feat(hololake): add domain-routed language membrane and user PNCC

product-source/hololake-native-desktop/docs/adr/0003-public-domain-router-and-user-native-gh-pncc.md

@@ -0,0 +1,24 @@
+# ADR 0003: Public number routing precedes a HoloLake-owned GH-PNCC
+
+- Status: accepted; public routing shell and local GH-PNCC slice implemented
+- Date: 2026-08-16
+
+## Context
+
+HoloLake is a public product for five independent domains. The fifth domain is private, while the other four domains belong to the enterprise reality body. A common client cannot ask every user to log in to the fifth-domain Forgejo, and it cannot infer authority from the visual shape of a number.
+
+Each trusted user also needs one durable code channel bound to the registered number and account. Git already supplies the right history engine, but neither a generic Git browser nor a Forgejo page is the HoloLake product shell.
+
+## Decision
+
+The unauthenticated home shows the five public domain vestibules and one number entry. The user submits a number without choosing a domain. A registered internal router must resolve that number to one known domain and obtain an explicit verdict from the responsible registry. The fifth-domain registry is maintained inside the authorized fifth-domain system. The enterprise four-domain registries are served by the enterprise root server. Only a successful exact route may reveal the selected domain and load its own account and node login.
+
+After domain routing, number verification and domain-specific account authentication, the Rust core derives a stable opaque repository id from the trusted tuple and idempotently creates or restores a private Git repository. HoloLake owns the human projection. Forgejo remains an optional remote collaboration adapter. Credentials never enter the repository, and local channel creation does not claim persona binding or remote authority.
+
+## Server boundary
+
+The enterprise root server runs an enterprise-domain Guanghu OS runtime, not a clone of the fifth-domain body. Its controller, manifests, repositories, registries and responsibility are independent. Linux may remain the subordinate hardware/service/rescue bridge. Ordinary personal nodes install the HoloLake node runtime rather than replacing their operating system.
+
+## Current reality
+
+Only the fifth-domain login adapter is currently provisioned. Enterprise cards are public and visible, but their account login remains fail-closed until an enterprise root server, signed route registration, number registries, node registration and domain handoff endpoints exist. The implementation must display this as unavailable, not simulate a successful login.

product-source/hololake-native-desktop/docs/adr/0004-circular-lake-protocol-membrane-and-nearby-ai-discovery.md

@@ -0,0 +1,37 @@
+# ADR 0004: Circular-lake protocol membrane and nearby AI discovery
+
+- Status: accepted for HoloLake 0.4.0
+- Date: 2026-08-16
+
+## Context
+
+External AI needs a simple way to find HoloLake and deliver language without turning MCP, a copied connection ticket, an Agent framework or a model host into the product's authority root. A language-only boundary must also remain enforceable when the sender is malformed or adversarial; asking a persona to infer every sender's motive is neither deterministic nor a security boundary.
+
+## Decision
+
+The native Rust core owns a circular-lake membrane before the language inbox. It accepts a bounded, strict GLP/1.0 expression envelope only after HoloLake issues an expression-only visitor session. Protocol-invalid input is rejected before persistence or semantic interpretation. Accepted language creates a receipt but no execution authority.
+
+The first discovery scope is the same logged-in operating-system account on one computer. A standard application-data descriptor points to a Unix socket restricted to that user. Generic AI may open an expression-only visitor lane. A Guanghu persona route requires separate verified persona-binding evidence and is not implemented by relabelling a visitor.
+
+Local-network discovery is not enabled in this slice. It requires an encrypted mutually authenticated transport, explicit human approval, expiry, replay protection, revocation and visible connection receipts before any mDNS-style advertisement or LAN listener may be introduced.
+
+MCP remains a compatibility and recovery adapter. It is not continuity, identity, memory or execution authority.
+
+## Why
+
+This preserves the user's "round lake" idea at an engineering boundary: non-protocol traffic never reaches the language world, while valid language still remains language rather than executable permission. The same-device descriptor provides Wi-Fi-like discovery where the operating system already supplies a trustworthy user boundary. Deferring LAN broadcast avoids falsely treating physical proximity or discoverability as authorization.
+
+## Rejected alternatives
+
+- Exposing an unauthenticated TCP or mDNS service now: discovery would outpace transport security and consent.
+- Letting natural-language intent classification replace structural validation: probabilistic interpretation cannot be the outer security boundary.
+- Treating any accepted message as a command: expression and execution authority must remain separate.
+- Making MCP or a third-party Agent framework the continuity owner: adapters are replaceable tools beneath HoloLake.
+
+## Evidence
+
+- `contracts/circular-lake-membrane.json`
+- `contracts/nearby-ai-discovery.json`
+- `src-tauri/src/circular_lake_membrane.rs`
+- `src-tauri/src/direct_local_broker.rs`
+- `scripts/circular-lake-membrane.test.mjs`