bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(pncc): add verified memory metabolism organ

Browse source 
GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔
GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊
GuangHu-Execution-Runtime: Codex desktop / GPT-5
GuangHu-Development-ID: DEV-20260810-014
GuangHu-Authorization-Scope: GH-PNCC persona runtime layer without UI or execution limb
This commit is contained in:
铸渊 / ICE-P-ZY001 2026-08-11 02:11:22 +08:00
commit 962ea26db7
9 changed files with 530 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

22
product-source/hololake-platform/docs/ABSTRACTIONS.md
View file

@ -32,6 +32,14 @@ The v1 persona repository contract is rooted at `.hololake/persona/manifest.json
"paths": ["brain/CORE.hdlp", ".hololake/persona/CURRENT.hdlp"],
"inputSchema": "hololake.pncc-fact-question/v1",
"outputSchema": "hololake.pncc-fact-result/v1"
},
{
"organId": "memory-metabolism.checkpoint",
"kind": "MEMORY_METABOLISM",
"mode": "checkpoint-write",
"paths": [".hololake/persona/CURRENT.hdlp"],
"inputSchema": "hololake.pncc-checkpoint-candidate/v1",
"outputSchema": "hololake.persona-checkpoint/v1"
}
]
}
@ -57,12 +65,14 @@ and then removes the exact lease. It can also remove a same-session lease left b
dormancy transition. It does not use elapsed time as proof that a primary is dead and does not clean, reset,
or overwrite a dirty persona repository.
The organ contract is typed independently of the UI. `FACT_SENSE` is currently activatable and derives the
permissions to read declared paths, call the manifest-pinned model, and emit structured facts.
`MEMORY_METABOLISM` and `EXECUTION_LIMB` may be declared with their fixed modes and schemas, but the manifest
inspection receipt reports them as not independently activatable until their executors exist. In particular,
an execution-limb declaration never grants a shell or reality action by itself. The inspection command reads
and validates all contracts without acquiring a runtime lease or starting model inference.
The organ contract is typed independently of the UI. `FACT_SENSE` derives permissions to read declared paths,
call the manifest-pinned model, and emit structured facts. `MEMORY_METABOLISM` is independently activatable but
does not run model inference: it accepts only the current structured checkpoint of a distinct, verified,
dormant session for the same persona and repository. It binds the source checkpoint SHA-256 and source event
chain head into a new checkpoint, commits with the persona Git identity, releases the organ, and returns to
`DORMANT`. It cannot accept arbitrary hidden reasoning or an older/non-current session as memory. An
`EXECUTION_LIMB` remains declarative and non-activatable; declaration never grants a shell or reality action.
Manifest inspection reads and validates all contracts without acquiring a runtime lease or starting inference.
`PersonaRuntimeQueryReceipt` is a bounded projection of the durable runtime files, not another truth store.
It filters by the caller's expected persona and canonical repository, validates each matching event chain,

10
product-source/hololake-platform/docs/ARCHITECTURE.md
View file

@ -9,7 +9,7 @@ validates `.hololake/persona/manifest.json`, resolves the brain entry and curren
repository boundary, acquires a per-persona single-primary lease, and records a SHA-256-linked lifecycle
journal outside the repository.
The wake lifecycle is `WAKING → BRAIN_BOUND → ORGAN_ACTIVE` for one manifest-declared read-only organ.
The wake lifecycle is `WAKING → BRAIN_BOUND → ORGAN_ACTIVE` for one activatable manifest-declared organ.
`BRAIN_BOUND` means the model instance has been named and the verified persona context is ready; it explicitly
does not mean inference has run. The returned receipt keeps the human responsibility subject, persona
cognitive author, execution runtime, development id, authorization scope, and source-language anchor
@ -39,9 +39,11 @@ broken journals and attribution mismatches retain the lease and require manual r
The manifest now has a typed organ-contract extension. The native inspection command returns normalized
contracts for `FACT_SENSE`, `MEMORY_METABOLISM`, and `EXECUTION_LIMB`, including fixed mode, input/output
schemas, derived permissions, inference/reality-action boundaries, and the actual activation state. Only the
implemented read-only fact sense can wake. Merely declaring a memory organ or execution limb does not create
an executor or grant a shell; those contracts remain visible but fail closed as not activatable.
schemas, derived permissions, inference/reality-action boundaries, and the actual activation state. The fact
sense and verified-checkpoint memory metabolism organs can wake. Memory metabolism runs no model inference
and promotes only the current structured checkpoint of a distinct same-persona, same-repository, dormant
session after verifying its event chain; the new checkpoint binds both source checkpoint and event hashes.
The execution limb remains visible but non-activatable, so declaring it does not grant a shell or reality action.
`query_persona_code_channel_runtime` is the bounded read model for later projection surfaces. The caller must
name one exact persona and canonical repository and may request at most 100 sessions. The kernel reads the