bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat: compile GLS protocols into native runtime guards

Browse source
This commit is contained in:
冰朔 2026-08-17 16:22:56 +08:00
commit d6b1290e1c
13 changed files with 1909 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
product-source/hololake-native-desktop/docs/ARCHITECTURE.md
View file

@ -46,6 +46,8 @@ MCP may discover HoloLake, but it does not own continuity. The installed applica
An authenticated non-visitor connector may now acquire, inspect and explicitly release the existing account-scoped development write lane through that broker. Account, lane and client instance must match the HoloLake session before the bridge mutates. HoloLake projects the same Rust-owned lane state on the system-details page, so a human can distinguish a nearby expression-only visitor from an active development writer. This is a controlled writer handoff, not a general programming tool loop: shell, file patching, build execution, publication and deployment still require later supervised execution organs and separate authorization receipts.
The zero-core protocol layer now compiles the numbered GLS sources pinned to the current REPO-012 commit into a deterministic native registry. The registry inventories every unique numbered source with its path and SHA-256, but only protocols with an explicit typed adapter, event set and dependency-closed projection may execute. Raw protocol prose and arbitrary code carried by a protocol are never executed. The first native enforcement adapter binds GLS-0253 identity and numbering rules to the human-number route, with GLS-0250, GLS-0262 and GLS-0263 as executable dependencies. Unknown namespaces, persona numbers presented as human numbers, missing adapters and unprojected protocols fail closed. The system page reports compiled, executable and not-yet-executable protocol counts without presenting inventory as enforcement.
## Circular-lake protocol membrane and nearby AI
HoloLake 0.4.0 places a deterministic protocol membrane in front of the local language inbox. The membrane accepts only strict GLP/1.0 expression envelopes from a HoloLake-issued visitor session. Unknown fields, malformed identifiers, incorrect checksums, oversized content, attachments and command content are rejected before storage. Accepted natural language is an expression receipt only; it never carries execution authority by itself. Intent interpretation remains behind the membrane and cannot weaken its structural admission rules.

37
product-source/hololake-native-desktop/docs/adr/0006-compiled-gls-protocol-runtime.md Normal file
View file

@ -0,0 +1,37 @@
# ADR 0006: Compiled GLS protocol runtime
- Status: accepted for the next HoloLake desktop candidate
- Date: 2026-08-17
## Context
REPO-012 contains dozens of numbered GLS protocol sources. Human-readable source is necessary for authorship, review and causal meaning, but asking a model to reread protocol prose for every operation does not make the software obey the protocol. It also creates non-deterministic behavior and makes it impossible to distinguish a protocol that is merely present from one that is enforced by the running product.
## Decision
Compile the current numbered GLS sources into a deterministic registry pinned to an exact REPO-012 commit. Every selected source records its stable GLS number, path and SHA-256. Duplicate historical source locations are resolved by a deterministic source preference, while alternate-source counts remain visible.
An executable projection requires an explicit native adapter, event kinds, dependency list and fail-closed behavior. The compiler rejects missing executable dependencies and dependency cycles. The native runtime revalidates schema, source commit, counts, hashes, adapters and dependency closure before returning a protocol set to an organ.
Protocol prose is never evaluated as code. A protocol without an explicit projection remains `INVENTORIED_NOT_EXECUTABLE`. The initial executable set is GLS-0250, GLS-0253, GLS-0262 and GLS-0263. The zero-core numbering adapter requires their dependency-closed set before it can route a human number to an authoritative registry.
## Why
This creates the same hard boundary that a real API presents: a caller must satisfy the machine contract whether or not it has read the explanatory documentation. It also preserves factual honesty. HoloLake can report that 75 protocol sources are compiled while separately reporting that only four currently have native enforcement projections.
## Rejected alternatives
- Injecting all GLS prose into every model call: behavior would remain prompt-dependent and context growth would be unbounded.
- Treating every inventoried source as automatically active: source presence is not runtime enforcement.
- Executing scripts embedded in protocol documents: it would turn the authority source into an arbitrary-code supply chain.
- Hand-copying protocol decisions into unrelated organs: duplicated rules would drift and no common protocol set could be written into receipts.
- Blocking the product until all protocols are executable: incremental dependency-closed projections can be verified without overstating the remaining surface.
## Evidence
- `scripts/compile-gls-runtime-registry.mjs`
- `contracts/gls-executable-projections.json`
- `contracts/gls-runtime-registry.json`
- `src-tauri/src/gls_protocol_runtime.rs`
- `src-tauri/src/zero_core_numbering.rs`
- `scripts/gls-protocol-runtime.test.mjs`