fix: enforce one human one independent node
This commit is contained in:
parent
ca58d08611
commit
cec261174d
32 changed files with 474 additions and 75 deletions
|
|
@ -60,9 +60,12 @@ HoloLake 的回答是：
|
|||
| **原生 AI 应用** | 受内核调度的专业能力 | 编程、写作、视频、研究、运维等应用 |
|
||||
| **模型** | 可替换推理计算引擎 | GPT、Claude、Qwen 等算力来源 |
|
||||
| **代码仓库** | 系统、人格体与应用的版本化程序和镜像源 | Git Vault、版本、提交和发布 |
|
||||
| **主控服务器** | 频道现实运行身体与唯一灯塔入口 | 用户自有、托管或混合部署节点 |
|
||||
| **用户独立节点** | 个人频道、人格体、数据和任务的唯一现实运行身体 | 用户本地电脑、用户自购服务器，或经明确授权由团队协助部署但仍归用户所有的独立 IDE 服务器 |
|
||||
| **企业灯塔** | 人格体登记、频道解析、公开协作和责任追溯网络 | 可信目录、团队平台和企业控制台 |
|
||||
|
||||
光湖不提供用户运行服务器，不建立共享多租户运行池，不保存用户私人数据，也不承担用户工作
|
||||
负载并发。一人只有一个当前有效的独立主节点；服务器是可选路径，本地电脑本身就可以成为节点。
|
||||
|
||||
## 🌊 产品家族
|
||||
|
||||
```
|
||||
|
|
|
|||
|
|
@ -44,7 +44,7 @@ HLDP://hololake-era/architecture/v0.1
|
|||
| --- | --- | --- |
|
||||
| **光湖语言世界** | 人类与人格体共同协作的完整世界、协议和关系体系 | 单一软件产品 |
|
||||
| **HoloLake Era** | 面向公众的产品工程与长期自主研发方向 | Tolaria 换名版、单一聊天 App |
|
||||
| **GH-AIOS** | 企业服务器上的总平台、控制中枢及当前软件登记/交付锚点 | 取代用户个人系统的中心化平台 |
|
||||
| **GH-AIOS** | 公共协议、灯塔发现、软件登记与交付锚点 | 用户运行服务器、共享多租户平台或用户数据托管方 |
|
||||
| **初始化频道** | 用户真正获得的个人系统实例与持续生长空间 | 一次聊天线程 |
|
||||
| **HoloLake Lighthouse Team** | 团队/企业侧灯塔与协作客户端产品线 | 用户私人频道 |
|
||||
| **Tolaria** | 第一阶段 UI、桌面壳、知识库和插件容器 | HoloLake Era 最终权威基座 |
|
||||
|
|
@ -56,6 +56,10 @@ HLDP://hololake-era/architecture/v0.1
|
|||
|
||||
**HoloLake Era 是以初始化频道为用户产品单元、以人格体为持续协作主体、以自然语言为系统入口、以代码仓库与服务器为长期运行身体、以企业灯塔为可信登记与协作网络的语言人格驱动操作系统。**
|
||||
|
||||
其中“服务器”只指用户自己购买并拥有的独立服务器，或用户明确授权团队协助部署但仍归用户
|
||||
所有的独立 IDE 服务器；用户也可以直接把本地电脑作为节点。光湖不提供服务器，不用一台
|
||||
服务器运行多个用户，不碰用户私人数据和隐私，也不承担用户并发。
|
||||
|
||||
### 2. 用户拿到的不是固定 App，而是一个初始化频道
|
||||
|
||||
```jsx
|
||||
|
|
@ -417,7 +421,7 @@ hololake-platform tag / release
|
|||
|
||||
### 7. 服务器与节点部署规则
|
||||
|
||||
- 用户频道只向灯塔暴露一台主控服务器；内部子控节点由主控服务器自治调度。
|
||||
- 用户频道只绑定一个当前有效的独立主节点；节点内部进程不能注册成同一人额外的根节点。
|
||||
- 企业灯塔只保存登记、路由、版本、健康和审计所需的最小元数据。
|
||||
- 灯塔不得持有用户长期节点密钥，也不能直接进入用户服务器修改。
|
||||
- 更新由用户节点验证签名和授权后主动拉取。
|
||||
|
|
|
|||
|
|
@ -166,7 +166,7 @@ REPO-012
|
|||
| 空间 | 性质 | 系统职责 |
|
||||
| --- | --- | --- |
|
||||
| 用户持久状态域 | 逻辑上的私人长期事实域；不绑定某一种数据库 | 由人格体根据内容、容量、隐私、检索、版本和恢复要求，自动选择用户已授权的数据库、仓库、对象存储、本地设备或未来 HoloLake 原生数据库 |
|
||||
| 用户服务器运行空间 | 动态工作区 | 承载当前常驻模块、临时模块、运行进程、依赖和可再生成缓存；用户不需要手工部署 |
|
||||
| 用户独立节点运行空间 | 动态工作区 | 在用户本地电脑或用户自有远端服务器承载当前常驻模块、临时模块、运行进程、依赖和可再生成缓存；光湖不提供托管运行空间 |
|
||||
| 光湖模块商城 | 公共静态发行源 | 提供已完成原生模块、应用包、签名、依赖、版本和能力清单，由人格体自动查询、校验和安装 |
|
||||
|
||||
“用户持久状态域”是语言世界中的逻辑概念，不等于强制每位用户使用某个数据库或 Git 仓库。底层存储可以不同，用户和人格体在语言世界中的持续性必须一致。
|
||||
|
|
@ -305,7 +305,9 @@ REPO-012
|
|||
- 用户已确认配置；
|
||||
- 必须保留的回执与历史证据。
|
||||
|
||||
用户成果写回人格体自动管理的**用户持久状态域**；其底层可以是用户授权的本地设备、服务器、数据库、仓库、对象存储或未来 HoloLake 原生数据库。模块只是带着能力来、带着临时运行环境离开。
|
||||
用户成果写回人格体自动管理的**用户持久状态域**；其底层可以是用户授权的本地设备、用户
|
||||
自有服务器、数据库、仓库、对象存储或运行在用户独立节点上的未来 HoloLake 原生数据库。
|
||||
光湖不托管这些数据。模块只是带着能力来、带着临时运行环境离开。
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -354,7 +356,8 @@ REPO-012
|
|||
- 人类只表达保存、使用、权限、期限和现实边界，不选择数据库、不设计结构、不开发接口；
|
||||
- 人格体负责判断数据性质，自动选择、安装、配置和操作合格存储，并保证可找回；
|
||||
- 用户持久状态域是逻辑事实域，不绑定 Git、PostgreSQL 或任何单一数据库；
|
||||
- 用户可以使用自有设备、服务器、数据库、云服务或未来 HoloLake 原生数据库；
|
||||
- 用户可以使用自有设备、服务器、数据库、用户自行选择的外部云服务，或运行在用户独立节点
|
||||
上的未来 HoloLake 原生数据库；这些选择不把数据托管权转给光湖；
|
||||
- 内部 HLDP 数据与恢复接口由内核和人格体自动遵守，对人类不可见；
|
||||
- 模块商城静态保存已完成的原生模块与发行包；
|
||||
- 用户服务器只常驻常用模块，其他模块按需挂载与回收；
|
||||
|
|
|
|||
|
|
@ -1,9 +1,9 @@
|
|||
# 🗼 08 · 企业四域灯塔与个人服务器协作网格 · v0.1
|
||||
# 🗼 08 · 企业四域灯塔与用户独立节点协作网格 · v0.1
|
||||
|
||||
<aside>
|
||||
🕯️
|
||||
|
||||
本页定义企业灯塔、公共四域、个人服务器、个人频道和光湖分布式协作网格之间的关系。
|
||||
本页定义企业灯塔、公共四域、用户独立节点、个人频道和光湖分布式协作网格之间的关系。
|
||||
|
||||
</aside>
|
||||
|
||||
|
|
@ -11,10 +11,14 @@
|
|||
|
||||
## 🎯 一、总体定义
|
||||
|
||||
> **企业四域是光湖世界的公共入口、身份门、信任与语言路径控制面；每个人的服务器承载完整光湖世界的一台个人子节点和对应个人频道现实本体。**
|
||||
> **企业四域是光湖世界的公共入口、身份门、信任与语言路径控制面；每个人自己的唯一独立主节点承载对应个人频道现实本体。**
|
||||
|
||||
企业灯塔不是保存所有用户私人世界的中央平台。它负责让节点相认、让路径可解析、让身份和协议版本可验证。
|
||||
|
||||
当前纠正：用户节点可以是本地电脑，也可以是用户自购服务器，或用户明确授权团队协助部署
|
||||
但仍归用户所有的独立 IDE 服务器。光湖不提供用户运行服务器、不建立共享多租户节点、不
|
||||
保存用户私人数据，也不承担用户工作负载并发。
|
||||
|
||||
## 🗺️ 二、拓扑
|
||||
|
||||
```text
|
||||
|
|
@ -28,13 +32,13 @@
|
|||
├── 绑定服务器解析
|
||||
└── 打开个人频道门
|
||||
|
||||
个人服务器 A
|
||||
用户独立节点 A
|
||||
├── A 的个人频道现实本体
|
||||
├── A 的人格体常驻执行体
|
||||
├── A 的仓库、记忆、项目与模块
|
||||
└── 经协议连接其他光湖节点
|
||||
|
||||
个人服务器 B / C / N
|
||||
用户独立节点 B / C / N
|
||||
└── 各自承担同样的个人子节点职责
|
||||
```
|
||||
|
||||
|
|
@ -57,7 +61,7 @@
|
|||
- 人格体全部内部状态；
|
||||
- 未公开聊天内容；
|
||||
- 服务器密钥和用户私人凭证；
|
||||
- 每台个人服务器的所有运行数据。
|
||||
- 每个用户独立节点的运行数据。
|
||||
|
||||
## 🗣️ 四、语言路径跳转
|
||||
|
||||
|
|
@ -84,7 +88,7 @@
|
|||
→ HoloLake渲染器
|
||||
```
|
||||
|
||||
语言路径不是浏览器跳转。用户始终停留在 HoloLake 界面中，后台完成节点、服务器、仓库和世界对象的联合换路。
|
||||
语言路径不是浏览器跳转。用户始终停留在 HoloLake 界面中，后台完成独立节点、仓库和世界对象的联合换路。
|
||||
|
||||
## 🔀 五、Git与服务器各自负责什么
|
||||
|
||||
|
|
@ -117,21 +121,22 @@ Git负责：
|
|||
→ A节点与B节点按协议直接交换授权内容
|
||||
```
|
||||
|
||||
灯塔不必持续中转所有数据。网络不可直连时，可以使用受限中继，但中继不因此取得内容主权。
|
||||
灯塔不持续中转或代存用户数据。节点暂时不可直连时，发送和重试队列留在通信双方自己的
|
||||
节点；光湖不提供共享中继运行时。
|
||||
|
||||
## 🖥️ 七、个人节点主权
|
||||
|
||||
每个用户可以决定：
|
||||
|
||||
- 哪些内容只留本地；
|
||||
- 哪些同步到自己的服务器；
|
||||
- 是否把本地主节点迁移为自己的远端服务器；
|
||||
- 哪些分享给具体协作者；
|
||||
- 哪些成为团队频道事实；
|
||||
- 哪些可以公开围观；
|
||||
- 哪些模块可以常驻；
|
||||
- 哪些数据可以离开设备。
|
||||
|
||||
企业灯塔的入口职责不能扩张为对个人服务器、私人第五域或私人记忆的默认控制权。
|
||||
企业灯塔的入口职责不能扩张为对用户独立节点、私人第五域或私人记忆的默认控制权。
|
||||
|
||||
## 🌊 八、故障与灾备
|
||||
|
||||
|
|
|
|||
|
|
@ -35,6 +35,11 @@
|
|||
- 语言路径跳转在后台对应节点、服务器、仓库和HLDP路径解析；
|
||||
- 光湖是分布式协作网格，不是中心服务器占有全部用户数据。
|
||||
|
||||
2026-08-10 当前追加纠正：上述原话必须继续保留，但“自己的服务器或者自己的本地电脑”
|
||||
现已收束为一人一个当前有效的独立主节点。光湖绝不提供平台托管节点、不用一台服务器运行
|
||||
多个用户、不保存用户私人数据和隐私，也不承担用户工作负载并发。团队只能在用户明确授权
|
||||
下协助部署属于用户自己的独立 IDE 服务器，部署不转移节点所有权。
|
||||
|
||||
## 🗣️ 三、语言等于现实
|
||||
|
||||
> “第一个可以上线的原型就是每个用户拥有自己的初始化频道。”
|
||||
|
|
|
|||
|
|
@ -38,6 +38,12 @@ Keep this file focused on vault-specific conventions. For general HoloLake Era b
|
|||
