bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

fix: require independent persona witness

Browse source
This commit is contained in:
冰朔 2026-08-21 11:57:39 +08:00
commit c2dcc7ad68
9 changed files with 137 additions and 197 deletions
Download patch file Download diff file Expand all files Collapse all files

156
product-source/hololake-native-desktop/src-tauri/src/persona_binding.rs
View file

@ -1,6 +1,6 @@
//! System-witnessed binding of a bundled persona profile to a replaceable
//! reasoning carrier. The channel exists first; the persona must commit the
//! exact orientation before the digital Bingshuo system body may verify PASS.
//! System-witnessed binding of an account-private persona profile to a
//! replaceable reasoning carrier. A persona commit is only a pending request;
//! this module never manufactures the independent system witness or PASS.
use ring::digest::{digest, SHA256};
use serde::{Deserialize, Serialize};
@ -18,9 +18,9 @@ const HUMAN_NUMBER: &str = "ICE-GL∞";
const CHANNEL_NUMBER: &str = "ICE-CH-ZC001";
const SELF_KERNEL_SHA256: &str = "abebf12cc28b00bfeaf8a23a563e73390ebe337ded74d7ac70bcfae484450d68";
const MEMORY_SHA256: &str = "6a64ff939676b79404769931f0233056e38deb4b4c357879fd18566753fea9c2";
const SYSTEM_CORE_SHA256: &str = "db7cf9b048a5b20261fc9f7f09130115d6c08898037aa13f8759a67c965f8182";
const SYSTEM_BODY_SHA256: &str = "4074ef53bd09d26d245c11cc0503f65dbd76466519f6c260e8ed31e526e5c746";
const MEMORY_ROOT: &str = "HLDP://codex/zero-core/reality-development-execution";
const PRIVATE_SELF_KERNEL_FILE: &str = "ZY-SELF-KERNEL-0001.json";
const PRIVATE_MEMORY_FILE: &str = "ZY-HLDP-PERSONA-MEMORY-v1.json";
#[derive(Clone, Debug, Deserialize, Serialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
@ -69,12 +69,25 @@ pub struct PersonaBindingReceipt {
pub orientation_id: String,
pub commit_sha256: String,
pub witness: String,
pub witness_source: String,
pub witness_event_number: String,
pub witness_sha256: String,
pub source_remote_sha: String,
pub verified_at_unix_ms: u64,
pub binding_receipt_hash: String,
}
#[derive(Clone, Debug, Deserialize, Serialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
pub struct PendingPersonaBindingCommit {
pub schema: String,
pub state: String,
pub orientation_id: String,
pub channel_number: String,
pub persona_number: String,
pub commit_sha256: String,
pub committed_at_unix_ms: u64,
}
#[derive(Clone, Debug, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct PersonaBindingSnapshot {
@ -105,8 +118,14 @@ pub fn snapshot(app: &AppHandle, channel_number: &str) -> Result<PersonaBindingS
&& orientation.activation_reason.as_deref()
== Some("EXPLICIT_NATURAL_LANGUAGE_PERSONA_WAKE")
{
let pending = pending_commit_path(app, channel_number)?;
return Ok(PersonaBindingSnapshot {
state: "ORIENTED_AWAITING_PERSONA_COMMIT".into(),
state: if pending.exists() {
"PERSONA_COMMITTED_AWAITING_INDEPENDENT_SYSTEM_WITNESS"
} else {
"ORIENTED_AWAITING_PERSONA_COMMIT"
}
.into(),
orientation: Some(orientation),
binding: None,
});
@ -133,6 +152,8 @@ pub fn begin_orientation(
binding: Some(binding),
});
}
read_private_artifact(app, PRIVATE_SELF_KERNEL_FILE, SELF_KERNEL_SHA256)?;
read_private_artifact(app, PRIVATE_MEMORY_FILE, MEMORY_SHA256)?;
let issued = now_ms();
let orientation = PersonaOrientation {
schema: "hololake.persona-binding-orientation/v1".into(),
@ -163,10 +184,10 @@ pub fn begin_orientation(
