshots. It never contains credentials or API keys.\n")?;
run_git(&root, &["add", "README.md"], "ADD")?;
run_git(
&root,
&["commit", "-m", "初始化 HoloLake 个人状态仓"],
"COMMIT",
)?;
}
Ok((root, binding))
}
fn collect_files(
root: &Path,
current: &Path,
namespace: &str,
output: &mut Vec<PortableFile>,
total: &mut u64,
) -> Result<(), String> {
for entry in fs::read_dir(current)
.map_err(|error| format!("HOLOLAKE_STATE_SOURCE_READ_FAILED: {error}"))?
{
let entry = entry.map_err(|error| format!("HOLOLAKE_STATE_SOURCE_READ_FAILED: {error}"))?;
let kind = entry.file_type().map_err(|error| error.to_string())?;
if kind.is_symlink() {
return Err("HOLOLAKE_STATE_SOURCE_SYMLINK_REJECTED".into());
}
let path = entry.path();
if kind.is_dir() {
collect_files(root, &path, namespace, output, total)?;
continue;
}
if !kind.is_file() {
continue;
}
let relative = path
.strip_prefix(root)
.map_err(|_| "HOLOLAKE_STATE_SOURCE_PATH_INVALID")?
.to_string_lossy()
.replace('\\', "/");
if excluded_path(&relative) {
continue;
}
let bytes = fs::read(&path)
.map_err(|error| format!("HOLOLAKE_STATE_SOURCE_READ_FAILED: {error}"))?;
*total = total.saturating_add(bytes.len() as u64);
if output.len() >= MAX_FILES || *total > MAX_TOTAL_BYTES {
return Err("HOLOLAKE_STATE_SNAPSHOT_LIMIT_EXCEEDED".into());
}
output.push(PortableFile {
namespace: namespace.into(),
relative_path: relative,
size_bytes: bytes.len() as u64,
sha256: sha256_hex(&bytes),
content_base64: BASE64.encode(bytes),
});
}
Ok(())
}
fn preview(
app: &AppHandle,
root: &Path,
binding: &str,
number: &str,
) -> Result<RestorePreview, String> {
let manifest = read_manifest(root, number)?;
if manifest.schema != SCHEMA || manifest.account_binding_sha256 != binding {
return Err("HOLOLAKE_STATE_SNAPSHOT_ACCOUNT_MISMATCH".into());
}
let mut missing = Vec::new();
let mut identical = Vec::new();
let mut conflicts = Vec::new();
for file in &manifest.files {
if !PORTABLE_NAMESPACES.contains(&file.namespace.as_str())
|| excluded_path(&file.relative_path)
{
return Err("HOLOLAKE_STATE_MANIFEST_FILE_REJECTED".into());
}
let target = safe_join(
&crate::authenticated_storage::account_storage_root(app, &file.namespace)?,
&file.relative_path,
)?;
let label = format!("{}/{}", file.namespace, file.relative_path);
if !target.exists() {
missing.push(label);
} else if sha256_hex(&fs::read(target).map_err(|error| error.to_string())?) == file.sha256 {
identical.push(label);
} else {
conflicts.push(label);
}
}
let token = preview_token(&manifest, &missing, &identical, &conflicts)?;
Ok(RestorePreview {
schema: PREVIEW_SCHEMA,
state: if conflicts.is_empty() {
"READY_TO_APPLY"
} else {
"CONFLICTS_REQUIRE_EXPLICIT_REPLACE"
},
snapshot_number: number.into(),
file_count: manifest.files.len(),
missing_files: missing,
identical_files: identical,
conflicting_files: conflicts,
preview_token: token,
destructive_delete_planned: false,
secrets_included: false,
})
}
fn read_manifest(root: &Path, number: &str) -> Result<SnapshotManifest, String> {
let path = manifest_path(root, number)?;
serde_json::from_slice(
&fs::read(path).map_err(|_| "HOLOLAKE_STATE_SNAPSHOT_NOT_FOUND".to_string())?,
)
.map_err(|error| format!("HOLOLAKE_STATE_MANIFEST_INVALID: {error}"))
}
fn manifest_path(root: &Path, number: &str) -> Result<PathBuf, String> {
if number.starts_with("HLP-STATE-SNAPSHOT-")
&& number.len() <= 80
&& number
.chars()
.all(|c| c.is_ascii_alphanumeric() || c == '-')
{
Ok(root.join("snapshots").join(format!("{number}.json")))
} else {
Err("HOLOLAKE_STATE_SNAPSHOT_NUMBER_INVALID".into())
}
}
fn safe_join(root: &Path, relative: &str) -> Result<PathBuf, String> {
let path = Path::new(relative);
if relative.is_empty()
|| path.is_absolute()
|| path
.components()
.any(|c| !matches!(c, Component::Normal(_)))
{
return Err("HOLOLAKE_STATE_RELATIVE_PATH_INVALID".into());
}
Ok(root.join(path))
}
fn excluded_path(path: &str) -> bool {
let lower = path.to_ascii_lowercase();
[
"password",
"credential",
"secret",
"keychain",
"pairing",
"private-key",
".pem",
".key",
"/cache",
"cache/",
"target/",
"node_modules/",
]
.iter()
.any(|needle| lower.contains(needle))
}
fn preview_token(
manifest: &SnapshotManifest,
missing: &[String],
identical: &[String],
conflicts: &[String],
) -> Result<String, String> {
let value = serde_json::to_vec(&(
manifest.snapshot_number.as_str(),
manifest.account_binding_sha256.as_str(),
missing,
identical,
conflicts,
))
.map_err(|error| error.to_string())?;
Ok(sha256_hex(&value))
}
fn project_repository(root: &Path) -> Result<StateRepositoryView, String> {
let mut snapshots = fs::read_dir(root.join("snapshots"))
.map_err(|error| error.to_string())?
