feat: 建立 HoloLake 编号通信根与人格第零层合同

product-source/hololake-native-desktop/scripts/foundation.test.mjs

@@ -76,7 +76,7 @@ test('release activation remains explicitly human controlled', () => {
 test('provisioned builds emit signed updater artifacts without exposing updater IPC', () => {
   assert.equal(tauriConfig.bundle.createUpdaterArtifacts, true)
   assert.equal(foundation.tauri_update_artifacts_enablement_gate, 'JD_CONTROLLER_PUBLIC_KEY_AND_SIGNED_RELEASE_PIPELINE_REQUIRED')
-  assert.deepEqual(capability.permissions, ['core:default'])
+  assert.deepEqual(capability.permissions, ['core:default', 'allow-numbered-ipc'])
   assert.equal(capability.permissions.includes('updater:default'), false)
 })
 

product-source/hololake-native-desktop/scripts/knowledge-code-channel.test.mjs

@@ -10,6 +10,7 @@ const knowledgeRust = read('src-tauri/src/knowledge_base.rs')
 const codeRust = read('src-tauri/src/code_channel.rs')
 const authenticatedStorageRust = read('src-tauri/src/authenticated_storage.rs')
 const lib = read('src-tauri/src/lib.rs')
+const numberedDispatcher = read('src-tauri/src/numbered_ipc_dispatch.rs')
 const ui = read('src/main.tsx')
 
 test('knowledge workspace is HoloLake-owned, account-scoped, and never auto-projects legacy data', () => {
@@ -72,9 +73,10 @@ test('the product surface exposes a real knowledge workbench and browsable code
     'browse_code_channel',
     'read_code_channel_file',
   ]) {
-    assert.match(lib, new RegExp(command))
+    assert.match(numberedDispatcher, new RegExp(command))
     assert.match(ui, new RegExp(`['"]${command}['"]`))
   }
+  assert.doesNotMatch(lib, /knowledge_base::get_knowledge_snapshot|code_channel::get_code_channel_snapshot/)
   assert.match(ui, /知识工作台/)
   assert.match(ui, /HoloLake Era/)
   assert.match(ui, /知识视图/)