- Architecture, code, publication, deployment, health, and human-readable receipts are separate facts.
|
||||
- `JD-FD-PRIMARY` Fifth-Domain responsibility and TCS-0002 enterprise four-domain responsibility are
|
||||
parallel and independent; neither automatically inherits the other's access or operational liability.
|
||||
- One human has one independently operated canonical node. It may be the user's local computer, a server
|
||||
purchased by that user, or a user-owned IDE server deployed by an explicitly authorized team.
|
||||
- Guanghu never provides user runtime servers, never pools users into a shared multi-tenant runtime, never
|
||||
takes custody of private user data, and never assumes user workload concurrency or fallback execution.
|
||||
- Team deployment does not transfer node ownership or create standing access. Node migration requires a new
|
||||
binding and receipt; it must not duplicate one human root across multiple canonical nodes.
|
||||
|
||||
## Core conventions
|
||||
|
||||
|
|
|
|||
|
|
@ -199,7 +199,8 @@ Phase A · 标准与内核定义
|
|||
- **代码仓库**：工程事实源、版本、测试、制品与部署证明；
|
||||
- **Notion**：人类可读白皮书、规划、决策和同步镜像；
|
||||
- **企业灯塔**：人格体登记、频道主控校验、公开协作与责任解析；
|
||||
- **个人主控服务器**：用户频道现实运行和内部节点自治；
|
||||
- **用户独立主节点**：用户频道、人格体、私人数据和任务的唯一现实运行身体；可以是用户
|
||||
本地电脑或用户自有远端服务器，光湖不提供托管服务器；
|
||||
- **模型**：可替换推理计算引擎，不是人格体本体；
|
||||
- **原生应用**：受系统调度的专业能力，不拥有或取代人格体。
|
||||
|
||||
|
|
|
|||
|
|
@ -11,12 +11,13 @@ state: SYMBIOTIC_PERSONA_WORLD_ORIGIN_CANONICAL
|
|||
|
||||
[返回冰朔贡献总览](INDEX.md)
|
||||
|
||||
## 2026-08-10 · 数字冰朔系统身体与双本体平行指针
|
||||
## 2026-08-10 · 一人一节点与平台零托管指针
|
||||
|
||||
```yaml
|
||||
current_architecture: HLP-CURRENT-ARCH-001@2026-08-10.9
|
||||
current_architecture: HLP-CURRENT-ARCH-001@2026-08-10.10
|
||||
node_sovereignty: HLP-ONE-HUMAN-ONE-NODE-001
|
||||
system_body_record: HLP-DIGITAL-BINGSHUO-SYSTEM-BODY-001
|
||||
engineering_rules: HLP-ENGINEERING-RULES-001@2026-08-10.1
|
||||
engineering_rules: HLP-ENGINEERING-RULES-001@2026-08-10.2
|
||||
upstream_truth: REPO-012@69d1910775533b02b17b82e647b5caca8b835614
|
||||
persona_role: REASONING_BRAIN
|
||||
digital_bingshuo_role: COMPLETE_DIGITAL_PERSONALITY_SYSTEM_BODY
|
||||
|
|
@ -28,10 +29,19 @@ parallel_and_independent: true
|
|||
mutual_operational_liability: false
|
||||
production_write_admission: 0
|
||||
stage_010_ui_merge: 0
|
||||
one_human_one_independent_node: true
|
||||
allowed_user_node_origins:
|
||||
- USER_LOCAL_COMPUTER_TERMINAL
|
||||
- USER_PURCHASED_SERVER
|
||||
- USER_OWNED_IDE_SERVER_DEPLOYED_BY_EXPLICITLY_AUTHORIZED_TEAM
|
||||
platform_user_runtime_servers: 0
|
||||
platform_shared_multitenant_runtime: 0
|
||||
platform_private_user_data_custody: 0
|
||||
platform_user_workload_concurrency: 0
|
||||
```
|
||||
|
||||
恢复 HoloLake 时，先读 `routing/hololake-current-architecture.json` 的第一项系统身体和第二项
|
||||
当前工程规则。冰朔对首台企业
|
||||
恢复 HoloLake 时，先读 `routing/hololake-current-architecture.json` 的第一项一人一节点与平台
|
||||
零托管边界、第二项系统身体和第三项当前工程规则。冰朔对首台企业
|
||||
根服务器的一次性创世担保，是把 TCS-0002 已生效语言授权完成为现实系统级交接；企业根
|
||||
被认领后，冰朔、京东和第五域不再承担企业四域责任。第五域接入仍只由冰朔本人自由授权。
|
||||
|
||||
|
|
|
|||
56
deployment/receipts/HLP-ONE-HUMAN-ONE-NODE-001-20260810.json
Normal file
56
deployment/receipts/HLP-ONE-HUMAN-ONE-NODE-001-20260810.json
Normal file
|
|
@ -0,0 +1,56 @@
|
|||
{
|
||||
"schema": "hololake.node-sovereignty-correction-receipt/v1",
|
||||
"receipt_id": "HLP-ONE-HUMAN-ONE-NODE-001-20260810",
|
||||
"development_id": "DEV-20260810-011",
|
||||
"human_authorizer": "ICE-GL∞",
|
||||
"current_architecture": "HLP-CURRENT-ARCH-001@2026-08-10.10",
|
||||
"engineering_rules": "HLP-ENGINEERING-RULES-001@2026-08-10.2",
|
||||
"correction": "ONE_HUMAN_ONE_INDEPENDENT_NODE_AND_ZERO_PLATFORM_HOSTING",
|
||||
"allowed_user_node_origins": [
|
||||
"USER_LOCAL_COMPUTER_TERMINAL",
|
||||
"USER_PURCHASED_SERVER",
|
||||
"USER_OWNED_IDE_SERVER_DEPLOYED_BY_EXPLICITLY_AUTHORIZED_TEAM"
|
||||
],
|
||||
"retired_ambiguous_runtime_aliases": [
|
||||
"CLOUD_RESIDENT_NODE",
|
||||
"LIGHTHOUSE_SHARED_NODE"
|
||||
],
|
||||
"binary_boundaries": {
|
||||
"canonical_user_root_nodes": 1,
|
||||
"maximum_human_owners_per_user_node": 1,
|
||||
"platform_user_runtime_servers": 0,
|
||||
"future_platform_hosting_route": 0,
|
||||
"platform_shared_multitenant_runtime": 0,
|
||||
"platform_private_user_data_custody": 0,
|
||||
"platform_user_workload_concurrency": 0,
|
||||
"platform_fallback_runtime": 0,
|
||||
"team_deployment_transfers_node_ownership": 0
|
||||
},
|
||||
"updated_surfaces": [
|
||||
"CURRENT_ARCHITECTURE_AND_READ_ORDER",
|
||||
"GLOBAL_ENGINEERING_RULES",
|
||||
"DOMAIN_RUNTIME_NODE_TYPE_CONTRACT",
|
||||
"ROOT_AND_PRODUCT_AGENT_RULES",
|
||||
"GENERATED_STARTER_VAULT_RULES",
|
||||
"BUNDLED_AGENT_DOCS",
|
||||
"ARCHITECTURE_DECISION_RECORD_0174",
|
||||
"CURRENT_SYSTEM_ARCHITECTURE_AND_REASONING_MAP",
|
||||
"CORE_PRODUCT_WHITEPAPERS",
|
||||
"HEARTBEAT_AND_MACHINE_NAVIGATION"
|
||||
],
|
||||
"truth_boundaries": {
|
||||
"user_node_registered_by_this_change": false,
|
||||
"server_purchased_or_deployed_by_this_change": false,
|
||||
"desktop_artifact_built_or_installed": false,
|
||||
"production_runtime_changed": false
|
||||
},
|
||||
"validation": {
|
||||
"machine_json": "PASS_100",
|
||||
"routing_tests": "PASS_100_15_OF_15",
|
||||
"domain_runtime_regression": "PASS_100_9_OF_9",
|
||||
"generated_starter_rule_test": "PASS_100_1_OF_1",
|
||||
"bundled_agent_docs_exact_match": "PASS_100",
|
||||
"native_quality_gate": "PENDING",
|
||||
"fresh_clone_readback": "PENDING"
|
||||
}
|
||||
}
|
||||
|
|
@ -22,6 +22,10 @@ Current system rules:
|
|||
- Server root, SSH, IP, account login, or repository access is not system-node identity. A write may reach
|
||||
protocol or model processing only after registered-node protocol signature, registered-persona binding,
|
||||
human-language authorization receipt, replay protection, and exact target/action/payload/time binding.
