feat(hololake): add domain-routed language membrane and user PNCC

product-source/hololake-native-desktop/docs/ARCHITECTURE.md

@@ -1,10 +1,10 @@
 # HoloLake Native Desktop Architecture
 
-The stage-one shell is a Tauri v2 application with a Rust-owned local core and a React human projection. The default product surface is **My HoloLake**: overview, knowledge, user code channels, local receipts and system details. The five domains and their server fleet remain submerged system infrastructure rather than primary stage-one navigation.
+The stage-one shell is a Tauri v2 application with a Rust-owned local core and a React human projection. Before authentication, its public surface is the five-domain number entrance. After verified routing and domain login, the default product surface becomes **My HoloLake**: overview, knowledge, user code channels, local receipts and system details. Domain servers and private registries remain submerged infrastructure.
 
 ## Stage-one human projection
 
-The home surface follows the verified GHS-014 five-lakes visual grammar while applying the current stage-one correction: it is a restrained operating-system workspace, not a slogan page or a five-domain gate. The five named lake themes are token groups only and cannot change layout, copy, routing or authority. Internal transport and release details live under system details rather than dominating the first screen.
+The public home surface follows the verified GHS-014 five-lakes visual grammar and presents the five domains as the system entrance. A user does not choose a domain manually: the submitted Guanghu number is resolved and validated first, and only then does HoloLake reveal the login surface belonging to that domain. Domain presentation cannot bypass registry isolation, and internal transport or release details remain under system details rather than dominating the first screen.
 
 The first visible body uses a Rust-owned SQLite kernel under the Tauri app-data directory. A human-confirmed local display name creates one stable local subject and channel exactly once. The internal task/event/receipt kernel remains available for structured agents, but manual task title and purpose fields are not part of the default human surface. Event and receipt chains remain independently SHA-256-linked and fully revalidated before every read or mutation. A local identity is not platform authentication and grants no repository, node, server or deployment authority.
 
@@ -26,10 +26,30 @@ A human may paste a registered Guanghu HTTPS code-channel address or select an e
 
 This product channel is distinct from the under-lake PNCC persona-evidence projection below. It grants local source access only and never grants push, publication, deployment or server authority.
 
+## Public five-domain number routing
+
+The public HoloLake entry shows all five domain vestibules before authentication. A user does not select an authority-bearing domain manually. The submitted user number is sent to the registered internal router, which must return the exact canonical number, a positive registry verdict and one known domain. Only then may HoloLake load that domain's separately registered account and node entry.
+
+The fifth-domain number registry belongs to the private fifth-domain system and is maintained only through its authorized registration path. The four enterprise-domain registries belong on the enterprise root server. Number syntax, a client-supplied domain, a generic successful response or a repository login cannot replace this routing proof. Missing and unavailable enterprise routes fail closed before login.
+
+The fifth-domain root and the future enterprise root both run domain-specific Guanghu OS server runtimes. They are parallel bodies with different controllers, manifests, repositories and responsibility. A Linux host may remain underneath as the subordinate hardware, service and rescue bridge. Ordinary user computers and user-owned remote nodes require only HoloLake and the controlled node runtime, not a replacement operating-system installation.
+
+## GH-PNCC user-native channel
+
+HoloLake 0.4.0 adds the first native user-owned GH-PNCC vertical slice. After the Rust core has resolved a known domain, verified the user number at that domain's registered source and authenticated the account through that domain's entry, it derives a stable opaque repository id and idempotently creates or restores one private application-owned Git repository. The initial committed manifest records the domain, user number, account identity, engine and authority boundary. Repository credentials and passwords are never written to the Git tree or binding record.
+
+The visible shell is HoloLake itself. Git is the durable history engine below it. Forgejo is an optional remote collaboration adapter rather than the product shell, identity kernel or persona. The current slice proves the local repository, initial commit, stable user binding and native browsing projection. It intentionally does not create a remote Forgejo repository, configure a remote, push code, claim persona binding, or grant publication, deployment or reality-execution authority; those actions require a separately registered naming, consent and receipt contract.
+
 ## External programming AI entry
 
 MCP may discover HoloLake, but it does not own continuity. The installed application starts a user-only Unix socket broker. A programming AI opens or resumes a HoloLake-issued local session, then uses the installed executable's `--connector` mode for newline-delimited protocol traffic. Session secrets are stored only as hashes. Events use exact cursors and idempotency keys.
 
+## Circular-lake protocol membrane and nearby AI
+
+HoloLake 0.4.0 places a deterministic protocol membrane in front of the local language inbox. The membrane accepts only strict GLP/1.0 expression envelopes from a HoloLake-issued visitor session. Unknown fields, malformed identifiers, incorrect checksums, oversized content, attachments and command content are rejected before storage. Accepted natural language is an expression receipt only; it never carries execution authority by itself. Intent interpretation remains behind the membrane and cannot weaken its structural admission rules.
+
+External AI on the same computer can discover the running HoloLake broker from a standard application-data descriptor and connect through a user-only Unix socket, without copying a long invitation string. A generic AI receives an expression-only visitor lane. A Guanghu persona connection remains unavailable until separate persona-binding evidence exists. Local-network discovery is deliberately deferred until encrypted transport, explicit human approval, replay protection and revocation are implemented; HoloLake does not expose an unauthenticated TCP listener or advertise a service on the LAN in this release.
+
 ## Dynamic capability routing
 