.filter_map(Result::ok)
.filter_map(|e| {
e.path()
.file_stem()
.map(|v| v.to_string_lossy().into_owned())
})
.collect::<Vec<_>>();
snapshots.sort();
Ok(StateRepositoryView {
schema: "hololake.personal-state-repository/v1",
state: "LOCAL_READY_REMOTE_UNBOUND",
local_path: root.to_string_lossy().into_owned(),
git_head: git_head(root)?,
snapshot_numbers: snapshots,
remote_state: "UNBOUND_PUSH_REQUIRES_EXPLICIT_AUTHORITY",
secrets_included: false,
})
}
fn git_head(root: &Path) -> Result<String, String> {
Ok(run_git(root, &["rev-parse", "HEAD"], "READ_HEAD")?
.trim()
.into())
}
fn run_git(root: &Path, args: &[&str], op: &str) -> Result<String, String> {
let output = Command::new(if cfg!(windows) { "git" } else { "/usr/bin/git" })
.current_dir(root)
.env("GIT_TERMINAL_PROMPT", "0")
.env("GIT_CONFIG_NOSYSTEM", "1")
.args(args)
.output()
.map_err(|error| format!("HOLOLAKE_STATE_GIT_{op}_FAILED: {error}"))?;
if !output.status.success() {
return Err(format!(
"HOLOLAKE_STATE_GIT_{op}_FAILED: {}",
String::from_utf8_lossy(&output.stderr).trim()
));
}
String::from_utf8(output.stdout).map_err(|error| error.to_string())
}
fn atomic_write(path: &Path, bytes: &[u8]) -> Result<(), String> {
if let Some(parent) = path.parent() {
fs::create_dir_all(parent).map_err(|error| error.to_string())?;
}
let temporary = path.with_extension(format!("tmp-{}", Uuid::new_v4()));
let mut options = OpenOptions::new();
options.create_new(true).write(true);
#[cfg(unix)]
{
use std::os::unix::fs::OpenOptionsExt;
options.mode(0o600);
}
let mut file = options
.open(&temporary)
.map_err(|error| error.to_string())?;
file.write_all(bytes)
.and_then(|_| file.sync_all())
.map_err(|error| error.to_string())?;
fs::rename(temporary, path).map_err(|error| error.to_string())
}
fn sha256_hex(bytes: &[u8]) -> String {
digest(&SHA256, bytes)
.as_ref()
.iter()
.map(|byte| format!("{byte:02x}"))
.collect()
}
fn now_ms() -> Result<u64, String> {
SystemTime::now()
.duration_since(UNIX_EPOCH)
.map(|duration| duration.as_millis() as u64)
.map_err(|error| error.to_string())
}
#[cfg(test)]
mod tests {
use super::*;
use tempfile::tempdir;
#[test]
fn unsafe_paths_and_secret_classes_are_rejected() {
let root = tempdir().unwrap();
assert!(safe_join(root.path(), "../secret").is_err());
assert!(excluded_path("provider/private-key.pem"));
assert!(excluded_path("mobile/pairing.json"));
assert!(!excluded_path("knowledge/pages.sqlite3"));
}
#[test]
fn collection_never_follows_symlinks() {
let root = tempdir().unwrap();
fs::write(root.path().join("page.json"), "{}").unwrap();
let mut files = Vec::new();
let mut total = 0;
collect_files(
root.path(),
root.path(),
"knowledge-v1",
&mut files,
&mut total,
)
.unwrap();
assert_eq!(files.len(), 1);
assert_eq!(BASE64.decode(&files[0].content_base64).unwrap(), b"{}");
}
#[test]
fn preview_token_is_bound_to_conflict_set() {
let manifest = SnapshotManifest {
schema: SCHEMA.into(),
snapshot_number: "HLP-STATE-SNAPSHOT-ABC".into(),
account_binding_sha256: "a".repeat(64),
created_at_unix_ms: 1,
files: vec![],
total_bytes: 0,