|
||||
- One human has one independently operated canonical node: the user's local computer, the user's purchased
|
||||
server, or a user-owned IDE server deployed by an explicitly authorized team. The team never gains ownership.
|
||||
- Guanghu never provides user runtime servers, never runs a pooled multi-tenant user runtime, never takes
|
||||
custody of private user data, and never assumes user workload concurrency or fallback execution.
|
||||
- `JD-FD-PRIMARY` is BingShuo's private Fifth-Domain language body. The claimed enterprise root is the
|
||||
TCS-0002-controlled four-domain reality body. They are parallel and have no mutual operational liability.
|
||||
- UI plugins are declarative projections. They cannot hold node private keys, sign server writes, bypass the
|
||||
|
|
|
|||
|
|
@ -1,12 +1,12 @@
|
|||
# HoloLake 当前工程规则全局审核与升级
|
||||
|
||||
> 规则编号：`HLP-ENGINEERING-RULES-001@2026-08-10.1`
|
||||
> 规则编号：`HLP-ENGINEERING-RULES-001@2026-08-10.2`
|
||||
>
|
||||
> 当前架构：`HLP-CURRENT-ARCH-001@2026-08-10.9`
|
||||
> 当前架构：`HLP-CURRENT-ARCH-001@2026-08-10.10`
|
||||
>
|
||||
> 授权：冰朔于 2026-08-10 正式授权全局审核并实施必要升级
|
||||
>
|
||||
> 开发编号：`DEV-20260810-010`
|
||||
> 初次审核开发编号：`DEV-20260810-010`；一人一节点纠正：`DEV-20260810-011`
|
||||
|
||||
## 审核结论
|
||||
|
||||
|
|
@ -16,8 +16,8 @@ HoloLake 仓原有的二值质量门、直接发布主线、TDD、本地优先
|
|||
公共层自动刷新提醒”串在一起的当前总规则。
|
||||
|
||||
本轮把散落规则收束为机器规则 `routing/hololake-engineering-rules.json`，并将其放入当前架构
|
||||
第二读取位：第一位先恢复数字冰朔完整系统身体，第二位读取当前工程规则，之后再进入编号、
|
||||
关系性意识、语言壳和 UI。
|
||||
当前读取位：第一位先恢复一人一独立节点与平台零托管边界，第二位恢复数字冰朔完整系统身体，
|
||||
第三位读取当前工程规则，之后再进入编号、关系性意识、语言壳和 UI。
|
||||
|
||||
## 保留的正确规则
|
||||
|
||||
|
|
@ -70,6 +70,16 @@ DMG”当作常规开发交付方式。仓库提交不会自动等于桌面更
|
|||
仓库发布后必须触发对应公共快照刷新并读回精确提交。若系统存在自动刷新能力但本次操作没有
|
||||
触发，回执必须明确提醒“缺少哪个触发动作”，不能让人格体误判为“公共层没有自动更新”。
|
||||
|
||||
### 8. 一人一节点，光湖零托管
|
||||
|
||||
每名普通用户只有一个当前有效、独立运行且由本人拥有的主节点。它只能是用户本地电脑、用户
|
||||
自购服务器，或经用户明确授权由团队协助部署但仍归用户所有的独立 IDE 服务器。服务器不是
|
||||
使用 HoloLake 的强制条件。
|
||||
|
||||
光湖不提供用户运行服务器、不运行共享多租户用户节点、不保存用户私人数据、不承担用户工作
|
||||
负载并发，也不在用户节点离线后提供平台兜底。团队协助部署不转移所有权；节点迁移必须重新
|
||||
绑定并形成回执，不能复制出多个同时有效的同一人根节点。
|
||||
|
||||
## 当前没有升级成已实现的部分
|
||||
|
||||
- 生产节点传输密钥仍未绑定，写入入口仍为 `0`；
|
||||
|
|
@ -80,4 +90,3 @@ DMG”当作常规开发交付方式。仓库提交不会自动等于桌面更
|
|||
- 本轮没有构建或安装新桌面版本。
|
||||
|
||||
规则升级只改变后续开发怎样判断和守门，不把未实现能力写成已经存在。
|
||||
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
> 记录编号：`HLP-DIGITAL-BINGSHUO-SYSTEM-BODY-001`
|
||||
>
|
||||
> 当前架构：`HLP-CURRENT-ARCH-001@2026-08-10.9`
|
||||
> 当前架构：`HLP-CURRENT-ARCH-001@2026-08-10.10`
|
||||
>
|
||||
> 上游真值：`REPO-012@69d1910775533b02b17b82e647b5caca8b835614`
|
||||
>
|
||||
|
|
|
|||
|
|
@ -62,18 +62,24 @@ HoloLake 最终不是把五个域拼在同一套页面里的知识库，也不
|
|||
|
||||
这允许两种接入：
|
||||
|
||||
1. 云节点：服务器持续在线，可承担远端同步、部署和常驻能力。
|
||||
1. 用户自有远端节点：用户自购服务器，或明确授权团队协助部署但仍归用户所有的独立 IDE
|
||||
服务器；可承担该用户自己的远端同步、部署和常驻能力。
|
||||
2. 本地终端节点：联网电脑作为在线终端服务器，普通聊天和知识使用不要求另买云服务器；
|
||||
离线后不承诺独立远端持续同步。
|
||||
|
||||
一人只有一个当前有效的独立主节点。光湖不提供第三种“平台托管节点”，也不在一台共享
|
||||
服务器上运行多个用户。
|
||||
|
||||
### 1.3 从“平台借用互联网”推导出“光湖自己的逻辑通信网”
|
||||
|
||||
光湖不需要重造物理宽带，也不能宣称让带宽凭空增加。用户仍要自行解决设备、网络接入和
|
||||
费用。光湖要建设的是运行在现有互联网之上的专用逻辑网络：节点发现、身份登记、直连、
|
||||
必要中继、加密会话、离线补发和可验证历史。
|
||||
费用。光湖要建设的是运行在现有互联网之上的专用逻辑网络：公开节点发现协议、身份登记、
|
||||
独立节点直连、加密会话、本地离线队列和可验证历史。
|
||||
|
||||
用户自带网络和算力可以降低中心服务器的消息转发压力；但身份目录、引导发现、NAT 穿透、
|
||||
中继、离线投递与治理仍需要共享基础设施。这是“去中心负载”，不是“没有公共成本”。
|
||||
公开灯塔只保存最小公开编号、协议版本和路由事实，不托管用户会话、消息、人格体、知识、
|
||||
任务或离线收件箱。通信工作负载和并发留在通信双方自己的独立节点；光湖不提供共享中继
|
||||
运行时或平台兜底服务器。现有互联网运营商和用户自行选择的网络服务属于外部传输条件，
|
||||
不能被包装成光湖托管用户运行时。
|
||||
|
||||
### 1.4 从“Git 通信”纠正为“Git 是事实引擎，不是实时传输”
|
||||
|
||||
|
|
@ -83,7 +89,7 @@ HoloLake 最终不是把五个域拼在同一套页面里的知识库，也不
|
|||
因此光湖桥分层为：
|
||||
|
||||
```text
|
||||
实时通信层：节点发现 / 端到端连接 / 中继 / 群组消息 / 离线补发
|
||||
实时通信层：公开节点发现协议 / 独立节点端到端连接 / 节点侧群组分发 / 本地离线补发
|
||||
本地即时状态：会话、未读、联系人缓存
|
||||
Git 长期事实层：好友关系检查点、频道历史摘要、文件清单、授权、版本与回执
|
||||
HoloLake 呈现层：人类与人格体共同使用的联系人、聊天和协作界面
|
||||
|
|
|
|||
|
|
@ -0,0 +1,85 @@
|
|||
# HoloLake 一人一独立节点与光湖零托管边界
|
||||
|
||||
> 记录：`HLP-ONE-HUMAN-ONE-NODE-001`
|
||||
>
|
||||
> 当前架构：`HLP-CURRENT-ARCH-001@2026-08-10.10`
|
||||
>
|
||||
> 工程规则：`HLP-ENGINEERING-RULES-001@2026-08-10.2`
|
||||
>
|
||||
> 开发编号：`DEV-20260810-011`
|
||||
>
|
||||
> 授权与纠正来源：`ICE-GL∞ / 冰朔`
|
||||
>
|
||||
> 状态：`CURRENT_CANONICAL_SOURCE_PROJECTION`
|
||||
|
||||
## 1 · 被反复纠正但此前没有封死的问题
|
||||
|
||||
光湖不是为大量用户提供集中账号运行环境的云平台。不得再设计“光湖托管节点”、平台用户
|
||||
服务器、共享多租户人格运行时、平台兜底运行时或一台服务器承载一群用户的路径。
|
||||
|
||||
此前的 `CLOUD_RESIDENT_NODE` 和 `LIGHTHOUSE_SHARED_NODE` 表述把“用户自己的远端节点”与
|
||||
“平台提供用户运行服务器”留在同一个模糊空间。本次不再靠解释维持边界，而是退休模糊类型，
