feat: embed complete GLS protocol kernel in HoloLake
This commit is contained in:
parent
ca5d6f3f58
commit
b8d08fb620
15 changed files with 3515 additions and 485 deletions
|
|
@ -48,6 +48,14 @@ An authenticated non-visitor connector may now acquire, inspect and explicitly r
|
|||
|
||||
The zero-core protocol layer now compiles the numbered GLS sources pinned to the current REPO-012 commit into a deterministic native registry. The registry inventories every unique numbered source with its path and SHA-256, but only protocols with an explicit typed adapter, event set and dependency-closed projection may execute. Raw protocol prose and arbitrary code carried by a protocol are never executed. The first native enforcement adapter binds GLS-0253 identity and numbering rules to the human-number route, with GLS-0250, GLS-0262 and GLS-0263 as executable dependencies. Unknown namespaces, persona numbers presented as human numbers, missing adapters and unprojected protocols fail closed. The system page reports compiled, executable and not-yet-executable protocol counts without presenting inventory as enforcement.
|
||||
|
||||
## Product-embedded GLS protocol kernel
|
||||
|
||||
GLS enforcement is part of the HoloLake executable, not a sidecar process on the development computer. Rust embeds the pinned runtime manifest and kernel contract in the application binary. Application startup validates the full executable dependency graph, P1-P6 contract set, deterministic HLDP-NP → GIR compiler self-check and the per-user receipt ledger; a failure prevents normal product startup.
|
||||
|
||||
The unified decision API returns only `ALLOW`, `DENY`, `AMBIGUOUS` or `UNVERIFIED` with stable reason codes. Every result, including malformed input and refusal, appends an idempotent SHA-256-linked receipt. The same immediate SQLite transaction also advances the durable protocol state for work orders, time leases, immutable modules, persona lifecycle, isolated runways and broadcast control epochs. Stale transitions, concurrent double-primary claims, cross-owner runway release and immutable digest replacement fail closed; concurrent memory/state versions are retained in a conflict set instead of last-write-wins. Identity never implies permission, stale heartbeats and leases become unknown, work-order proposers cannot self-approve, models remain replaceable inference resources, and temporary capabilities cannot auto-install, publish or deploy.
|
||||
|
||||
The P7 native-OS assembly registry is also embedded, but it is not a physical-capability simulator. It records the exact target and source-evidence node for GLS-0836 and GLS-0840–0849. No BS-SH-005 or JD-FD-PRIMARY evidence is relabeled as desktop health; without target-side evidence the assembly stays unverified.
|
||||
|
||||
## Circular-lake protocol membrane and nearby AI
|
||||
|
||||
HoloLake 0.4.0 places a deterministic protocol membrane in front of the local language inbox. The membrane accepts only strict GLP/1.0 expression envelopes from a HoloLake-issued visitor session. Unknown fields, malformed identifiers, incorrect checksums, oversized content, attachments and command content are rejected before storage. Accepted natural language is an expression receipt only; it never carries execution authority by itself. Intent interpretation remains behind the membrane and cannot weaken its structural admission rules.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# GLS 原生协议运行层实施规划
|
||||
|
||||
状态：`EVIDENCE_BACKED_IMPLEMENTATION_BASELINE`
|
||||
状态：`P0_TO_P7_DESKTOP_PRODUCT_KERNEL_IMPLEMENTED · INSTALLED_RUNTIME_ACCEPTANCE_PENDING`
|
||||
|
||||
核验时间：2026-08-17（Asia/Shanghai）
|
||||
|
||||
|
|
@ -219,6 +219,10 @@ protocol_decision_receipt:
|
|||
|
||||
`d6b1290` 完成了 75 份编号协议的确定性发现登记，并为 `GLS-0250 / 0253 / 0262 / 0263` 建立首批原生适配器。P0 随后已把运行清单升级为 v2：四份登记源分别固化摘要，75 份协议全部取得登记解释，旧依赖与显式运行依赖分离，三组旧环只进入审计面而不能进入执行图。
|
||||
|
||||
下一步是实现 P1 的 GLP schema、统一裁决 API 和持久回执，再按 P2–P7 逐层扩大运行集合。旧依赖边只有经权威修订为明确的类型边后才可离开审计面。
|
||||
P1–P6 已按顺序实现为 HoloLake Rust 原生器官：统一裁决 API 对消息、身份、上下文、会话、心跳、工单、见证、时间、记忆、状态、模块、生命周期、资源轨道、广播主控、外部适配、模型路由、临时能力和 HLDP-NP/GIR 编译执行确定性守门；所有裁决进入用户侧 SQLite 哈希链。工单阶段、时间租约、不可变模块、人格执行体生命周期、隔离跑道与广播塔主控纪元和裁决回执在同一原子事务中推进；旧状态重放、租约内双主、越权释放和同编号换摘要都失败关闭，并发记忆/状态版本写入冲突集而非互相覆盖。GLC Bootstrap Compiler 对同一黄金程序执行双编译一致性检查，不解析自由自然语言、不执行生成代码。
|
||||
|
||||
P7 已实现桌面产品侧装配注册表，但没有伪造物理能力：GLS-0836 与 GLS-0840–0849 全部保留目标节点、来源证据节点和当前装配状态，`ACTIVE_HEALTHY` 数量固定为 0，直到目标节点自身给出版本绑定回执。协议合同、运行图、状态机和编译器通过 Rust 编入 HoloLake 应用；用户数据与裁决回执留在各自应用数据目录。
|
||||
|
||||
当前验收数字：75 份编号源、183 条已分型来源依赖、0 条未分类依赖、25 份可执行投影、50 份库存不可执行源、P1–P6 共 21 份新原生器官、P7 共 11 项失败关闭装配边界。
|
||||
|
||||
这保证“已注册”不会被误报为“系统正在运行”，也保证每次新增执行协议都有可重复编译、明确守卫和真实回执。
|
||||
|
|
|
|||
|
|
@ -11,15 +11,19 @@ REPO-012 contains dozens of numbered GLS protocol sources. Human-readable source
|
|||
|
||||
Compile the current numbered GLS sources into a deterministic v2 runtime manifest pinned to an exact REPO-012 commit. Every selected source records its stable GLS number, path and SHA-256. Duplicate historical source locations are resolved by a deterministic source preference, while alternate-source counts remain visible. The compiler also reconciles the protocol registry, GLS entry, source manifest, architecture catalog and routing references, preserving their independent source hashes and rejecting registration conflicts.