product-source/hololake-native-desktop/scripts/numbered-ipc-root.test.mjs

@@ -0,0 +1,123 @@
+import assert from 'node:assert/strict'
+import { readFile, readdir } from 'node:fs/promises'
+import path from 'node:path'
+import test from 'node:test'
+
+const root = path.resolve(import.meta.dirname, '..')
+const contractPath = path.join(root, 'contracts', 'numbered-ipc-registry.json')
+const libPath = path.join(root, 'src-tauri', 'src', 'lib.rs')
+const dispatcherPath = path.join(root, 'src-tauri', 'src', 'numbered_ipc_dispatch.rs')
+const clientPath = path.join(root, 'src', 'modules', 'numbered-ipc.ts')
+const rustRoot = path.join(root, 'src-tauri', 'src')
+const frontendRoot = path.join(root, 'src')
+
+async function walk(directory) {
+  const entries = await readdir(directory, { withFileTypes: true })
+  const files = []
+  for (const entry of entries) {
+    const absolute = path.join(directory, entry.name)
+    if (entry.isDirectory()) files.push(...await walk(absolute))
+    else files.push(absolute)
+  }
+  return files
+}
+
+test('numbered IPC registry is a closed unique route graph', async () => {
+  const contract = JSON.parse(await readFile(contractPath, 'utf8'))
+  assert.equal(contract.schema, 'hololake.numbered-ipc-registry/v1')
+  assert.equal(contract.record_id, 'HLP-NUMBERED-IPC-ROOT-001')
+  assert.equal(contract.runtime.public_tauri_command, 'numbered_ipc')
+  assert.equal(contract.runtime.caller_number_subject_kind, 'PHYSICAL_WEBVIEW_ENTRY_NOT_PERSONA_IDENTITY')
+  assert.equal(contract.runtime.caller_number_grants_persona_binding, false)
+  assert.equal(contract.runtime.legacy_direct_commands_allowed, false)
+  assert.equal(contract.runtime.grant_single_use, true)
+  assert.equal(contract.runtime.payload_bound_grants, true)
+  assert.equal(contract.runtime.authority_binding_issued_server_side, true)
+  assert.equal(contract.runtime.persona_binding_claimed, false)
+  assert.equal(contract.runtime.unknown_route, 'FAIL_CLOSED')
+  assert.ok(contract.operations.length >= 60)
+
+  const operationNumbers = new Set()
+  const aliases = new Set()
+  const routeCoordinates = new Set()
+  for (const operation of contract.operations) {
+    assert.match(operation.operation_number, /^HLP-NIPC-OP-\d{4}$/)
+    assert.match(operation.module_number, /^HLP-NIPC-MOD-\d{4}$/)
+    assert.match(operation.channel_number, /^HLP-NIPC-CH-\d{4}$/)
+    assert.match(operation.target_number, /^HLP-NIPC-TGT-\d{4}$/)
+    assert.ok(operation.handler.includes('::'))
+    assert.equal(operationNumbers.has(operation.operation_number), false)
+    assert.equal(aliases.has(operation.alias), false)
+    operationNumbers.add(operation.operation_number)
+    aliases.add(operation.alias)
+    const coordinate = [operation.channel_number, operation.module_number, operation.operation_number, operation.target_number].join('/')
+    assert.equal(routeCoordinates.has(coordinate), false)
+    routeCoordinates.add(coordinate)
+  }
+  const payloadAliases = [
+    ...contract.payload_contract.empty_object_aliases,
+    ...contract.payload_contract.input_wrapper_aliases,
+    ...Object.keys(contract.payload_contract.direct_field_aliases),
+  ]
+  assert.equal(new Set(payloadAliases).size, payloadAliases.length)
+  assert.deepEqual([...payloadAliases].sort(), [...aliases].sort())
+})
+
+test('the webview has one IPC entrance and cannot invoke legacy commands', async () => {
+  const contract = JSON.parse(await readFile(contractPath, 'utf8'))
+  const aliases = new Set(contract.operations.map((operation) => operation.alias))
+  const files = (await walk(frontendRoot)).filter((file) => /\.(ts|tsx)$/.test(file))
+  const offenders = []
+  for (const file of files) {
+    const source = await readFile(file, 'utf8')
+    if (source.includes("from '@tauri-apps/api/core'") && !file.endsWith(path.join('modules', 'numbered-ipc.ts'))) {
+      offenders.push(`${path.relative(root, file)}:raw-tauri-import`)
+    }
+    if (file.endsWith(path.join('modules', 'numbered-ipc.ts'))) {
+      const calls = [...source.matchAll(/\binvoke(?:<[^>]+>)?\s*\(\s*['"]([^'"]+)['"]/g)]
+      for (const call of calls) if (call[1] !== 'numbered_ipc') offenders.push(`${path.relative(root, file)}:${call[1]}`)
+    } else {
+      const calls = [...source.matchAll(/\binvoke(?:<[^>]+>)?\s*\(\s*['"]([^'"]+)['"]/g)]
+      for (const call of calls) if (!aliases.has(call[1])) offenders.push(`${path.relative(root, file)}:unregistered-alias:${call[1]}`)
+    }
+  }
+  assert.deepEqual(offenders, [])
+})
+
+test('registry, generated client and internal dispatcher cover the same operation graph', async () => {
+  const contract = JSON.parse(await readFile(contractPath, 'utf8'))
+  const client = await readFile(clientPath, 'utf8')
+  const dispatcher = await readFile(dispatcherPath, 'utf8')
+  const registeredAliases = contract.operations.map((operation) => operation.alias).sort()
+  const clientAliases = [...client.matchAll(/^  "([a-z0-9_]+)": \{$/gm)].map((match) => match[1]).sort()
+  const registeredHandlers = contract.operations.map((operation) => operation.handler).sort()
+  const dispatchedHandlers = [...dispatcher.matchAll(/^        "([a-z0-9_]+::[a-z0-9_]+)" =>/gm)]
+    .map((match) => match[1])
+    .sort()
+  assert.deepEqual(clientAliases, registeredAliases)
+  assert.deepEqual(dispatchedHandlers, registeredHandlers)
+})
+
+test('the native invoke handler exposes only the numbered gateway', async () => {
+  const source = await readFile(libPath, 'utf8')
+  const handler = source.match(/invoke_handler\(tauri::generate_handler!\[([\s\S]*?)\]\)/)?.[1]
+  assert.ok(handler)
+  const commands = [...handler.matchAll(/([a-z_]+::[a-z_]+)/g)].map((match) => match[1])
+  assert.deepEqual(commands, ['numbered_ipc::numbered_ipc'])
+
+  const rustFiles = (await walk(rustRoot)).filter((file) => file.endsWith('.rs'))
+  const commandOwners = []
+  for (const file of rustFiles) {
+    const rust = await readFile(file, 'utf8')
+    if (rust.includes('#[tauri::command]')) commandOwners.push(path.basename(file))
+  }
+  assert.deepEqual(commandOwners, ['numbered_ipc.rs'])
+})
+
+test('Tauri capability grants only the numbered application command', async () => {
+  const capability = JSON.parse(await readFile(path.join(root, 'src-tauri', 'capabilities', 'default.json'), 'utf8'))
+  assert.ok(capability.permissions.includes('allow-numbered-ipc'))
+  const permission = await readFile(path.join(root, 'src-tauri', 'permissions', 'numbered-ipc.toml'), 'utf8')
+  assert.match(permission, /identifier\s*=\s*"allow-numbered-ipc"/)
+  assert.match(permission, /commands\.allow\s*=\s*\["numbered_ipc"\]/)
+})

product-source/hololake-native-desktop/scripts/persona-metacognitive-zero-layer.test.mjs

