feat(hololake): add human-confirmed PNCC mounts

product-source/hololake-native-desktop/contracts/pncc-stage-one.json

@@ -2,7 +2,7 @@
   "schema": "hololake.pncc-stage-one-contract/v1",
   "record_id": "HLP-PNCC-STAGE-ONE-001",
   "development_id": "DEV-20260813-004",
-  "state": "READ_ONLY_CORE_IMPLEMENTED_HUMAN_MOUNT_REGISTRATION_GATED",
+  "state": "READ_ONLY_CORE_WITH_HUMAN_CONFIRMED_LOCAL_MOUNT",
   "source_provenance": "audit/pncc-migration-provenance.json",
   "transport": {
     "primary": "AUTHENTICATED_DIRECT_LOCAL_BROKER",
@@ -41,7 +41,10 @@
     "webview_arbitrary_path_or_url_registration_allowed": false,
     "external_ai_registration_allowed": false,
     "native_file_picker_exact_confirmation_required": true,
-    "implemented": false
+    "candidate_expires_after_ms": 900000,
+    "confirmation_token_stored_plaintext": false,
+    "evidence_revalidated_before_write": true,
+    "implemented": true
   },
   "forbidden": [
     "INTERNAL_AI_CHAT",
@@ -55,5 +58,5 @@
     "WHOLE_DONOR_TREE_COPY"
   ],
   "read_only_core_implemented": true,
-  "implementation_complete": false
+  "implementation_complete": true
 }

product-source/hololake-native-desktop/docs/ARCHITECTURE.md

@@ -22,4 +22,4 @@ HoloLake routes work but does not host the user's private work lake, pool users
 
 Stage one now contains a read-only GH-PNCC core beneath the public surface. A local persona repository is bound to an exact Git root and full committed head. A remote persona object is read through a credential-free HTTPS Git v2 partial-object channel with an app-owned bare `blob:none` cache and a separate durable ancestry cursor. Verified reads append to a bounded hash-chained projection for the human panel and authenticated external programming AIs.
 
-This core does not run a model, configure an API, acquire a persona lease, mutate memory or execute reality actions. Arbitrary repository paths and remote URLs cannot be registered by the WebView or external AI. Native human-confirmed source registration remains an explicit UI-stage gate.
+This core does not run a model, configure an API, acquire a persona lease, mutate memory or execute reality actions. Arbitrary repository paths and remote URLs cannot be registered by the WebView or external AI. A human may choose a folder through the native operating-system picker; HoloLake then displays the committed persona, responsibility subject, full head and checkpoint. A short-lived hashed confirmation token is required before the exact revalidated evidence becomes a read-only mount.

product-source/hololake-native-desktop/foundation.json

@@ -41,8 +41,8 @@
   "pncc_remote_incremental_object_channel_implemented": true,
   "pncc_receipt_projection_implemented": true,
   "pncc_authenticated_direct_broker_integration_implemented": true,
-  "pncc_human_mount_registration_implemented": false,
+  "pncc_human_mount_registration_implemented": true,
-  "pncc_human_mount_registration_gate": "NATIVE_FILE_PICKER_EXACT_CONFIRMATION_REQUIRED",
+  "pncc_human_mount_registration_gate": "SATISFIED_NATIVE_FILE_PICKER_EXACT_CONFIRMATION",
   "pncc_internal_model_inference_implemented": false,
   "pncc_execution_limb_implemented": false,
   "pncc_persona_lease_acquisition_implemented": false,

product-source/hololake-native-desktop/scripts/pncc-stage-one.test.mjs

@@ -48,7 +48,9 @@ test('neither webview nor external AI can register an arbitrary PNCC source', ()
   assert.equal(contract.mount_registration.webview_arbitrary_path_or_url_registration_allowed, false)
   assert.equal(contract.mount_registration.external_ai_registration_allowed, false)
   assert.equal(contract.mount_registration.native_file_picker_exact_confirmation_required, true)
-  assert.equal(contract.mount_registration.implemented, false)
+  assert.equal(contract.mount_registration.confirmation_token_stored_plaintext, false)
+  assert.equal(contract.mount_registration.evidence_revalidated_before_write, true)
+  assert.equal(contract.mount_registration.implemented, true)
   const native = readText('src-tauri/src/lib.rs')
   const broker = readText('src-tauri/src/direct_local_broker.rs')
   assert.doesNotMatch(native, /register_pncc_(repository|remote)_mount/)
@@ -60,7 +62,7 @@ test('foundation and Rust modules report the implemented PNCC boundary', () => {
   assert.equal(foundation.pncc_repository_binding_implemented, true)
   assert.equal(foundation.pncc_remote_incremental_object_channel_implemented, true)
   assert.equal(foundation.pncc_receipt_projection_implemented, true)
-  assert.equal(foundation.pncc_human_mount_registration_implemented, false)
+  assert.equal(foundation.pncc_human_mount_registration_implemented, true)
   assert.equal(foundation.pncc_internal_model_inference_implemented, false)
   assert.equal(foundation.pncc_execution_limb_implemented, false)
   for (const relative of [

product-source/hololake-native-desktop/src-tauri/Cargo.lock

@@ -659,6 +659,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
 dependencies = [
  "bitflags 2.13.1",
+ "block2",
+ "libc",
  "objc2",
 ]
 