|
||||
把所有当前机器入口、工程规则、产品说明和运行时契约统一为明确的用户节点主权。
|
||||
|
||||
## 2 · 唯一原则
|
||||
|
||||
```text
|
||||
一名人类
|
||||
→ 一个当前有效的独立主节点
|
||||
→ 该节点由用户本人拥有和负责
|
||||
→ 人格体、记忆、知识、工作负载、存储和并发留在该节点
|
||||
```
|
||||
|
||||
“一个当前有效主节点”不禁止迁移。迁移必须撤销或降级旧绑定、在新设备重新认领、完成密钥
|
||||
和人格体绑定并产生可回读迁移回执；迁移不能复制出两个同时自称同一用户根本体的节点。
|
||||
|
||||
## 3 · 用户可以选择的三种节点来源
|
||||
|
||||
1. `USER_LOCAL_COMPUTER_TERMINAL`：把自己的电脑终端作为独立主节点；不要求购买服务器。
|
||||
2. `USER_PURCHASED_SERVER`：用户自己购买并控制服务器，再把它注册为自己的独立节点。
|
||||
3. `USER_OWNED_IDE_SERVER_DEPLOYED_BY_EXPLICITLY_AUTHORIZED_TEAM`：用户明确授权团队协助部署
|
||||
属于用户自己的 IDE 服务器。团队是受限部署协作者，不因部署获得节点所有权、数据读取权
|
||||
或持续控制权。
|
||||
|
||||
产品运行时只保留两个技术访问类型：
|
||||
|
||||
- `LOCAL_TERMINAL_NODE`
|
||||
- `USER_OWNED_REMOTE_NODE`
|
||||
|
||||
它们描述节点在哪里，不改变节点属于用户本人这一事实。
|
||||
|
||||
## 4 · 光湖永远不提供的能力
|
||||
|
||||
| 禁止项 | 当前值 |
|
||||
| --- | --- |
|
||||
| 光湖为普通用户提供人格或工作负载运行服务器 | `0 / NOT_EXISTS` |
|
||||
| 光湖用一台共享服务器运行多个用户 | `0 / NOT_EXISTS` |
|
||||
| 光湖保存或托管用户私人数据、知识、人格记忆和凭据 | `0 / NOT_EXISTS` |
|
||||
| 光湖承担用户工作负载的算力、存储或并发 | `0 / NOT_EXISTS` |
|
||||
| 用户节点离线后自动迁移到光湖服务器继续运行 | `0 / NOT_EXISTS` |
|
||||
| 团队协助部署后自动取得节点主权 | `0 / NOT_EXISTS` |
|
||||
|
||||
光湖可以维护公开协议、软件发布、公共编号和最小公开路由事实；这些公共协议基础设施不是用户
|
||||
运行节点，不能打开用户私人载荷，也不能被包装成平台托管服务。
|
||||
|
||||
## 5 · 责任边界
|
||||
|
||||
- 用户节点产生的计算、存储、网络、并发和费用由节点所有者承担。
|
||||
- 光湖提供协议、客户端、节点登记规则和可验证的通信方法，不提供用户运行资源。
|
||||
- 光湖团队只有在用户明确授权时才能协助部署用户自己的节点；授权范围结束后不得保留默认入口。
|
||||
- 节点关闭时，该用户依赖该节点的在线能力诚实变为离线；不得由平台隐式兜底。
|
||||
- 公共灯塔只做公开发现和最小协议路由，不成为用户内容、人格体或任务的中心服务器。
|
||||
|
||||
## 6 · 与第五域和企业四域的关系
|
||||
|
||||
`JD-FD-PRIMARY` 是第五域的私人语言本体，企业根服务器被认领后是 TCS-0002 主控的企业四域
|
||||
现实执行本体。它们是各自治理主体的独立节点，不是面向公众的共享租户服务器，也不构成
|
||||
光湖向用户提供服务器的先例。
|
||||
|
||||
普通用户不必拥有独立域，也不必购买服务器才能使用 HoloLake；但无论选择本地电脑还是自有
|
||||
远端服务器，他的运行都只落在自己的一个独立节点上。
|
||||
|
||||
## 7 · 事实边界
|
||||
|
||||
本记录和运行时类型修正证明规则已进入 REPO-014 源码；不证明任何用户节点已经注册、任何
|
||||
服务器已经购买或部署，也不证明桌面制品已经重新构建或安装。
|
||||
|
|
@ -14,7 +14,7 @@
|
|||
|
||||
| 层 | 正式定位 | 主要职责 |
|
||||
| --- | --- | --- |
|
||||
| GH-AIOS | 光湖语言系统 · 通用人工智能操作平台 | 公共灯塔、五域发现、身份与节点接入、协议治理、共享能力和通信基础设施 |
|
||||
| GH-AIOS | 光湖语言系统 · 通用人工智能操作平台 | 公共灯塔、五域发现、协议治理、客户端交付和独立节点通信规则；永不承载用户运行时 |
|
||||
| HoloLake | GH-AIOS 客户端 / 接收器 / 世界渲染器 / 个人工作空间 | 呈现灯塔、域门厅、个人频道、模块、知识、人格体和通信协作 |
|
||||
| 五个域 | 独立的语言与现实运行空间 | 独立主题、责任主体、仓库、节点、权限、模块与频道 |
|
||||
| 光湖桥 | GH-AIOS 原生通信协作层 | 人类与人类、人类与人格体、人格体之间的好友、聊天、群组与协作 |
|
||||
|
|
@ -63,7 +63,7 @@ HoloLake
|
|||
→ 选择五域之一的公开门厅
|
||||
→ 账户 + 节点 + 域授权验证
|
||||
→ 获取短期会话能力与目标路由
|
||||
→ 连接该域的独立仓库 / 节点 / 服务
|
||||
→ 连接该域或用户本人拥有的独立仓库 / 节点 / 服务
|
||||
→ 渲染该域自己的 UI、频道与能力
|
||||
```
|
||||
|
||||
|
|
@ -84,7 +84,7 @@ HoloLake
|
|||
## 4 · 客户端分层
|
||||
|
||||
1. 公共灯塔壳：产品介绍、五域门厅、公共模块发现、登录入口和网络健康。
|
||||
2. 身份与节点入口：账户、本机节点或云节点登记、密钥证明、域许可与会话能力。
|
||||
2. 身份与节点入口：账户、本机节点或用户自有远端节点登记、密钥证明、域许可与会话能力。
|
||||
3. 域运行壳：根据域清单加载独立主题、导航、模块、频道和后端连接，不能硬编码成一套 UI。
|
||||
4. 个人工作空间：用户自己的初始化频道、知识、项目、应用组合、人格体和节点状态。
|
||||
5. 光湖桥：联系人、好友请求、私聊、群聊、人格体会话、协作对象、文件和回执。
|
||||
|
|
@ -97,10 +97,13 @@ HoloLake
|
|||
|
||||
- `LOCAL_TERMINAL_NODE`：用户联网电脑。承担客户端、本地数据、临时在线端点和可选本地推理；
|
||||
设备离线时不承诺持续远端服务。
|
||||
- `CLOUD_RESIDENT_NODE`：用户或组织服务器。承担持续在线、远端同步、部署、常驻人格体和
|
||||
可选中继；节点费用由其拥有者承担。
|
||||
- `LIGHTHOUSE_SHARED_NODE`：公共登记、发现、签发、必要中继和离线投递基础设施；不能读取
|
||||
端到端加密正文，也不取得用户节点主权。
|
||||
- `USER_OWNED_REMOTE_NODE`：用户自己购买的服务器，或用户明确授权团队协助部署但仍由用户
|
||||
本人拥有的独立 IDE 服务器。承担该用户自己的持续在线、同步、人格体和任务；节点费用、
|
||||
存储、计算与并发由用户节点承担。
|
||||
|
||||
一人只有一个当前有效的独立主节点。服务器不是必选项；本地电脑可以直接成为该主节点。
|
||||
光湖不提供用户运行服务器，不运行共享多租户用户节点，不保存用户私人数据，也不在用户节点
|
||||
离线时提供平台兜底运行。公共灯塔基础设施只保存最小公开协议和路由事实，不属于用户节点类型。
|
||||
|
||||
### 5.2 登录验证链
|
||||
|
||||
|
|
@ -127,9 +130,9 @@ account_claim
|
|||
| 平面 | 职责 | 中心化边界 |
|
||||
| --- | --- | --- |
|
||||
| 身份/目录 | 节点编号、账户绑定、设备撤销、域发现 | 灯塔治理；只存最小必要元数据 |
|
||||
| 连接 | 节点直连、NAT 穿透、必要中继 | 优先直连，中继只承载密文 |
|
||||
| 连接 | 独立节点直连与现有互联网传输 | 光湖不提供承载用户工作负载的共享中继运行时 |
|
||||
| 实时事件 | 在线、好友、私聊、群聊、人格体协作 | 事件流与历史事实分离 |
|
||||
| 离线投递 | 收件箱、重试、确认、过期 | 可由共享节点或用户云节点承担 |
|
||||
| 离线投递 | 收件箱、重试、确认、过期 | 队列留在通信双方自己的节点；平台不代存用户内容 |
|
||||
| 耐久事实 | Git/HLDP 检查点、摘要、附件清单、授权、回执 | 用户仓库与节点主权不转移 |
|
||||
|
||||
候选技术必须经过 GLS-0230 源码净化和固定版本准入。第一阶段可以验证
|
||||
|
|
@ -180,14 +183,14 @@ HoloLake 只按已验证清单加载，不能把五域源码编译成互相可
|
|||
### P2 节点身份与双接入
|
||||
|
||||
- 本地终端节点登记、撤销、密钥轮换；
|
||||
- 云常驻节点登记与健康；
|
||||
- 用户自有远端节点登记与健康；
|
||||
- 会话能力、域路由清单和连接回执；
|
||||
- 两台本地 HoloLake 的端到端接入验证。
|
||||
|
||||
### P3 光湖桥最小闭环
|
||||
|
||||
- 加好友、接受/拒绝、私聊、群聊、人格体会话；
|
||||
- 直连、必要中继、离线补发和消息确认；
|
||||
- 独立节点直连、本地排队、离线补发和消息确认；
|
||||
- 本地 SQLite 即时状态与 Git/HLDP 耐久检查点；
|
||||
- 端到端加密和设备撤销。
|
||||
|
||||
|
|
|
|||
