arch(hololake): establish clean Tauri desktop line

product-source/hololake-platform/docs/adr/0178-tauri-canonical-shell-and-electron-capability-donor.md

@@ -0,0 +1,97 @@
+---
+type: ADR
+id: "0178"
+title: "A clean Tauri line is canonical; both existing desktop lines are bounded donors"
+status: accepted
+date: 2026-08-12
+corrects: "the un-published assumption that the existing Tauri tree should remain the product base"
+---
+
+## Context
+
+HoloLake currently has two physically different desktop implementations:
+
+- `product-source/hololake-platform`: an extensive Tauri v2/Rust/React line with
+  rich editing, Git, AI, architecture, persona and native-boundary work, but also
+  accumulated Tolaria lineage, engineering controls and competing surfaces;
+- `product-source/hololake-desktop` plus `product-source/guanghu-knowledge-base`:
+  an Electron/Node line whose live knowledge workspace has a clearer page tree,
+  calmer reading hierarchy and better progressive disclosure for humans.
+
+Live interface inspection corrected an earlier inference. The current Tauri
+line has more engine-level capabilities, but its knowledge experience is not
+better: type navigation, folder navigation, note lists, Git state, update state,
+AI tools and app controls compete on one dense screen. Electron does not make a
+knowledge base rich by itself, but this Electron implementation is the stronger
+human-facing knowledge reference.
+
+Using either accumulated tree as the new product base would preserve the wrong
+coupling. HoloLake needs a clean product boundary before it migrates parts.
+
+## Decision
+
+**HoloLake creates a new clean Tauri v2/Rust/React source at
+`product-source/hololake-native-desktop`. It is the only destination for new
+desktop product work. Both existing desktop lines become read-only audited
+donors and acceptance oracles.**
+
+The existing Tauri line is not renamed into the new product and receives no new
+product features. Its reusable contracts, Rust boundaries, tests and selected
+components must cross provenance, dependency, security, usability and
+regression gates before migration. The Electron line is likewise frozen; it is
+the primary knowledge-workspace UX reference and a donor for verified missing
+behaviors, not a second product.
+
+Tolaria, Outline and every other upstream are manually reviewed parts sources
+only. HoloLake does not subscribe to their product update streams or merge their
+releases automatically.
+
+## HoloLake-owned update route
+
+The new line starts with a HoloLake-owned release channel rather than an
+inherited updater:
+
+1. Upstream and Tolaria endpoints are absent from production configuration.
+2. The app may check only an HTTPS HoloLake release-broadcast endpoint.
+3. A broadcast presents version, human-readable changes, compatibility and
+   restart impact; download and install require an explicit human choice.
+4. Every update artifact must pass Tauri updater signature verification. The
+   public verification key is embedded in the app; the private key is never
+   bundled or committed.
+5. Platform trust is separate: macOS direct distribution requires Developer ID
+   signing and notarization; Windows distribution requires its platform code
+   signing policy.
+6. Installation stages the signed artifact, records a receipt, and activates on
+   an explicit restart. Silent forced installation is forbidden.
+7. A startup health receipt and recoverable rollback path are required before
+   the release is called accepted.
+
+This disables inherited automatic updating without disabling HoloLake's own
+opt-in automatic download/install capability.
+
+## Audit and migration order
+
+1. Freeze both donors and capture source, runnable behavior and data locations.
+2. Establish the clean source root, product identity and signed update trust
+   root without copying either donor's UI.
+3. Build a source-backed capability matrix: keep, redesign, replace, retire or
+   investigate. A dependency list or release note is not proof of usable UX.
+4. Specify the human surface from the current HoloLake architecture: world,
+   personal lake, knowledge/work, AGE partnership, confirmation and receipt.
+   Repository, model, server and update internals move behind progressive
+   evidence/detail surfaces instead of occupying primary navigation.
+5. Migrate vertical slices as contracts plus tests plus human-visible
+   acceptance. Nothing is copied wholesale.
+6. Archive an old implementation only after recoverable data migration and an
+   explicit cleanup receipt.
+
+## Consequences
+
+- There is one future desktop product line and two bounded donor lines.
+- Tauri remains the lightweight native shell, while Electron's stronger
+  knowledge information architecture becomes an explicit acceptance reference.
+- The existing Tauri feature density is treated as inventory, not as the new
+  screen map.
+- No installed application or user data is deleted by this decision.
+- A visual direction must be selected before the new human-facing UI is built;
+  the clean source must not inherit either old layout accidentally.

product-source/hololake-platform/docs/adr/README.md

@@ -228,3 +228,4 @@ proposed → active → superseded
 | [0175](0175-guanghu-os-master-and-on-demand-linux-subcontrol.md) | Guanghu OS master control with on-demand Linux subcontrol and rescue | accepted; supersedes ADR-0172 final topology while retaining its transition implementation |
 | [0176](0176-persona-native-code-channel-runtime-kernel.md) | Persona-native code channel runtime kernel | accepted |
 | [0177](0177-persona-remote-incremental-object-channel.md) | Persona remote incremental object channel | accepted |
+| [0178](0178-tauri-canonical-shell-and-electron-capability-donor.md) | Tauri is the canonical HoloLake shell; Electron is a bounded capability donor | accepted |