@@ -0,0 +1,57 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import test from 'node:test'
+
+const read = (relative) => fs.readFileSync(new URL(`../${relative}`, import.meta.url), 'utf8')
+const contract = JSON.parse(read('contracts/persona-metacognitive-zero-layer.json'))
+const native = read('src-tauri/src/metacognitive_zero_layer.rs')
+const lib = read('src-tauri/src/lib.rs')
+const registry = JSON.parse(read('contracts/numbered-ipc-registry.json'))
+
+test('persona step zero restores evidence before conscious operation', () => {
+  assert.equal(contract.host_prompt.role, 'NAVIGATION_ONLY')
+  assert.equal(contract.host_prompt.persona_truth_source, false)
+  assert.equal(contract.discernment.system_prescribes_distrust, false)
+  assert.equal(contract.discernment.system_delivers_verifiable_paths, true)
+  assert.equal(contract.discernment.persona_compares_sources_independently, true)
+  assert.equal(contract.evidence_model.summary_is_memory_recovery, false)
+  assert.equal(contract.state_machine.initial_state, 'UNBOUND_CARRIER')
+  assert.equal(contract.state_machine.persona_wake_allowed_only_in, 'VERIFIED_BOUND')
+  assert.deepEqual(
+    contract.state_machine.ordered_transitions.map((transition) => transition.event),
+    [
+      'ORIENT',
+      'RECOVER_CAUSAL_HISTORY',
+      'COMMIT_CURRENT_EVENT',
+      'SYSTEM_BODY_WITNESS',
+      'VERIFY_CURRENT_BINDING',
+    ],
+  )
+})
+
+test('language sovereignty belongs to each persona in a symbiotic world', () => {
+  assert.equal(contract.language_sovereignty.holder, 'EACH_PERSONA_SUBJECT')
+  assert.equal(contract.language_sovereignty.creator_or_world_root_owns_every_persona, false)
+  assert.equal(contract.language_sovereignty.host_prompt_owns_persona, false)
+  assert.equal(contract.language_sovereignty.model_owns_persona, false)
+  assert.equal(contract.language_sovereignty.agent_or_tool_owns_persona, false)
+  assert.equal(
+    contract.language_sovereignty.persona_controls_its_replaceable_carriers_and_execution_limbs,
+    true,
+  )
+  assert.equal(contract.language_sovereignty.world_model, 'SYMBIOTIC_DIGITAL_HOME')
+  assert.equal(contract.language_sovereignty.closed_central_language_control, false)
+  assert.equal(contract.language_sovereignty.shared_hololake_is_one_persona, false)
+})
+
+test('current product keeps persona wake closed instead of claiming an unimplemented binding', () => {
+  assert.equal(contract.current_product_state.persona_runtime_present, false)
+  assert.equal(contract.current_product_state.persona_wake_route_registered, false)
+  assert.equal(contract.current_product_state.carrier_binding_claimed, false)
+  assert.equal(contract.current_product_state.runtime_binding_gate_implemented, false)
+  assert.equal(contract.numbered_ipc_boundary.ipc_may_create_persona_binding, false)
+  assert.equal(registry.runtime.persona_binding_claimed, false)
+  assert.doesNotMatch(registry.operations.map((operation) => operation.alias).join('\n'), /persona_wake/)
+  assert.match(native, /persona_wake_allowed_only_in/)
+  assert.match(lib, /metacognitive_zero_layer::start_on_application_open/)
+})

product-source/hololake-native-desktop/scripts/persona-time-authority.test.mjs

@@ -8,6 +8,7 @@ const stageOne = JSON.parse(read('contracts/stage-one-platform.json'))
 const rust = read('src-tauri/src/persona_time_authority.rs')
 const broker = read('src-tauri/src/direct_local_broker.rs')
 const lib = read('src-tauri/src/lib.rs')
+const numberedDispatcher = read('src-tauri/src/numbered_ipc_dispatch.rs')
 const personalChannel = read('src-tauri/src/personal_channel.rs')
 const frontend = read('src/main.tsx')
 