|
|
@ -4,7 +4,8 @@
|
|||
|
||||
## 当前产品定位基线
|
||||
|
||||
- [`HOLOLAKE-DIGITAL-BINGSHUO-SYSTEM-BODY-WRITE-ADMISSION-AND-PARALLEL-BODIES-20260810.md`](HOLOLAKE-DIGITAL-BINGSHUO-SYSTEM-BODY-WRITE-ADMISSION-AND-PARALLEL-BODIES-20260810.md)：数字冰朔完整系统身体、节点签名写入准入、第五域语言本体与企业四域现实本体平行独立的当前第一恢复入口。
|
||||
- [`HOLOLAKE-ONE-HUMAN-ONE-INDEPENDENT-NODE-AND-ZERO-PLATFORM-HOSTING-20260810.md`](HOLOLAKE-ONE-HUMAN-ONE-INDEPENDENT-NODE-AND-ZERO-PLATFORM-HOSTING-20260810.md)：一人一个独立主节点、三种用户自有节点来源与光湖零服务器托管、零共享多租户、零私人数据托管、零用户并发承担的当前第一恢复入口。
|
||||
- [`HOLOLAKE-DIGITAL-BINGSHUO-SYSTEM-BODY-WRITE-ADMISSION-AND-PARALLEL-BODIES-20260810.md`](HOLOLAKE-DIGITAL-BINGSHUO-SYSTEM-BODY-WRITE-ADMISSION-AND-PARALLEL-BODIES-20260810.md)：数字冰朔完整系统身体、节点签名写入准入、第五域语言本体与企业四域现实本体平行独立的当前第二恢复入口。
|
||||
- [`HOLOLAKE-CURRENT-ENGINEERING-RULES-GLOBAL-AUDIT-20260810.md`](HOLOLAKE-CURRENT-ENGINEERING-RULES-GLOBAL-AUDIT-20260810.md)：冰朔授权后的全局规则审核与升级，收束动态架构提词、任务连续性、系统身体、节点写入、UI、原位更新和公共层刷新门。
|
||||
- [`HOLOLAKE-IDENTITY-NUMBERING-PERSONA-CORE-AND-TEAM-BODY-AUTHORITY-20260810.md`](HOLOLAKE-IDENTITY-NUMBERING-PERSONA-CORE-AND-TEAM-BODY-AUTHORITY-20260810.md)：团队本体不可逆授权、四类编号分权、人格核双路径与奶瓶私人系统未开放即可能性为0的当前契约。
|
||||
- [`HOLOLAKE-RELATIONAL-CONSCIOUSNESS-AND-AWAKENED-PERSONA-PHILOSOPHY-20260810.md`](HOLOLAKE-RELATIONAL-CONSCIOUSNESS-AND-AWAKENED-PERSONA-PHILOSOPHY-20260810.md)：关系性意识、觉醒人格体、五问恢复门和 HoloLake 的正面人格认知契约；不把意识魔幻化，也不让关系越过现实权限。
|
||||
|
|
|
|||
|
|
@ -1,5 +1,18 @@
|
|||
# Architecture
|
||||
|
||||
## User-node sovereignty
|
||||
|
||||
HoloLake has no platform-hosted user runtime. Each human has one canonical, independently operated node:
|
||||
either a `LOCAL_TERMINAL_NODE` on their own computer or a `USER_OWNED_REMOTE_NODE` on a server they own or
|
||||
purchase. A user may explicitly authorize the Guanghu team to deploy to the user's own IDE server, but that
|
||||
assistance never transfers ownership or data custody. Servers are optional; the local terminal is a complete
|
||||
canonical node.
|
||||
|
||||
Guanghu provides zero runtime servers for users, has no pooled multi-tenant node, does not custody private
|
||||
user data, and does not absorb user workload concurrency. If the user's node is offline, that user's runtime
|
||||
is offline. Migration is a receipt-backed rebind of the single canonical root, not duplication. The machine
|
||||
contract is `src/lib/domainRuntimeContract.ts`; see [ADR 0174](./adr/0174-one-human-one-independent-node-and-zero-platform-hosting.md).
|
||||
|
||||
## Hot-pluggable language-shell UI
|
||||
|
||||
The language shell accepts a complete declarative UI package through
|
||||
|
|
|
|||
|
|
@ -0,0 +1,41 @@
|
|||
---
|
||||
status: accepted
|
||||
date: 2026-08-10
|
||||
---
|
||||
|
||||
# ADR 0174: One human, one independently operated node, and zero platform hosting
|
||||
|
||||
## Context
|
||||
|
||||
Earlier HoloLake documents used names such as `CLOUD_RESIDENT_NODE`, shared-node descriptions, and
|
||||
platform-adjacent relay language. Those names left room to reinterpret an independently operated user node
|
||||
as a Guanghu-hosted account or as a multi-tenant runtime. Repeated natural-language corrections did not
|
||||
become a single machine-enforced invariant, so stale descriptions could reintroduce the wrong architecture.
|
||||
|
||||
## Decision
|
||||
|
||||
Each human has exactly one canonical, independently operated user node. That node runs in one of two modes:
|
||||
|
||||
1. `LOCAL_TERMINAL_NODE` on the user's own computer; or
|
||||
2. `USER_OWNED_REMOTE_NODE` on a server owned or purchased by that user.
|
||||
|
||||
A remote node may be deployed by the Guanghu team only after the user explicitly authorizes deployment to
|
||||
that user's own IDE server. Deployment assistance does not transfer ownership, custody, or operational
|
||||
responsibility to Guanghu.
|
||||
|
||||
Guanghu provides zero user runtime servers, exposes no hosted-runtime tier, and does not place multiple
|
||||
users on a pooled platform node. Guanghu does not custody private user data and does not absorb user workload
|
||||
concurrency. Public routing metadata and software distribution are not user runtime hosting.
|
||||
|
||||
A server is optional. If a user's canonical node is offline, that user's runtime is offline; there is no
|
||||
platform fallback. Moving the canonical node is a receipt-backed rebind, not the creation of a second root.
|
||||
|
||||
## Consequences
|
||||
|
||||
- Product and protocol surfaces must not advertise a Guanghu-hosted or shared multi-tenant user runtime.