|
||||
|
||||
Legacy `depends` arrays are not silently interpreted as runtime edges. They remain `LEGACY_UNTYPED_REFERENCE` audit edges and block new activation until their meaning is classified. Only dependencies declared by an explicit executable projection enter the runtime graph as `RUNTIME_REQUIRES`; that graph must be acyclic and dependency-closed.
|
||||
Legacy `depends` arrays are not silently interpreted as runtime edges. Bootstrap Compiler v1 classifies every source edge as `NORMATIVE_REFERENCE`, `SCHEMA_IMPORT`, `BUILD_REQUIRES`, `BOOT_REQUIRES`, `RECOVERY_REQUIRES` or `EVIDENCE_ONLY`; all remain audit-only. Only dependencies declared by an explicit executable projection enter the runtime graph as `RUNTIME_REQUIRES`; that graph must be acyclic and dependency-closed. The current exact source produces 183 typed source edges and zero unclassified edges.
|
||||
|
||||
An executable projection requires an explicit native adapter, event kinds, dependency list and fail-closed behavior. The compiler rejects missing executable dependencies and dependency cycles. The native runtime revalidates schema, source commit, counts, hashes, adapters and dependency closure before returning a protocol set to an organ.
|
||||
|
||||
Protocol prose is never evaluated as code. A protocol without an explicit projection remains `INVENTORIED_NOT_EXECUTABLE`. The initial executable set is GLS-0250, GLS-0253, GLS-0262 and GLS-0263. The zero-core numbering adapter requires their dependency-closed set before it can route a human number to an authoritative registry.
|
||||
Protocol prose is never evaluated as code. A protocol without an explicit projection remains `INVENTORIED_NOT_EXECUTABLE`. The product now embeds 25 dependency-closed projections: four P0 foundation contracts and 21 P1-P6 protocol organs. They provide the strict GLP codec, identity/context guards, hash-chain decision ledger, session/heartbeat/work-order/witness rules, causal time/memory/state guards, module/lifecycle/scheduler/control state machines, external/model/temporary-capability boundaries and the restricted HLDP-NP → GIR bootstrap compiler.
|
||||
|
||||
The kernel is an application-start prerequisite. If its embedded contract, projection closure, deterministic compiler self-check or local receipt/state ledger cannot load, HoloLake fails closed during startup. Receipt append and state-machine transition use one immediate SQLite transaction, so stale work-order/lifecycle transitions, conflicting time or broadcast owners, immutable module replacement and cross-owner runway release cannot race past the guards. Concurrent memory/state inputs are stored as conflicts rather than overwritten. The ledger stores per-user receipts and projections in application data; protocol authority and enforcement code are compiled into the signed application bundle and do not depend on the development machine.
|
||||
|
||||
P7 is intentionally different: the application embeds an 11-item target capability assembly registry for GLS-0836 and GLS-0840–0849, but records zero desktop physical capabilities as verified. Evidence from BS-SH-005 or JD-FD-PRIMARY is never transferred into desktop health. A target becomes active only after its own version-bound evidence exists.
|
||||
|
||||
## Why
|
||||
|
||||
This creates the same hard boundary that a real API presents: a caller must satisfy the machine contract whether or not it has read the explanatory documentation. It also preserves factual honesty. HoloLake can report that 75 protocol sources are compiled while separately reporting that only four currently have native enforcement projections.
|
||||
This creates the same hard boundary that a real API presents: a caller must satisfy the machine contract whether or not it has read the explanatory documentation. It also preserves factual honesty. HoloLake reports 75 inventoried sources, 25 native enforcement projections and 50 non-executable sources separately.
|
||||
|
||||
## Rejected alternatives
|
||||
|
||||
|
|
@ -35,5 +39,8 @@ This creates the same hard boundary that a real API presents: a caller must sati
|
|||
- `contracts/gls-executable-projections.json`
|
||||
- `contracts/gls-runtime-registry.json`
|
||||
- `src-tauri/src/gls_protocol_runtime.rs`
|
||||
- `src-tauri/src/gls_protocol_kernel.rs`
|
||||
- `src-tauri/src/gls_bootstrap_compiler.rs`
|
||||
- `contracts/gls-native-runtime-kernel.json`
|
||||
- `src-tauri/src/zero_core_numbering.rs`
|
||||
- `scripts/gls-protocol-runtime.test.mjs`
|
||||
|
|
|
|||
Loading…
Reference in a new issue