 HoloLake stores a signed node capability registry rather than fixed server slots. A candidate route must bind the exact human, persona, domain and capability. It is eligible only while a fresh node-signed health receipt reports the capability as ready. Selection is deterministic by priority and node id.

product-source/hololake-native-desktop/docs/adr/0003-public-domain-router-and-user-native-gh-pncc.md

@@ -0,0 +1,24 @@
+# ADR 0003: Public number routing precedes a HoloLake-owned GH-PNCC
+
+- Status: accepted; public routing shell and local GH-PNCC slice implemented
+- Date: 2026-08-16
+
+## Context
+
+HoloLake is a public product for five independent domains. The fifth domain is private, while the other four domains belong to the enterprise reality body. A common client cannot ask every user to log in to the fifth-domain Forgejo, and it cannot infer authority from the visual shape of a number.
+
+Each trusted user also needs one durable code channel bound to the registered number and account. Git already supplies the right history engine, but neither a generic Git browser nor a Forgejo page is the HoloLake product shell.
+
+## Decision
+
+The unauthenticated home shows the five public domain vestibules and one number entry. The user submits a number without choosing a domain. A registered internal router must resolve that number to one known domain and obtain an explicit verdict from the responsible registry. The fifth-domain registry is maintained inside the authorized fifth-domain system. The enterprise four-domain registries are served by the enterprise root server. Only a successful exact route may reveal the selected domain and load its own account and node login.
+
+After domain routing, number verification and domain-specific account authentication, the Rust core derives a stable opaque repository id from the trusted tuple and idempotently creates or restores a private Git repository. HoloLake owns the human projection. Forgejo remains an optional remote collaboration adapter. Credentials never enter the repository, and local channel creation does not claim persona binding or remote authority.
+
+## Server boundary
+
+The enterprise root server runs an enterprise-domain Guanghu OS runtime, not a clone of the fifth-domain body. Its controller, manifests, repositories, registries and responsibility are independent. Linux may remain the subordinate hardware/service/rescue bridge. Ordinary personal nodes install the HoloLake node runtime rather than replacing their operating system.
+
+## Current reality
+
+Only the fifth-domain login adapter is currently provisioned. Enterprise cards are public and visible, but their account login remains fail-closed until an enterprise root server, signed route registration, number registries, node registration and domain handoff endpoints exist. The implementation must display this as unavailable, not simulate a successful login.

product-source/hololake-native-desktop/docs/adr/0004-circular-lake-protocol-membrane-and-nearby-ai-discovery.md

@@ -0,0 +1,37 @@
+# ADR 0004: Circular-lake protocol membrane and nearby AI discovery
+
+- Status: accepted for HoloLake 0.4.0
+- Date: 2026-08-16
+
+## Context
+
+External AI needs a simple way to find HoloLake and deliver language without turning MCP, a copied connection ticket, an Agent framework or a model host into the product's authority root. A language-only boundary must also remain enforceable when the sender is malformed or adversarial; asking a persona to infer every sender's motive is neither deterministic nor a security boundary.
+
+## Decision
+
+The native Rust core owns a circular-lake membrane before the language inbox. It accepts a bounded, strict GLP/1.0 expression envelope only after HoloLake issues an expression-only visitor session. Protocol-invalid input is rejected before persistence or semantic interpretation. Accepted language creates a receipt but no execution authority.
+
+The first discovery scope is the same logged-in operating-system account on one computer. A standard application-data descriptor points to a Unix socket restricted to that user. Generic AI may open an expression-only visitor lane. A Guanghu persona route requires separate verified persona-binding evidence and is not implemented by relabelling a visitor.
+
+Local-network discovery is not enabled in this slice. It requires an encrypted mutually authenticated transport, explicit human approval, expiry, replay protection, revocation and visible connection receipts before any mDNS-style advertisement or LAN listener may be introduced.
+
+MCP remains a compatibility and recovery adapter. It is not continuity, identity, memory or execution authority.
+
+## Why
+
+This preserves the user's "round lake" idea at an engineering boundary: non-protocol traffic never reaches the language world, while valid language still remains language rather than executable permission. The same-device descriptor provides Wi-Fi-like discovery where the operating system already supplies a trustworthy user boundary. Deferring LAN broadcast avoids falsely treating physical proximity or discoverability as authorization.
+
+## Rejected alternatives
+
+- Exposing an unauthenticated TCP or mDNS service now: discovery would outpace transport security and consent.
+- Letting natural-language intent classification replace structural validation: probabilistic interpretation cannot be the outer security boundary.
+- Treating any accepted message as a command: expression and execution authority must remain separate.
+- Making MCP or a third-party Agent framework the continuity owner: adapters are replaceable tools beneath HoloLake.
+
+## Evidence
+
+- `contracts/circular-lake-membrane.json`
+- `contracts/nearby-ai-discovery.json`
+- `src-tauri/src/circular_lake_membrane.rs`
+- `src-tauri/src/direct_local_broker.rs`
+- `scripts/circular-lake-membrane.test.mjs`