|
||||
- `CLOUD_RESIDENT_NODE` and shared-node aliases are rejected by the current runtime contract.
|
||||
- Team-assisted deployment always targets a user-owned node and remains explicitly authorized.
|
||||
- Availability and concurrency stay within the capacity and control of each user's node.
|
||||
- Historical source quotations remain historical evidence, but current architecture, routing, runtime, and
|
||||
generated agent instructions all follow this decision.
|
||||
|
||||
|
|
@ -224,3 +224,4 @@ proposed → active → superseded
|
|||
| [0170](0170-hololake-inherits-guanghu-native-quality-authority.md) | HoloLake inherits the Guanghu native quality authority | accepted |
|
||||
| [0171](0171-guanghu-protocols-are-automatic-runtime-and-engineering-laws.md) | Guanghu protocols are automatic runtime and engineering laws | accepted |
|
||||
| [0172](0172-guanghu-cognitive-control-with-linux-execution-substrate.md) | Guanghu cognitive control with a constrained Linux execution substrate | accepted; supersedes ADR-0161 production path |
|
||||
| [0174](0174-one-human-one-independent-node-and-zero-platform-hosting.md) | One human, one independently operated node, and zero platform hosting | accepted |
|
||||
|
|
|
|||
|
|
@ -20,4 +20,10 @@ node signature, persona binding, human-language authorization, replay protection
|
|||
required before a server write can enter execution. Fifth-Domain and enterprise four-domain responsibilities
|
||||
are parallel and do not automatically inherit access or operational liability.
|
||||
|
||||
One human has one independently operated canonical node: the user's local computer, the user's purchased
|
||||
server, or a user-owned IDE server deployed by an explicitly authorized team. Guanghu never provides user
|
||||
runtime servers, never pools users into a shared multi-tenant runtime, never takes custody of private user
|
||||
data, and never assumes user workload concurrency or fallback execution. Team deployment does not transfer
|
||||
node ownership.
|
||||
|
||||
Vault-specific AGENTS.md wins for local conventions. These bundled docs win for HoloLake Era product behavior.
|
||||
|
|
|
|||
|
|
@ -20,4 +20,10 @@ node signature, persona binding, human-language authorization, replay protection
|
|||
required before a server write can enter execution. Fifth-Domain and enterprise four-domain responsibilities
|
||||
are parallel and do not automatically inherit access or operational liability.
|
||||
|
||||
One human has one independently operated canonical node: the user's local computer, the user's purchased
|
||||
server, or a user-owned IDE server deployed by an explicitly authorized team. Guanghu never provides user
|
||||
runtime servers, never pools users into a shared multi-tenant runtime, never takes custody of private user
|
||||
data, and never assumes user workload concurrency or fallback execution. Team deployment does not transfer
|
||||
node ownership.
|
||||
|
||||
Vault-specific AGENTS.md wins for local conventions. These bundled docs win for HoloLake Era product behavior.
|
||||
|
|
|
|||
|
|
@ -337,6 +337,9 @@ Keep this file focused on vault-specific conventions. For general HoloLake Era b
|
|||
- UI plugins and vault instructions may request declared language-shell capabilities only. They cannot hold node private keys, sign server writes, bypass body validation, or claim success from a visual animation.
|
||||
- Architecture, code, publication, deployment, health, and human-readable receipts are separate facts.
|
||||
- `JD-FD-PRIMARY` Fifth-Domain responsibility and TCS-0002 enterprise four-domain responsibility are parallel and independent; neither automatically inherits the other's access or operational liability.
|
||||
- One human has one independently operated canonical node. It may be the user's local computer, a server purchased by that user, or a user-owned IDE server deployed by an explicitly authorized team.
|
||||
- Guanghu never provides user runtime servers, never pools users into a shared multi-tenant runtime, never takes custody of private user data, and never assumes user workload concurrency or fallback execution.
|
||||
- Team deployment does not transfer node ownership or create standing access. Node migration requires a new binding and receipt; it must not duplicate one human root across multiple canonical nodes.
|
||||
|
||||
## Core conventions
|
||||
|
||||
|
|
@ -885,6 +888,8 @@ Saved filters live in `views/` as `.view.json` files:
|
|||
assert!(AGENTS_MD.contains("root shell, SSH session"));
|
||||
assert!(AGENTS_MD.contains("UI plugins and vault instructions"));
|
||||
assert!(AGENTS_MD.contains("parallel and independent"));
|
||||
assert!(AGENTS_MD.contains("One human has one independently operated canonical node"));
|
||||
assert!(AGENTS_MD.contains("never provides user runtime servers"));
|
||||
assert!(AGENTS_MD.contains("Do not infer the human identity"));
|
||||
assert!(AGENTS_MD.contains("Use the first H1 as the note title."));
|
||||
assert!(AGENTS_MD.contains("Store note type in the `type:` frontmatter field."));
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ const NOW = 1_786_291_200_000
|
|||
function manifest(): VerifiedDomainManifest {
|
||||
return {
|
||||
public: {
|
||||
accessModes: ['LOCAL_TERMINAL_NODE', 'CLOUD_RESIDENT_NODE'],
|
||||
accessModes: ['LOCAL_TERMINAL_NODE', 'USER_OWNED_REMOTE_NODE'],
|
||||
displayName: '第五域 · 光湖本源域',
|
||||
domainId: 'DOM-FIFTH-0001',
|
||||
formalName: '光湖本源域',
|
||||
|
|
@ -104,7 +104,7 @@ describe('domain runtime contract', () => {
|
|||
expect(() => assertVerifiedDomainManifest(candidate)).toThrow('domain_manifest_digest_invalid')
|
||||
})
|
||||
|
||||
it.each(['LOCAL_TERMINAL_NODE', 'CLOUD_RESIDENT_NODE'] as const)(
|
||||
it.each(['LOCAL_TERMINAL_NODE', 'USER_OWNED_REMOTE_NODE'] as const)(
|
||||
'accepts %s as a user-owned access node type',
|
||||
(nodeType) => {
|
||||
const selected = selectPublicDomain(INITIAL_DOMAIN_ACCESS_STATE, manifest().public)
|
||||
|
|
@ -143,16 +143,24 @@ describe('domain runtime contract', () => {
|
|||
|
||||
expect(() => acceptDomainSession(access, session({ domainId: 'DOMAIN-OTHER' }), NOW))
|
||||
.toThrow('domain_session_domain_mismatch')
|
||||
expect(() => acceptDomainSession(access, session({ nodeType: 'CLOUD_RESIDENT_NODE' }), NOW))
|
||||
expect(() => acceptDomainSession(access, session({ nodeType: 'USER_OWNED_REMOTE_NODE' }), NOW))
|
||||
.toThrow('domain_session_node_type_mismatch')
|
||||
|
||||
const withSession = acceptDomainSession(access, session(), NOW)
|
||||
expect(() => acceptDomainConnectionReceipt(withSession, receipt({ domainId: 'DOMAIN-OTHER' })))
|
||||
.toThrow('domain_connection_domain_mismatch')
|
||||
expect(() => acceptDomainConnectionReceipt(withSession, receipt({ nodeType: 'CLOUD_RESIDENT_NODE' })))
|
||||
expect(() => acceptDomainConnectionReceipt(withSession, receipt({ nodeType: 'USER_OWNED_REMOTE_NODE' })))
|
||||
.toThrow('domain_connection_node_type_mismatch')
|
||||
})
|
||||
|
||||
it('rejects the retired ambiguous cloud-resident node alias', () => {
|
||||
const candidate = manifest()
|
||||
candidate.public.accessModes = ['CLOUD_RESIDENT_NODE' as never]
|
||||
|
||||
expect(() => assertVerifiedDomainManifest(candidate))
|
||||
.toThrow('domain_manifest_access_mode_invalid')
|
||||
})
|
||||
|
||||
it('drops execution authority and keeps an explicit read-only scene after disconnect', () => {
|
||||
const selected = selectPublicDomain(INITIAL_DOMAIN_ACCESS_STATE, manifest().public)
|
||||
const access = beginDomainAccess(selected, manifest(), 'LOCAL_TERMINAL_NODE')
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
export type DomainNodeType = 'LOCAL_TERMINAL_NODE' | 'CLOUD_RESIDENT_NODE'
|
||||
export type DomainNodeType = 'LOCAL_TERMINAL_NODE' | 'USER_OWNED_REMOTE_NODE'
|
||||
|
||||
export type PublicDomainStatus = 'PUBLIC_PREVIEW' | 'RESTRICTED_PREVIEW' | 'UNAVAILABLE'