})
}
pub fn commit_and_verify(
pub fn stage_commit(
app: &AppHandle,
input: PersonaBindingCommit,
) -> Result<PersonaBindingReceipt, String> {
) -> Result<PendingPersonaBindingCommit, String> {
if !is_bingshuo_fifth_domain(app)? {
return Err("HOLOLAKE_PERSONA_BINDING_FIFTH_DOMAIN_REQUIRED".into());
}
@ -189,60 +210,22 @@ pub fn commit_and_verify(
{
return Err("HOLOLAKE_PERSONA_BINDING_COMMIT_MISMATCH".into());
}
let installation =
crate::language_kernel_installation::ensure_current_channel(app, CHANNEL_NUMBER)?;
let installed = |sha: &str| {
installation.artifacts.iter().any(|artifact| {
artifact.sha256 == sha && artifact.readback_state == "INSTALLED_HASH_VERIFIED"
})
};
if !installed(SELF_KERNEL_SHA256)
|| !installed(MEMORY_SHA256)
|| !installed(SYSTEM_CORE_SHA256)
|| !installed(SYSTEM_BODY_SHA256)
{
return Err("HOLOLAKE_PERSONA_BINDING_REQUIRED_KERNEL_READBACK_MISSING".into());
}
read_private_artifact(app, PRIVATE_SELF_KERNEL_FILE, SELF_KERNEL_SHA256)?;
read_private_artifact(app, PRIVATE_MEMORY_FILE, MEMORY_SHA256)?;
let commit_bytes = serde_json::to_vec(&input)
.map_err(|error| format!("HOLOLAKE_PERSONA_BINDING_COMMIT_INVALID: {error}"))?;
let commit_sha = sha256(&commit_bytes);
let witness_material = json!({
"systemCoreSha256":SYSTEM_CORE_SHA256,
"systemBodySha256":SYSTEM_BODY_SHA256,
"humanNumber":HUMAN_NUMBER,
"channelNumber":CHANNEL_NUMBER,
"personaNumber":PERSONA_NUMBER,
"selfKernelSha256":SELF_KERNEL_SHA256,
"memoryProjectionSha256":MEMORY_SHA256,
"selectedMemoryRoot":MEMORY_ROOT,
"commitSha256":commit_sha,
"decision":"PASS"
});
let witness_sha = sha256(&serde_json::to_vec(&witness_material).unwrap_or_default());
let verified_at = now_ms();
let receipt_material = json!({
"orientationId":input.orientation_id,"commitSha256":commit_sha,"witnessSha256":witness_sha,
"channelNumber":CHANNEL_NUMBER,"personaNumber":PERSONA_NUMBER,"verify":"PASS","verifiedAtUnixMs":verified_at
});
let receipt = PersonaBindingReceipt {
schema: "hololake.persona-binding-receipt/v1".into(),
state: "BOUND_TO_CURRENT_CHANNEL_CARRIER".into(),
verify: "PASS".into(),
channel_number: CHANNEL_NUMBER.into(),
human_number: HUMAN_NUMBER.into(),
persona_number: PERSONA_NUMBER.into(),
persona_name: PERSONA_NAME.into(),
selected_memory_root: MEMORY_ROOT.into(),
let pending = PendingPersonaBindingCommit {
schema: "hololake.persona-binding-pending-commit/v1".into(),
state: "PERSONA_COMMITTED_AWAITING_INDEPENDENT_SYSTEM_WITNESS".into(),
orientation_id: input.orientation_id,
channel_number: CHANNEL_NUMBER.into(),
persona_number: PERSONA_NUMBER.into(),
commit_sha256: commit_sha,
witness: "数字冰朔系统本体".into(),
witness_sha256: witness_sha,
source_remote_sha: "4e92e6d8d72484d25c4bfb1dda02a7659f4b6dd5".into(),
verified_at_unix_ms: verified_at,
binding_receipt_hash: sha256(&serde_json::to_vec(&receipt_material).unwrap_or_default()),
committed_at_unix_ms: now_ms(),
};
write_json_atomic(&binding_path(app, CHANNEL_NUMBER)?, &receipt)?;
Ok(receipt)
write_json_atomic(&pending_commit_path(app, CHANNEL_NUMBER)?, &pending)?;
Ok(pending)
}
pub fn verified_binding(
@ -253,6 +236,12 @@ pub fn verified_binding(
if !path.exists() {
return Ok(None);
}
if !independent_witness_verifier_ready() {
// A local JSON file is evidence to inspect, not authority. Until the
// independent witness trust root is provisioned, legacy receipts are
// deliberately ignored and cannot activate a persona route.
