bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

fix: require native persona authorization verification

Browse source
This commit is contained in:
冰朔 2026-08-12 06:10:49 +08:00
commit 584f38b478
13 changed files with 195 additions and 173 deletions
Download patch file Download diff file Expand all files Collapse all files

20
product-source/hololake-platform/docs/ARCHITECTURE.md
View file

@ -178,22 +178,22 @@ configured provider metadata. It has no native persona-control authorization rec
callback, and hides the reality confirmation surface because no durable confirmation consumer is wired. This
proves source integration, not a real persona manifest binding, installed desktop runtime, or acceptance.
`src/lib/personaControlAuthorization.ts` removes the desktop coordinator's caller-supplied authorization boolean.
It validates the structure and exact bindings of a current receipt that claims `GUANGHU_OS` verification: persona,
human responsibility subject, repository head, model instance, request and language anchor must all agree. This
renderer validation does not prove the issuer or verify a signature. A native loader must first verify signed
provenance against a registered Guanghu OS trust source; neither that trust source nor the loader exists in the
current desktop source. Missing, stale, mismatched or merely local evidence therefore remains system-direct.
`src/lib/personaControlAuthorization.ts` removes the desktop coordinator's caller-supplied authorization boolean
and no longer treats renderer-side receipt shape checks as authority. The language controller sends a candidate
receipt plus exact persona, human responsibility subject, repository head, model instance, request, language anchor,
and observation time to the native verifier. Only its strict successful projection can enable persona-primary
planning; a missing candidate, verifier error, denial, extra field, or merely local signed-looking object remains
system-direct.
`product-source/guanghu-knowledge-base/server/persona-control-authorization.ts` now supplies the independent
cryptographic source contract: v2 signed receipt fields, deterministic signing bytes, an exact-commit REPO-012
signer-registry source, persona/human/scope-limited Ed25519 signers, revocation, time and request binding, and
signature verification. The current REPO-012 main does not publish that registry path, so no signer is trusted and
the Tauri desktop now exposes a native read-only loader for the exact REPO-012 commit-bound registry. It accepts
signature verification. The current REPO-012 main publishes that registry path with zero signers, so no signer is
trusted and the Tauri desktop exposes a native read-only loader for the exact REPO-012 commit-bound registry. It accepts
the current empty registry and keeps authorization disabled. The native verifier now implements strict v2 receipt
parsing, canonical signing bytes, Ed25519 SPKI verification, signer scope/revocation checks, exact request bindings,
and validity windows. It is not wired into the language controller, and the authoritative registry still has zero
signers, so tested loader/verifier source is not runtime authority, deployment, or desktop acceptance.
and validity windows. Its verification projection is now wired into the language controller, but the authoritative
registry still has zero signers, so tested source wiring is not runtime authority, deployment, or desktop acceptance.
Tolaria is a personal knowledge and life management desktop app. It reads a vault of markdown files with YAML frontmatter and presents them in a four-panel UI inspired by Bear Notes.