bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat: verify signed persona control receipts natively

Browse source
This commit is contained in:
冰朔 2026-08-12 05:50:53 +08:00
commit 75b6262c91
11 changed files with 562 additions and 98 deletions
Download patch file Download diff file Expand all files Collapse all files

4
product-source/hololake-platform/docs/ABSTRACTIONS.md
View file

@ -27,8 +27,8 @@ of a receipt that claims `GUANGHU_OS` verification. That renderer-side validatio
and cannot turn a local JSON object into authority. A native loader may be connected only after it verifies a
signed receipt against a registered Guanghu OS trust source and returns the already-verified projection. REPO-012
now publishes the exact registry source with zero signers, and the Tauri command loads only that exact commit-bound
empty state. It keeps authorization disabled and rejects any signer until native cryptographic verification exists,
so planning remains in system-direct mode. The independent server
empty state. The native verifier now validates the complete signed v2 contract, but no verified projection is wired
into the language controller and the authoritative registry has zero signers, so planning remains in system-direct mode. The independent server
contract in `product-source/guanghu-knowledge-base/server/persona-control-authorization.ts` defines the v2 signed
receipt, exact REPO-012 signer-registry source, canonical signing bytes, signer scope checks, revocation handling,
and Ed25519 verification. Its tested code does not appoint a signer or enable the desktop persona-primary path.

7
product-source/hololake-platform/docs/ARCHITECTURE.md
View file

@ -190,9 +190,10 @@ cryptographic source contract: v2 signed receipt fields, deterministic signing b
signer-registry source, persona/human/scope-limited Ed25519 signers, revocation, time and request binding, and
signature verification. The current REPO-012 main does not publish that registry path, so no signer is trusted and
the Tauri desktop now exposes a native read-only loader for the exact REPO-012 commit-bound registry. It accepts
the current empty registry only and keeps authorization disabled; any signer fails closed until the native
cryptographic receipt verifier and an authoritative signer/key-custody process exist. Tested loader and verifier
source are not runtime authority, deployment, or desktop acceptance.
the current empty registry and keeps authorization disabled. The native verifier now implements strict v2 receipt
parsing, canonical signing bytes, Ed25519 SPKI verification, signer scope/revocation checks, exact request bindings,
and validity windows. It is not wired into the language controller, and the authoritative registry still has zero
signers, so tested loader/verifier source is not runtime authority, deployment, or desktop acceptance.
Tolaria is a personal knowledge and life management desktop app. It reads a vault of markdown files with YAML frontmatter and presents them in a four-panel UI inspired by Bear Notes.