feat: embed cross-platform HoloLake terminal link
This commit is contained in:
parent
0be5ab3407
commit
ae7f883891
16 changed files with 808 additions and 122 deletions
|
|
@ -42,9 +42,9 @@ The visible shell is HoloLake itself. Git is the durable history engine below it
|
|||
|
||||
## External programming AI entry
|
||||
|
||||
MCP may discover HoloLake, but it does not own continuity. The installed application starts a user-only Unix socket broker. A programming AI opens or resumes a HoloLake-issued local session, then uses the installed executable's `--connector` mode for newline-delimited protocol traffic. Session secrets are stored only as hashes. Events use exact cursors and idempotency keys.
|
||||
MCP may discover HoloLake, but it does not own continuity. The installed application starts a same-account local broker: a mode-0600 Unix socket on macOS and Linux, or an owner/System-only Named Pipe on Windows. A programming AI opens or resumes a HoloLake-issued local session, then uses the installed executable's `--connector` mode for newline-delimited protocol traffic. Session secrets are stored only as hashes. Events use exact cursors and idempotency keys. The connector reloads the application descriptor after transport loss and never blindly replays an operation whose response is uncertain.
|
||||
|
||||
An authenticated non-visitor connector may now acquire, inspect and explicitly release the existing account-scoped development write lane through that broker. Account, lane and client instance must match the HoloLake session before the bridge mutates. HoloLake projects the same Rust-owned lane state on the system-details page, so a human can distinguish a nearby expression-only visitor from an active development writer. This is a controlled writer handoff, not a general programming tool loop: shell, file patching, build execution, publication and deployment still require later supervised execution organs and separate authorization receipts.
|
||||
An authenticated non-visitor connector may now acquire, inspect and explicitly release the existing account-scoped development write lane through that broker. Account, lane and client instance must match the HoloLake session before the bridge mutates. Opening, resuming, acquiring and every authenticated heartbeat return or require a bounded HoloLake work-environment frame. That frame states the HoloLake runtime owner, session cursor, writer match, native GLS runtime, expiry and digest; the external model does not restore protocol prose from chat context. HoloLake projects the same Rust-owned lane state on the system-details page, so a human can distinguish a nearby expression-only visitor from an active development writer. This is a controlled writer handoff, not a general programming tool loop: shell, file patching, build execution, publication and deployment still require later supervised execution organs and separate authorization receipts.
|
||||
|
||||
The zero-core protocol layer now compiles the numbered GLS sources pinned to the current REPO-012 commit into a deterministic native registry. The registry inventories every unique numbered source with its path and SHA-256, but only protocols with an explicit typed adapter, event set and dependency-closed projection may execute. Raw protocol prose and arbitrary code carried by a protocol are never executed. The first native enforcement adapter binds GLS-0253 identity and numbering rules to the human-number route, with GLS-0250, GLS-0262 and GLS-0263 as executable dependencies. Unknown namespaces, persona numbers presented as human numbers, missing adapters and unprojected protocols fail closed. The system page reports compiled, executable and not-yet-executable protocol counts without presenting inventory as enforcement.
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,39 @@
|
|||
# ADR 0007: Cross-platform programming-AI terminal link
|
||||
|
||||
- Status: implemented in source; installed acceptance remains per platform
|
||||
- Date: 2026-08-17
|
||||
|
||||
## Context
|
||||
|
||||
An external programming AI must remain attached to a HoloLake-owned work environment without making MCP stability, one chat window, or model protocol recall the continuity root. The product is not macOS-only: Windows and Linux must enforce the same session and write semantics even though their local IPC primitives differ.
|
||||
|
||||
## Decision
|
||||
|
||||
Embed `HOLOLAKE_TERMINAL_LINK/2` in the native HoloLake executable. macOS and Linux use a mode-0600 Unix socket inside a mode-0700 runtime directory. Windows uses a local Named Pipe with a protected DACL granting full access only to Local System and the creating object owner. All platforms additionally require HoloLake session authentication.
|
||||
|
||||
The installed executable exposes `--connector` as sequential newline-delimited JSON. It reloads the broker descriptor after transport loss. If an operation may have reached HoloLake but its response was lost, the connector reports an uncertain response and does not blindly replay it.
|
||||
|
||||
Opening or resuming a session establishes continuity in HoloLake. The authenticated client then acquires the account's single development writer and obtains a short-lived work-environment frame. Heartbeats refresh both durable session observation and that frame. The frame contains the HoloLake runtime owner, session and event cursor, writer match, compiled GLS runtime identity, expiry and digest. It explicitly says that model-side protocol restoration is not required.
|
||||
|
||||
## Boundary
|
||||
|
||||
This decision completes the first-stage control plane, not the second-stage Agent executor. It does not grant a supervised shell, arbitrary file mutation, build, publication, deployment, persona binding or reality-execution authority. Those require separate typed operations, approvals and receipts.
|
||||
|
||||
Cross-compilation of the isolated Linux Unix-socket and Windows Named-Pipe adapters is evidence for source portability only. It is not installed-runtime acceptance. A full Windows desktop build remains unobserved on this macOS builder because the Windows SDK and linker are unavailable; Linux and Windows installed readback must occur on their real targets.
|
||||
|
||||
## Rejected alternatives
|
||||
|
||||
- TCP loopback as the common denominator: it broadens the local attack surface and weakens the operating-system account boundary.
|
||||
- A macOS implementation with Windows and Linux documentation only: transport portability without compiled adapters is not an implementation.
|
||||
- Replaying a request automatically after a broken response: a mutation could execute twice.
|
||||
- Asking every newly started model to reread all GLS prose: protocols are HoloLake runtime code, not model memory.
|
||||
- Calling the control plane an Agent shell: the supervised execution organ is the next phase.
|
||||
|
||||
## Evidence
|
||||
|
||||
- `src-tauri/src/direct_local_broker.rs`
|
||||
- `src-tauri/src/direct_local_session.rs`
|
||||
- `src-tauri/src/local_development_bridge.rs`
|
||||
- `src/main.tsx`
|
||||
- `contracts/programming-ai-terminal-link.json`
|
||||
- `scripts/programming-ai-terminal-link.test.mjs`
|
||||
Loading…
Reference in a new issue