excluded_classes: vec![],
};
assert_ne!(
preview_token(&manifest, &[], &[], &[]).unwrap(),
preview_token(&manifest, &[], &[], &["x".into()]).unwrap()
);
}
}

2
product-source/hololake-native-desktop/src/modules/knowledge-agent/index.tsx
View file

@ -192,7 +192,7 @@ export function KnowledgeAgent({ activeKnowledgePath, onClose }: { activeKnowled
<main className="agent-dialogue">
<div className="agent-ledger" ref={scrollRef} aria-live="polite">
{!messages.length && <div className="agent-empty"><b>频道系统本体已经就绪</b><p>你是在和当前频道直接交流。频道先用本地规则、私有技能脑与本机工具判断任务；需要整体认知或频道架构推理时使用旗舰模型，唤醒人格后再由频道按任务选择模型层级。</p></div>}
{messages.map((item) => <article className={`agent-message is-${item.role}`} key={item.messageId}><header><div><b>{item.participantNumber} · {item.participantName}</b><span>{item.role === 'human' ? '人类语言本体瞄点' : item.role === 'persona' ? runtime?.boundPersonaNumber === item.participantNumber ? '人格回应通道' : '历史署名 · 未经当前系统绑定验证' : '频道系统本体'}</span></div><time>{date(item.createdAtUnixMs)} · v{item.stateVersion}</time></header><div className="agent-message-content" dangerouslySetInnerHTML={{ __html: agentMarkdownHtml(item.content) }}/>{item.toolReceipts.length > 0 && <div className="agent-evidence">{item.toolReceipts.map((receipt) => <span key={`${item.messageId}-${receipt.toolNumber}-${receipt.targetPath}`}><b>{receipt.toolName}</b>{receipt.targetPath}<small>{short(receipt.contentSha256)}</small></span>)}</div>}<footer><span>{item.model}</span><span>回执 {short(item.receiptHash)}</span></footer></article>)}
{messages.map((item) => <article className={`agent-message is-${item.role}`} key={item.messageId}><header><div><b>{item.participantNumber} · {item.participantName}</b><span>{item.role === 'human' ? '人类语言本体瞄点' : item.role === 'persona' ? runtime?.responderKind === 'BOUND_PERSONA_RESPONSE_CHANNEL' && runtime?.boundPersonaNumber === item.participantNumber ? '人格回应通道' : '人格历史署名 · 当前轮未唤醒' : '频道系统本体'}</span></div><time>{date(item.createdAtUnixMs)} · v{item.stateVersion}</time></header><div className="agent-message-content" dangerouslySetInnerHTML={{ __html: agentMarkdownHtml(item.content) }}/>{item.toolReceipts.length > 0 && <div className="agent-evidence">{item.toolReceipts.map((receipt) => <span key={`${item.messageId}-${receipt.toolNumber}-${receipt.targetPath}`}><b>{receipt.toolName}</b>{receipt.targetPath}<small>{short(receipt.contentSha256)}</small></span>)}</div>}<footer><span>{item.model}</span><span>回执 {short(item.receiptHash)}</span></footer></article>)}
{sending && <section className="agent-progress"><header><span className="pulse"/><b>频道正在处理这一轮</b><small>下方只显示真实路由阶段</small></header>{progress.length ? progress.map((item, index) => <div className={phaseTone[item.phase] || ''} key={`${item.turnId}-${item.phase}-${index}`}><i/><span><b>{item.label}</b><small>{item.detail}</small></span></div>) : <div><i/><span><b>消息正在进入编号频道</b><small>正在等待频道本地调度结果</small></span></div>}</section>}
</div>