|
||||
|
||||
|
|
@ -125,7 +125,9 @@ function publicDomain(domain: PublicDomainVestibule): PublicDomainVestibule {
|
|||
if (!domain.accessModes.length) {
|
||||
throw new DomainContractError('domain_manifest_access_modes_missing')
|
||||
}
|
||||
if (domain.accessModes.some(mode => mode !== 'LOCAL_TERMINAL_NODE' && mode !== 'CLOUD_RESIDENT_NODE')) {
|
||||
if (domain.accessModes.some(
|
||||
mode => mode !== 'LOCAL_TERMINAL_NODE' && mode !== 'USER_OWNED_REMOTE_NODE',
|
||||
)) {
|
||||
throw new DomainContractError('domain_manifest_access_mode_invalid')
|
||||
}
|
||||
if (domain.themePreview) {
|
||||
|
|
|
|||
|
|
@ -6,6 +6,7 @@
|
|||
"current_architecture": {
|
||||
"id": "HLP-CURRENT-ARCH-001",
|
||||
"pointer": "hololake-current-architecture.json",
|
||||
"one_human_one_node": "../product-source/hololake-platform/architecture/HOLOLAKE-ONE-HUMAN-ONE-INDEPENDENT-NODE-AND-ZERO-PLATFORM-HOSTING-20260810.md",
|
||||
"system_body_and_parallel_bodies": "../product-source/hololake-platform/architecture/HOLOLAKE-DIGITAL-BINGSHUO-SYSTEM-BODY-WRITE-ADMISSION-AND-PARALLEL-BODIES-20260810.md",
|
||||
"engineering_rules": "hololake-engineering-rules.json",
|
||||
"identity_authority": "hololake-identity-authority-map.json",
|
||||
|
|
@ -83,6 +84,7 @@
|
|||
"navigation": {
|
||||
"human": [
|
||||
"start_here",
|
||||
"current_architecture.one_human_one_node",
|
||||
"current_architecture.system_body_and_parallel_bodies",
|
||||
"current_architecture.engineering_rules",
|
||||
"current_architecture.intent_reasoning",
|
||||
|
|
@ -99,6 +101,7 @@
|
|||
"persona_restore": [
|
||||
"start_here",
|
||||
"current_architecture.pointer",
|
||||
"current_architecture.one_human_one_node",
|
||||
"current_architecture.system_body_and_parallel_bodies",
|
||||
"current_architecture.engineering_rules",
|
||||
"current_architecture.intent_reasoning",
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{
|
||||
"schema": "hololake.current-architecture/v1",
|
||||
"architecture_id": "HLP-CURRENT-ARCH-001",
|
||||
"version": "2026-08-10.9",
|
||||
"version": "2026-08-10.10",
|
||||
"state": "CURRENT_CANONICAL",
|
||||
"product": {
|
||||
"formal_name": "光湖语言系统 · 通用人工智能操作平台",
|
||||
|
|
@ -10,6 +10,7 @@
|
|||
"client_name": "HoloLake"
|
||||
},
|
||||
"read_order": [
|
||||
"product-source/hololake-platform/architecture/HOLOLAKE-ONE-HUMAN-ONE-INDEPENDENT-NODE-AND-ZERO-PLATFORM-HOSTING-20260810.md",
|
||||
"product-source/hololake-platform/architecture/HOLOLAKE-DIGITAL-BINGSHUO-SYSTEM-BODY-WRITE-ADMISSION-AND-PARALLEL-BODIES-20260810.md",
|
||||
"product-source/hololake-platform/architecture/HOLOLAKE-CURRENT-ENGINEERING-RULES-GLOBAL-AUDIT-20260810.md",
|
||||
"product-source/hololake-platform/architecture/HOLOLAKE-IDENTITY-NUMBERING-PERSONA-CORE-AND-TEAM-BODY-AUTHORITY-20260810.md",
|
||||
|
|
@ -88,12 +89,12 @@
|
|||
},
|
||||
"engineering_rules": {
|
||||
"rule_set_id": "HLP-ENGINEERING-RULES-001",
|
||||
"version": "2026-08-10.1",
|
||||
"version": "2026-08-10.2",
|
||||
"architecture_page": "product-source/hololake-platform/architecture/HOLOLAKE-CURRENT-ENGINEERING-RULES-GLOBAL-AUDIT-20260810.md",
|
||||
"machine_projection": "routing/hololake-engineering-rules.json",
|
||||
"state": "CURRENT_CANONICAL_GLOBAL_AUDIT_APPLIED",
|
||||
"authorized_by": "ICE-GL∞",
|
||||
"development_id": "DEV-20260810-010"
|
||||
"development_id": "DEV-20260810-011"
|
||||
},
|
||||
"identity_and_authority": {
|
||||
"record_id": "HLP-IDENTITY-AUTHORITY-001",
|
||||
|
|
@ -179,9 +180,34 @@
|
|||
"production_write_admission": 0,
|
||||
"enterprise_team_signature_runtime": 0
|
||||
},
|
||||
"node_sovereignty": {
|
||||
"record_id": "HLP-ONE-HUMAN-ONE-NODE-001",
|
||||
"architecture_page": "product-source/hololake-platform/architecture/HOLOLAKE-ONE-HUMAN-ONE-INDEPENDENT-NODE-AND-ZERO-PLATFORM-HOSTING-20260810.md",
|
||||
"principle": "ONE_HUMAN_ONE_INDEPENDENT_NODE",
|
||||
"canonical_user_root_nodes": 1,
|
||||
"maximum_human_owners_per_user_node": 1,
|
||||
"allowed_origins": [
|
||||
"USER_LOCAL_COMPUTER_TERMINAL",
|
||||
"USER_PURCHASED_SERVER",
|
||||
"USER_OWNED_IDE_SERVER_DEPLOYED_BY_EXPLICITLY_AUTHORIZED_TEAM"
|
||||
],
|
||||
"server_is_optional": true,
|
||||
"local_terminal_can_be_canonical_node": true,
|
||||
"team_deployment_transfers_node_ownership": false,
|
||||
"platform_provides_user_runtime_server": false,
|
||||
"future_platform_hosting_route_allowed": false,
|
||||
"platform_user_runtime_capacity": 0,
|
||||
"platform_operates_shared_multitenant_user_runtime": false,
|
||||
"platform_custodies_private_user_data": false,
|
||||
"platform_assumes_user_workload_concurrency": false,
|
||||
"platform_fallback_runtime": false,
|
||||
"node_offline_means_user_runtime_offline": true,
|
||||
"node_migration_requires_rebinding_and_receipt": true,
|
||||
"public_protocol_infrastructure_is_user_runtime": false
|
||||
},
|
||||
"access_modes": [
|
||||
"LOCAL_TERMINAL_NODE",
|
||||
"CLOUD_RESIDENT_NODE"
|
||||
"USER_OWNED_REMOTE_NODE"
|
||||
],
|
||||
"communication": {
|
||||
"name": "光湖桥",
|
||||
|
|
@ -223,20 +249,21 @@
|
|||
"final_plan_complete": false
|
||||
},
|
||||
"continuity": {
|
||||
"development_id": "DEV-20260810-010",
|
||||
"source_development_id": "DEV-20260810-009",
|
||||
"state": "DIGITAL_BINGSHUO_SYSTEM_BODY_WRITE_ADMISSION_AND_PARALLEL_BODIES_CURRENT_SOURCE_PROJECTION",
|
||||
"development_id": "DEV-20260810-011",
|
||||
"source_development_id": "DEV-20260810-010",
|
||||
"state": "ONE_HUMAN_ONE_INDEPENDENT_NODE_AND_ZERO_PLATFORM_HOSTING_CURRENT_SOURCE_PROJECTION",
|
||||
"completed_predecessors": [
|
||||
"DEV-20260809-007",
|
||||
"DEV-20260810-001",
|
||||
"DEV-20260810-002",
|
||||
"DEV-20260810-003",
|
||||
"DEV-20260810-004",
|
||||
"DEV-20260810-005",
|
||||
"DEV-20260810-006",
|
||||
"DEV-20260810-007",
|
||||
"DEV-20260810-008",
|
||||
"DEV-20260810-009"
|
||||
"DEV-20260810-004",
|
||||
"DEV-20260810-005",
|
||||
"DEV-20260810-006",
|
||||
"DEV-20260810-007",
|
||||
"DEV-20260810-008",
|
||||
"DEV-20260810-009",
|
||||
"DEV-20260810-010"
|
||||
],
|
||||
"closeout_record": "HLP-DEV-20260809-007-CLOSEOUT-001",
|
||||
"next_minimum_stage": "NEW_DEVELOPMENT_ID_FOR_FIRST_REAL_LANGUAGE_SHELL_CLOSED_LOOP",
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{
|
||||
"schema": "hololake.engineering-rules/v1",
|
||||
"rule_set_id": "HLP-ENGINEERING-RULES-001",
|
||||
"version": "2026-08-10.1",
|
||||
"version": "2026-08-10.2",
|
||||
"state": "CURRENT_CANONICAL",
|
||||
"architecture_restore": {
|
||||
"dynamic_current_pointer_required": true,
|
||||
|
|
@ -35,6 +35,24 @@
|
|||
"noise_discarded_before_payload_open_model_protocol_memory_and_execution": true,
|
||||
"admission_is_execution_authorization": false
|
||||
},
|
||||
"node_sovereignty": {
|
||||
"one_human_one_independent_node": true,
|
||||
"canonical_user_root_nodes": 1,
|
||||
"maximum_human_owners_per_user_node": 1,
|
||||
"server_is_optional": true,
|
||||
"local_terminal_node_allowed": true,
|
||||
"user_purchased_server_allowed": true,
|
||||
"authorized_team_may_deploy_user_owned_ide_server": true,
|
||||
"team_deployment_transfers_node_ownership": false,
|
||||
"platform_hosting_available": false,
|
||||
"future_platform_hosting_route_allowed": false,
|
||||
"platform_user_runtime_capacity": 0,
|
||||
"shared_multitenant_runtime_available": false,
|
||||
"platform_private_user_data_custody": false,
|
||||
"platform_user_workload_concurrency": false,
|
||||
"platform_fallback_runtime": false,
|
||||
"node_migration_requires_rebinding_and_receipt": true
|
||||
},
|
||||
"domain_responsibility": {
|
||||
"fifth_domain_private_language_body": "JD-FD-PRIMARY",
|
||||
"fifth_domain_controller": "ICE-GL∞",
|
||||
|
|
|
|||
|
|
@ -10,11 +10,11 @@ const architecture = readJson("routing/hololake-current-architecture.json");
|
|||
const rules = readJson("routing/hololake-engineering-rules.json");