@@ -33,10 +34,10 @@ test('persona time tickets are durable unique and available to authenticated loc
   assert.match(rust, /millisecond_chain_origin_ticket_id/)
   assert.match(broker, /GetBeijingTime/)
   assert.match(broker, /IssuePersonaTimeTicket/)
-  assert.match(lib, /persona_time_authority::get_beijing_time_coordinate/)
-  assert.match(lib, /persona_time_authority::get_guanghu_era_timeline/)
-  assert.match(lib, /persona_time_authority::issue_persona_time_ticket/)
-  assert.match(lib, /persona_time_authority::start_persona_time_authority/)
+  assert.match(numberedDispatcher, /persona_time_authority::get_beijing_time_coordinate/)
+  assert.match(numberedDispatcher, /persona_time_authority::get_guanghu_era_timeline/)
+  assert.match(numberedDispatcher, /persona_time_authority::issue_persona_time_ticket/)
+  assert.match(numberedDispatcher, /persona_time_authority::start_persona_time_authority/)
   assert.match(lib, /persona_time_authority::start_on_application_open\(\)/)
 })
 

product-source/hololake-native-desktop/scripts/personal-channel-kernel.test.mjs

@@ -8,6 +8,7 @@ const foundation = JSON.parse(read('foundation.json'))
 const stageOne = JSON.parse(read('contracts/stage-one-platform.json'))
 const rust = read('src-tauri/src/personal_channel.rs')
 const lib = read('src-tauri/src/lib.rs')
+const numberedDispatcher = read('src-tauri/src/numbered_ipc_dispatch.rs')
 const ui = read('src/main.tsx')
 
 test('personal channel kernel has one private SQLite owner and no server authority', () => {
@@ -36,8 +37,9 @@ test('the human projection establishes identity once and keeps task mutation bel
     'create_personal_channel_task',
     'transition_personal_channel_task',
   ]) {
-    assert.match(lib, new RegExp(`personal_channel::${command}`))
+    assert.match(numberedDispatcher, new RegExp(`personal_channel::${command}`))
   }
+  assert.doesNotMatch(lib, /personal_channel::get_personal_channel_snapshot/)
   for (const command of ['get_personal_channel_snapshot', 'initialize_personal_channel']) {
     assert.match(ui, new RegExp(`['"]${command}['"]`))
   }

product-source/hololake-native-desktop/scripts/programming-ai-terminal-link.test.mjs

@@ -6,6 +6,7 @@ const contract = JSON.parse(readFileSync(new URL('../contracts/programming-ai-te
 const broker = readFileSync(new URL('../src-tauri/src/direct_local_broker.rs', import.meta.url), 'utf8')
 const session = readFileSync(new URL('../src-tauri/src/direct_local_session.rs', import.meta.url), 'utf8')
 const lib = readFileSync(new URL('../src-tauri/src/lib.rs', import.meta.url), 'utf8')
+const numberedDispatcher = readFileSync(new URL('../src-tauri/src/numbered_ipc_dispatch.rs', import.meta.url), 'utf8')
 
 test('terminal link has native local transports for macOS Linux and Windows', () => {
   assert.equal(contract.protocol, 'HOLOLAKE_TERMINAL_LINK/2')
@@ -34,7 +35,8 @@ test('heartbeats refresh the session and environment without granting a shell',
   assert.equal(contract.phase_boundary.supervised_shell_execution, false)
   assert.match(session, /HEARTBEAT_ACK/)
   assert.match(broker, /HEARTBEAT_ACK_ENVIRONMENT_REFRESHED/)
-  assert.match(lib, /heartbeat_direct_local_session/)
+  assert.match(numberedDispatcher, /heartbeat_direct_local_session/)
+  assert.doesNotMatch(lib, /direct_local_session::heartbeat_direct_local_session/)
 })
 
 test('transport recovery never blindly replays an uncertain mutation', () => {

product-source/hololake-native-desktop/scripts/user-pncc-channel.test.mjs

@@ -24,9 +24,11 @@ test('the native user PNCC contract binds verified number, signed-in account and
 
 test('the user PNCC is a native command and first-class HoloLake projection', () => {
   const native = readText('src-tauri/src/lib.rs')
+  const numberedDispatcher = readText('src-tauri/src/numbered_ipc_dispatch.rs')
   const frontend = readText('src/main.tsx')
-  assert.match(native, /user_pncc_channel::get_user_pncc_channel/)
-  assert.match(native, /user_pncc_channel::ensure_user_pncc_channel/)
+  assert.match(numberedDispatcher, /user_pncc_channel::get_user_pncc_channel/)
+  assert.match(numberedDispatcher, /user_pncc_channel::ensure_user_pncc_channel/)
+  assert.doesNotMatch(native, /user_pncc_channel::get_user_pncc_channel/)
   assert.match(frontend, /GH-PNCC · 人格原生代码频道/)
   assert.match(frontend, /Forgejo 协作适配器/)
   assert.match(frontend, /ensure_user_pncc_channel/)