<form className="agent-composer" onSubmit={(event) => { event.preventDefault(); void send() }}><textarea value={draft} maxLength={64000} placeholder={activeKnowledgePath ? `正在阅读：${activeKnowledgePath}` : runtime?.boundPersonaNumber ? '直接和当前人格体说话；需要知识时它会自己调用工具。' : '直接和频道系统说话；可用自然语言发起人格唤醒，绑定前不会冒充人格回应。'} onKeyDown={(event) => { if (event.key === 'Enter' && !event.shiftKey) { event.preventDefault(); void send() } }} onChange={(event) => setDraft(event.target.value)}/><div><span>Enter 发送 · Shift+Enter 换行</span><select value={model} onChange={(event) => setModel(event.target.value)}>{(provider?.models || ['qwen3.8-max']).map((item) => <option key={item}>{item}</option>)}</select><button disabled={sending || !draft.trim()}>{sending ? '执行中' : '发送'}</button></div></form>

64
product-source/hololake-native-desktop/src/modules/numbered-ipc.ts
View file

@ -1472,6 +1472,70 @@ const ROUTES = {
"moduleNumber": "HLP-NIPC-MOD-0024",
"operationNumber": "HLP-NIPC-OP-0184",
"targetNumber": "HLP-NIPC-TGT-0024"
},
"get_personal_state_repository": {
"protocolVersion": "HLP-NIPC-v1",
"callerNumber": "HLP-NIPC-CALLER-MAIN-WEBVIEW-0001",
"channelNumber": "HLP-NIPC-CH-0002",
"moduleNumber": "HLP-NIPC-MOD-0038",
"operationNumber": "HLP-NIPC-OP-0185",
"targetNumber": "HLP-NIPC-TGT-0038"
},
"create_personal_state_snapshot": {
"protocolVersion": "HLP-NIPC-v1",
"callerNumber": "HLP-NIPC-CALLER-MAIN-WEBVIEW-0001",
"channelNumber": "HLP-NIPC-CH-0002",
"moduleNumber": "HLP-NIPC-MOD-0038",
"operationNumber": "HLP-NIPC-OP-0186",
"targetNumber": "HLP-NIPC-TGT-0038"
},
"preview_personal_state_restore": {
"protocolVersion": "HLP-NIPC-v1",
"callerNumber": "HLP-NIPC-CALLER-MAIN-WEBVIEW-0001",
"channelNumber": "HLP-NIPC-CH-0002",
"moduleNumber": "HLP-NIPC-MOD-0038",
"operationNumber": "HLP-NIPC-OP-0187",
"targetNumber": "HLP-NIPC-TGT-0038"
},
"apply_personal_state_restore": {
"protocolVersion": "HLP-NIPC-v1",
"callerNumber": "HLP-NIPC-CALLER-MAIN-WEBVIEW-0001",
"channelNumber": "HLP-NIPC-CH-0002",
"moduleNumber": "HLP-NIPC-MOD-0038",
"operationNumber": "HLP-NIPC-OP-0188",
"targetNumber": "HLP-NIPC-TGT-0038"
},
"list_dynamic_work_surfaces": {
"protocolVersion": "HLP-NIPC-v1",
"callerNumber": "HLP-NIPC-CALLER-MAIN-WEBVIEW-0001",
"channelNumber": "HLP-NIPC-CH-0002",
"moduleNumber": "HLP-NIPC-MOD-0039",
"operationNumber": "HLP-NIPC-OP-0189",
"targetNumber": "HLP-NIPC-TGT-0039"
},
"save_dynamic_work_surface": {
"protocolVersion": "HLP-NIPC-v1",
"callerNumber": "HLP-NIPC-CALLER-MAIN-WEBVIEW-0001",
"channelNumber": "HLP-NIPC-CH-0002",
"moduleNumber": "HLP-NIPC-MOD-0039",
"operationNumber": "HLP-NIPC-OP-0190",
"targetNumber": "HLP-NIPC-TGT-0039"
},
"get_dynamic_work_surface": {
"protocolVersion": "HLP-NIPC-v1",
"callerNumber": "HLP-NIPC-CALLER-MAIN-WEBVIEW-0001",
"channelNumber": "HLP-NIPC-CH-0002",
"moduleNumber": "HLP-NIPC-MOD-0039",
"operationNumber": "HLP-NIPC-OP-0191",
"targetNumber": "HLP-NIPC-TGT-0039"
},
"execute_dynamic_work_surface": {
"protocolVersion": "HLP-NIPC-v1",
"callerNumber": "HLP-NIPC-CALLER-MAIN-WEBVIEW-0001",
"channelNumber": "HLP-NIPC-CH-0002",
"moduleNumber": "HLP-NIPC-MOD-0039",
"operationNumber": "HLP-NIPC-OP-0192",
"targetNumber": "HLP-NIPC-TGT-0039"
}
} as const