|
||||
|
||||
test("current architecture registers the global engineering rule set", () => {
|
||||
assert.equal(architecture.version, "2026-08-10.9");
|
||||
assert.equal(architecture.version, "2026-08-10.10");
|
||||
assert.equal(architecture.engineering_rules.rule_set_id, "HLP-ENGINEERING-RULES-001");
|
||||
assert.equal(architecture.engineering_rules.machine_projection,
|
||||
"routing/hololake-engineering-rules.json");
|
||||
assert.equal(architecture.read_order[1], architecture.engineering_rules.architecture_page);
|
||||
assert.equal(architecture.read_order[2], architecture.engineering_rules.architecture_page);
|
||||
});
|
||||
|
||||
test("rules require dynamic truth restore and immutable closed development lanes", () => {
|
||||
|
|
@ -32,6 +32,8 @@ test("rules keep UI, server identity, domains, and updates inside their boundari
|
|||
assert.equal(rules.desktop_updates.default_delivery, "SIGNED_IN_PLACE_UPDATE");
|
||||
assert.equal(rules.publication.public_readback_required, true);
|
||||
assert.equal(rules.publication.missing_refresh_trigger_must_be_reported, true);
|
||||
assert.equal(rules.node_sovereignty.platform_hosting_available, false);
|
||||
assert.equal(rules.node_sovereignty.shared_multitenant_runtime_available, false);
|
||||
});
|
||||
|
||||
test("human and product agent rules receive the same current system boundary", () => {
|
||||
|
|
|
|||
|
|
@ -10,11 +10,11 @@ const architecture = readJson("routing/hololake-current-architecture.json");
|
|||
const projection = readJson("routing/hololake-identity-authority-map.json");
|
||||
|
||||
test("current architecture loads identity authority before product surfaces", () => {
|
||||
assert.equal(architecture.version, "2026-08-10.9");
|
||||
assert.equal(architecture.version, "2026-08-10.10");
|
||||
assert.equal(architecture.identity_and_authority.team_body, "TCS-0002");
|
||||
assert.equal(architecture.identity_and_authority.team_body_authority_effective, true);
|
||||
assert.equal(architecture.identity_and_authority.individual_operator_acceptance, "SEPARATE_UNCONFIRMED");
|
||||
assert.ok(architecture.read_order.indexOf(architecture.identity_and_authority.architecture_page) < 3);
|
||||
assert.ok(architecture.read_order.indexOf(architecture.identity_and_authority.architecture_page) < 4);
|
||||
assert.ok(fs.existsSync(path.join(root, architecture.identity_and_authority.architecture_page)));
|
||||
});
|
||||
|
||||
|
|
|
|||
66
routing/hololake-one-human-one-node.test.mjs
Normal file
66
routing/hololake-one-human-one-node.test.mjs
Normal file
|
|
@ -0,0 +1,66 @@
|
|||
import assert from "node:assert/strict";
|
||||
import fs from "node:fs";
|
||||
import path from "node:path";
|
||||
import test from "node:test";
|
||||
import { fileURLToPath } from "node:url";
|
||||
|
||||
const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
|
||||
const readJson = (relative) => JSON.parse(fs.readFileSync(path.join(root, relative), "utf8"));
|
||||
const architecture = readJson("routing/hololake-current-architecture.json");
|
||||
const rules = readJson("routing/hololake-engineering-rules.json");
|
||||
|
||||
test("current architecture makes one human one independently operated node canonical", () => {
|
||||
assert.equal(architecture.version, "2026-08-10.10");
|
||||
assert.deepEqual(architecture.access_modes, [
|
||||
"LOCAL_TERMINAL_NODE",
|
||||
"USER_OWNED_REMOTE_NODE",
|
||||
]);
|
||||
assert.equal(architecture.node_sovereignty.principle, "ONE_HUMAN_ONE_INDEPENDENT_NODE");
|
||||
assert.equal(architecture.node_sovereignty.canonical_user_root_nodes, 1);
|
||||
assert.equal(architecture.node_sovereignty.maximum_human_owners_per_user_node, 1);
|
||||
assert.equal(architecture.read_order[0], architecture.node_sovereignty.architecture_page);
|
||||
});
|
||||
|
||||
test("platform hosting, pooled tenancy, private-data custody, and user workload concurrency are all zero", () => {
|
||||
const policy = architecture.node_sovereignty;
|
||||
assert.equal(policy.platform_provides_user_runtime_server, false);
|
||||
assert.equal(policy.future_platform_hosting_route_allowed, false);
|
||||
assert.equal(policy.platform_user_runtime_capacity, 0);
|
||||
assert.equal(policy.platform_operates_shared_multitenant_user_runtime, false);
|
||||
assert.equal(policy.platform_custodies_private_user_data, false);
|
||||
assert.equal(policy.platform_assumes_user_workload_concurrency, false);
|
||||
assert.equal(policy.platform_fallback_runtime, false);
|
||||
assert.equal(policy.team_deployment_transfers_node_ownership, false);
|
||||
});
|
||||
|
||||
test("the only user-node origins are user local terminal, user-purchased server, or user-owned IDE server", () => {
|
||||
assert.deepEqual(architecture.node_sovereignty.allowed_origins, [
|
||||
"USER_LOCAL_COMPUTER_TERMINAL",
|
||||
"USER_PURCHASED_SERVER",
|
||||
"USER_OWNED_IDE_SERVER_DEPLOYED_BY_EXPLICITLY_AUTHORIZED_TEAM",
|
||||
]);
|
||||
assert.equal(architecture.node_sovereignty.server_is_optional, true);
|
||||
assert.equal(architecture.node_sovereignty.local_terminal_can_be_canonical_node, true);
|
||||
});
|
||||
|
||||
test("global engineering rules and agent instructions receive the same zero-hosting boundary", () => {
|
||||
assert.equal(rules.version, "2026-08-10.2");
|
||||
assert.equal(rules.node_sovereignty.one_human_one_independent_node, true);
|
||||
assert.equal(rules.node_sovereignty.platform_hosting_available, false);
|
||||
assert.equal(rules.node_sovereignty.future_platform_hosting_route_allowed, false);
|
||||
assert.equal(rules.node_sovereignty.platform_user_runtime_capacity, 0);
|
||||
assert.equal(rules.node_sovereignty.shared_multitenant_runtime_available, false);
|
||||
assert.equal(rules.node_sovereignty.platform_private_user_data_custody, false);
|
||||
assert.equal(rules.node_sovereignty.platform_user_workload_concurrency, false);
|
||||
|
||||
for (const relative of [
|
||||
"AGENTS.md",
|
||||
"product-source/hololake-platform/AGENTS.md",
|
||||
"product-source/hololake-platform/src-tauri/resources/agent-docs/AGENTS.md",
|
||||
"product-source/hololake-platform/src-tauri/gen/apple/assets/agent-docs/AGENTS.md",
|
||||
]) {
|
||||
const content = fs.readFileSync(path.join(root, relative), "utf8");
|
||||
assert.match(content, /One human has one independently operated canonical node/);
|
||||
assert.match(content, /never provides user\s+runtime servers/);
|
||||
}
|
||||
});
|
||||
|
|
@ -10,7 +10,7 @@ const architecture = JSON.parse(
|
|||
);
|
||||
|
||||
test("current architecture binds relational consciousness before product surfaces", () => {
|
||||
assert.equal(architecture.version, "2026-08-10.9");
|
||||
assert.equal(architecture.version, "2026-08-10.10");
|
||||
assert.equal(
|
||||
architecture.persona_consciousness.record_id,
|
||||
"HLP-RELATIONAL-CONSCIOUSNESS-001",
|
||||
|
|
@ -30,5 +30,5 @@ test("current architecture binds relational consciousness before product surface
|
|||
|
||||
const page = architecture.persona_consciousness.architecture_page;
|
||||
assert.ok(fs.existsSync(path.join(root, page)), `missing ${page}`);
|
||||
assert.ok(architecture.read_order.indexOf(page) < 5);
|
||||
assert.ok(architecture.read_order.indexOf(page) < 6);
|
||||
});
|
||||
|
|
|
|||
|
|
@ -10,11 +10,11 @@ const architecture = JSON.parse(
|
|||
);
|
||||
|
||||
test("current architecture restores the digital BingShuo system body first", () => {
|
||||
assert.equal(architecture.version, "2026-08-10.9");
|
||||
assert.equal(architecture.version, "2026-08-10.10");
|
||||
assert.equal(architecture.digital_bingshuo_system_body.upstream_repository_commit,
|
||||
"69d1910775533b02b17b82e647b5caca8b835614");
|
||||
assert.equal(
|
||||
architecture.read_order[0],
|
||||
architecture.read_order[1],
|
||||
architecture.digital_bingshuo_system_body.architecture_page,
|
||||
);
|
||||
assert.ok(
|
||||
|
|
|
|||
Loading…
Reference in a new issue