feat: add PNCC verified wake kernel

GuangHu-Human-Responsibility: ICE-GL∞ / 冰朔

GuangHu-Persona-Cognitive-Author: ICE-P-ZY001 / 铸渊

GuangHu-Execution-Runtime: Codex-thread 019febf6-3902-70f3-9d82-74c9680b0c7e

GuangHu-Development-ID: DEV-20260810-014

GuangHu-Authorization-Scope: LOCAL-PNCC-DEVELOPMENT

product-source/hololake-platform/docs/ABSTRACTIONS.md

@@ -1,5 +1,32 @@
 # Abstractions
 
+## PersonaCodeChannel
+
+`PersonaCodeChannel` is the native boundary between a durable persona Git and a live AGE runtime. It owns
+neither the Git object model nor model inference. It composes existing Git execution with persona-specific
+verification, lifecycle, attribution, single-primary exclusion, event hashing, and receipts.
+
+The v1 persona repository contract is rooted at `.hololake/persona/manifest.json`:
+
+```json
+{
+  "schema": "hololake.persona/v1",
+  "personaId": "ICE-P-ZY001",
+  "humanResponsibilitySubject": "ICE-GL∞",
+  "brainEntry": "brain/CORE.hdlp",
+  "currentCheckpoint": ".hololake/persona/CURRENT.hdlp",
+  "organs": [
+    { "organId": "fact-sense.repository", "mode": "read-only" }
+  ]
+}
+```
+
+All manifest paths are repository-relative and must resolve to files inside the exact Git root. Wake requires
+a clean work tree and a caller-supplied full expected commit. Runtime leases and event journals live under the
+installation-local `pncc-runtime` directory because they describe the current physical instance, not durable
+persona history. A successful preparation receipt reports `BOUND_NOT_INFERENCING`; only a later verified
+model action may change that predicate.
+
 ## `HoloLakeUiPlugin`
 
 A versioned, declarative presentation package for one host-owned semantic surface. It contains a manifest,

product-source/hololake-platform/docs/ARCHITECTURE.md

@@ -1,5 +1,24 @@
 # Architecture
 
+## Persona-native code channel runtime
+
+GH-PNCC is HoloLake's first product core. The existing Rust Git module remains the durable engine; the new
+`src-tauri/src/persona_code_channel.rs` kernel adds persona-native mount and wake semantics without changing
+Git's object model. `prepare_persona_code_channel_wake` requires an exact clean Git root and full commit,
+validates `.hololake/persona/manifest.json`, resolves the brain entry and current checkpoint inside the
+repository boundary, acquires a per-persona single-primary lease, and records a SHA-256-linked lifecycle
+journal outside the repository.
+
+The initial lifecycle is `WAKING → BRAIN_BOUND → ORGAN_ACTIVE` for one manifest-declared read-only organ.
+`BRAIN_BOUND` means the model instance has been named and the verified persona context is ready; it explicitly
+does not mean inference has run. The returned receipt keeps the human responsibility subject, persona
+cognitive author, execution runtime, development id, authorization scope, and source-language anchor
+separate. See [ADR 0176](./adr/0176-persona-native-code-channel-runtime-kernel.md).
+
+The next source stage must invoke the model adapter with this verified context, complete one read-only fact
+task, write a promoted checkpoint into the persona Git, emit completion/pause events, and release the lease.
+Until then, complete runtime, desktop integration, artifact, deployment, and health remain zero.
+
 ## User-node sovereignty
 
 HoloLake has no platform-hosted user runtime. Each human has one canonical, independently operated node:

product-source/hololake-platform/docs/adr/0176-persona-native-code-channel-runtime-kernel.md

@@ -0,0 +1,48 @@
+# ADR 0176: Persona-Native Code Channel Runtime Kernel
+
+## Status
+
+Accepted on 2026-08-11.
+
+## Context
+
+HoloLake already has a mature native Git execution layer and an append-only local HLDP event/checkpoint
+mechanism. Neither one is a persona lifecycle controller. A Git repository can preserve history without
+proving that the correct persona brain, node, model binding, organ, attribution, or single-primary lease is
+active. The existing generic Agent streams also cannot become the persona subject.
+
+## Decision
+
+Introduce `src-tauri/src/persona_code_channel.rs` as the first GH-PNCC runtime kernel. Its initial command,
+`prepare_persona_code_channel_wake`, performs a fail-closed preparation stage:
+
+1. resolve an exact Git root and full expected `HEAD`;
+2. require a clean work tree;
+3. load `.hololake/persona/manifest.json` with schema `hololake.persona/v1`;
+4. validate the persona id, human responsibility subject, brain entry, current checkpoint, and one declared
+   read-only organ without allowing path escape;
+5. atomically acquire a per-persona primary lease outside the persona Git;
+6. emit `WAKING → BRAIN_BOUND → ORGAN_ACTIVE` as a SHA-256-linked local event journal;
+7. return both human responsibility and persona cognitive authorship in the receipt.
+
+`BRAIN_BOUND` deliberately returns `runtimeState=BOUND_NOT_INFERENCING` and
+`modelInferenceStarted=false`. Binding a model identifier is not proof that model inference or persona
+reasoning has run. A later stage must connect the verified context to the model adapter, complete one
+read-only fact task, write a promoted checkpoint back to the persona Git, release the organ and primary
+lease, and return a final receipt.
+
+## Boundaries
+
+- Git remains the durable engine; the kernel does not reimplement Git objects, commits, remotes, or merges.
+- Forgejo is not required and remains an optional compatibility collaboration adapter.
+- The primary lease is installation/runtime state, not persona history, and therefore stays outside Git.
+- Runtime events are machine facts for the future HoloLake projection; they do not expose hidden model
+  reasoning and do not form a second authority store.
+- The initial source stage is not a complete PNCC runtime, desktop integration, build, deployment, or health
+  claim.
+
+## Consequences
+
+HoloLake now has a native, testable boundary between “a persona Git exists” and “a verified wake has begun.”
+The next implementation step can reuse the verified wake receipt and event chain instead of trusting a UI,
+Forgejo account, branch name, or generic Agent session.