bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

docs: require signed persona authorization provenance

Browse source
This commit is contained in:
冰朔 2026-08-12 04:54:54 +08:00
commit a118300791
9 changed files with 31 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

8
product-source/hololake-platform/docs/ABSTRACTIONS.md
View file

@ -22,9 +22,11 @@ still gated by a unique manifest-valid persona repository, the manifest-pinned c
device identity; it has no installed-desktop or live-product acceptance claim.
The source coordinator no longer accepts an unverified persona-authorization boolean from the desktop caller.
`hasPersonaPrimaryControlAuthorization` requires one current `GUANGHU_OS` receipt bound to the exact persona,
human responsibility subject, repository head, model instance, request, and language anchor. Until a native
loader provides that evidence, planning remains in system-direct mode.
`hasPersonaPrimaryControlAuthorization` validates the shape, exact bindings, digest format, and validity window
of a receipt that claims `GUANGHU_OS` verification. That renderer-side validation is not cryptographic provenance
and cannot turn a local JSON object into authority. A native loader may be connected only after it verifies a
signed receipt against a registered Guanghu OS trust source and returns the already-verified projection. No such
trust source or loader is currently registered, so planning remains in system-direct mode.
`compilePersonaLanguageGoalBinding` builds the exact native wake envelope only after a single clean persona
repository, its B0 and organ contracts, a registered local device identity, and the manifest-pinned model all