feat(ios): add native Git knowledge and device-only secrets

product-source/hololake-platform/docs/ABSTRACTIONS.md

@@ -1135,6 +1135,35 @@ server deployment.
 
 ## Updates & Feature Flags
 
+## Mobile HoloLake knowledge boundary
+
+### Native storage and identity
+
+- **`mobile_vault`** — Creates typed foundation and personal knowledge lakes
+  inside the application sandbox. It never calls a desktop folder picker.
+- **`device_secret_store`** — Stores account sessions and user model keys in a
+  non-synchronizing, this-device-only Apple Keychain item. Callers keep only an
+  opaque handle and never receive a persisted plaintext representation.
+- **`hololake_account`** — Owns email OTP, device-bound sessions, verified
+  repository snapshots, the server model catalog, and atomic Markdown write
+  receipts.
+
+### Knowledge Agent execution
+
+- **`.hololake-sync-policy.json`** — Marks a lake as repository-backed and
+  excludes `本地密钥/**`, internal HoloLake metadata, and Git internals.
+- **`sync_local_markdown_page`** — Sends only a bounded normal Markdown path,
+  complete content, and the exact current base commit. Success requires a new
+  40-character repository commit; otherwise the native tool rolls back its
+  local create or edit.
+- **server AI provider** — Sends bounded model messages and tool schemas through
+  the authenticated HoloLake proxy. The client executes allowlisted knowledge
+  tools locally and returns their exact receipts for the next model turn. The
+  server provider key never reaches the device.
+- **synchronized delete gate** — Refuses deletion until an atomic repository
+  delete receipt exists, preventing a local-only success from diverging from
+  the shared lake.
+
 ### Hooks
 - **`useUpdater(releaseChannel, automaticChecksEnabled)`** — Channel-aware updater state machine. When automatic checks are enabled, it checks the selected feed after startup; manual checks always remain available. It surfaces checking/available/downloading/ready states and delegates install work to Rust.
 - **`useFeatureFlag(flag)`** — Returns boolean for a named feature flag. Checks `localStorage` override (`ff_<name>`), then falls back to telemetry-backed evaluation. Type-safe via `FeatureFlagName` union.