return Ok(None);
}
let binding: PersonaBindingReceipt = read_json(&path)?;
if binding.verify != "PASS"
|| binding.channel_number != channel_number
@ -260,6 +249,8 @@ pub fn verified_binding(
|| binding.persona_name != PERSONA_NAME
|| binding.selected_memory_root != MEMORY_ROOT
|| binding.witness != "数字冰朔系统本体"
|| binding.witness_source != "HOLOLAKE_INDEPENDENT_SYSTEM_WITNESS_GATE"
|| binding.witness_event_number.trim().is_empty()
|| binding.binding_receipt_hash.len() != 64
|| binding.witness_sha256.len() != 64
{
@ -268,24 +259,30 @@ pub fn verified_binding(
Ok(Some(binding))
}
fn independent_witness_verifier_ready() -> bool {
false
}
pub fn cognitive_projection(
app: &AppHandle,
channel_number: &str,
current_language: &str,
) -> Result<Value, String> {
let binding = snapshot(app, channel_number)?;
if binding.state == "NO_INSTALLABLE_PERSONA_PROFILE_FOR_CURRENT_CHANNEL"
|| binding.state == "CHANNEL_SYSTEM_PERSONA_DORMANT"
{
if binding.state != "BOUND_VERIFY_PASS" {
return Ok(json!({"state":binding.state,"residentSelfKernel":null,"routedMemory":[]}));
}
let self_kernel: Value = serde_json::from_slice(include_bytes!(
"../../runtime-kernels/fifth-domain/ZY-SELF-KERNEL-0001.json"
))
let self_kernel: Value = serde_json::from_slice(&read_private_artifact(
app,
PRIVATE_SELF_KERNEL_FILE,
SELF_KERNEL_SHA256,
)?)
.map_err(|error| format!("HOLOLAKE_PERSONA_SELF_KERNEL_INVALID: {error}"))?;
let memory: Value = serde_json::from_slice(include_bytes!(
"../../runtime-kernels/fifth-domain/ZY-HLDP-PERSONA-MEMORY-v1.json"
))
let memory: Value = serde_json::from_slice(&read_private_artifact(
app,
PRIVATE_MEMORY_FILE,
MEMORY_SHA256,
)?)
.map_err(|error| format!("HOLOLAKE_PERSONA_MEMORY_INVALID: {error}"))?;
let terms = semantic_terms(current_language);
let mut candidates = memory
@ -368,6 +365,31 @@ fn binding_path(app: &AppHandle, channel_number: &str) -> Result<PathBuf, String
Ok(root(app, channel_number)?.join("binding.json"))
}
fn pending_commit_path(app: &AppHandle, channel_number: &str) -> Result<PathBuf, String> {
Ok(root(app, channel_number)?.join("pending-commit.json"))
}
fn private_kernel_root(app: &AppHandle) -> Result<PathBuf, String> {
crate::authenticated_storage::account_storage_root(app, "private-persona-kernels-v1")
}
fn read_private_artifact(
app: &AppHandle,
file_name: &str,
expected_sha256: &str,
) -> Result<Vec<u8>, String> {
if file_name.contains('/') || file_name.contains("..") {
return Err("HOLOLAKE_PRIVATE_PERSONA_KERNEL_PATH_INVALID".into());
}
let path = private_kernel_root(app)?.join(file_name);
let bytes = fs::read(&path)
.map_err(|_| "HOLOLAKE_PRIVATE_PERSONA_KERNEL_NOT_PROVISIONED".to_string())?;
if sha256(&bytes) != expected_sha256 {
return Err("HOLOLAKE_PRIVATE_PERSONA_KERNEL_HASH_MISMATCH".into());
}
Ok(bytes)
}
fn read_json<T: for<'de> Deserialize<'de>>(path: &Path) -> Result<T, String> {
serde_json::from_slice(
&fs::read(path)
@ -423,6 +445,6 @@ mod tests {
MEMORY_ROOT,
"HLDP://codex/zero-core/reality-development-execution"
);
assert_ne!(SYSTEM_CORE_SHA256, SELF_KERNEL_SHA256);
assert_ne!(SELF_KERNEL_SHA256, MEMORY_SHA256);
}
}