@@ -1353,6 +1355,7 @@ dependencies = [
  "serde_json",
  "tauri",
  "tauri-build",
+ "tauri-plugin-dialog",
  "tauri-plugin-updater",
  "tauri-runtime",
  "tauri-runtime-wry",
@@ -2986,6 +2989,30 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "rfd"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a15ad77d9e70a92437d8f74c35d99b4e4691128df018833e99f90bcd36152672"
+dependencies = [
+ "block2",
+ "dispatch2",
+ "glib-sys",
+ "gobject-sys",
+ "gtk-sys",
+ "js-sys",
+ "log",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "raw-window-handle",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "windows-sys 0.60.2",
+]
+
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -3867,6 +3894,48 @@ dependencies = [
  "walkdir",
 ]
 
+[[package]]
+name = "tauri-plugin-dialog"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2d3c1dbe38037e7f590cdf2492594d5ceebe031e7bc7e827509b22a999d2940"
+dependencies = [
+ "log",
+ "raw-window-handle",
+ "rfd",
+ "serde",
+ "serde_json",
+ "tauri",
+ "tauri-plugin",
+ "tauri-plugin-fs",
+ "thiserror 2.0.20",
+ "url",
+]
+
+[[package]]
+name = "tauri-plugin-fs"
+version = "2.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7ecc274121aca0c036a2b42d1cbe83d368d348f54e0bb8a735c2b1548e8f371"
+dependencies = [
+ "anyhow",
+ "dunce",
+ "glob",
+ "log",
+ "objc2-foundation",
+ "percent-encoding",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "tauri",
+ "tauri-plugin",
+ "tauri-utils",
+ "thiserror 2.0.20",
+ "toml 1.1.4+spec-1.1.0",
+ "url",
+]
+
 [[package]]
 name = "tauri-plugin-updater"
 version = "2.10.1"

product-source/hololake-native-desktop/src-tauri/Cargo.toml

@@ -25,6 +25,7 @@ tauri = { version = "=2.10.2", features = [] }
 tauri-runtime = "=2.10.0"
 tauri-runtime-wry = "=2.10.0"
 tauri-plugin-updater = "2.10.0"
+tauri-plugin-dialog = "=2.7.2"
 uuid = { version = "1", features = ["v4"] }
 
 [dev-dependencies]

product-source/hololake-native-desktop/src-tauri/src/lib.rs

@@ -17,6 +17,7 @@ pub fn run_connector() -> Result<(), String> {
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
     tauri::Builder::default()
+        .plugin(tauri_plugin_dialog::init())
         .invoke_handler(tauri::generate_handler![
             home_status::get_hololake_home_status,
             direct_local_session::issue_direct_local_discovery_ticket,
@@ -27,6 +28,8 @@ pub fn run() {
             local_development_bridge::inspect_development_write_lane,
             local_development_bridge::release_development_write_lane,
             pncc_repository_binding::inspect_mounted_pncc_repository,
+            pncc_repository_binding::select_pncc_repository_candidate,
+            pncc_repository_binding::confirm_pncc_repository_mount,
             pncc_receipt_projection::query_pncc_receipt_projection,
         ])
         .setup(|app| {

product-source/hololake-native-desktop/src-tauri/src/pncc_repository_binding.rs

@@ -2,13 +2,19 @@
 // Clean-room stage-one implementation. Contract evidence is recorded in
 // audit/pncc-migration-provenance.json; no donor source was copied.
 
+use fs2::FileExt;
 use ring::digest::{digest, SHA256};
 use serde::{Deserialize, Serialize};
 use std::collections::BTreeSet;
-use std::fs;
+use std::fs::{self, OpenOptions};
+use std::io::Write;
+use std::os::unix::fs::OpenOptionsExt;
 use std::path::{Component, Path, PathBuf};
 use std::process::{Command, Output};
+use std::time::{SystemTime, UNIX_EPOCH};
 use tauri::{AppHandle, Manager};
+use tauri_plugin_dialog::DialogExt;
+use uuid::Uuid;
 
 const MANIFEST_PATH: &str = ".hololake/persona/manifest.json";
 const MANIFEST_SCHEMA: &str = "hololake.persona/v1";
@@ -16,6 +22,8 @@ const MAX_MANIFEST_BYTES: usize = 512 * 1024;
 const MAX_EVIDENCE_OBJECT_BYTES: usize = 2 * 1024 * 1024;
 const MAX_DECLARED_ARTIFACTS: usize = 256;
 const MOUNT_SCHEMA: &str = "hololake.pncc-stage-one-repository-mount/v1";
+const CANDIDATE_SCHEMA: &str = "hololake.pncc-stage-one-repository-candidate/v1";
+const CANDIDATE_TTL_MS: u128 = 15 * 60 * 1000;
 
 #[derive(Clone, Debug, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -44,6 +52,41 @@ pub struct PnccRepositoryMountReceipt {
     pub binding: PnccRepositoryInspectionReceipt,
 }
 
+#[derive(Clone, Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct ConfirmPnccRepositoryMountInput {
+    pub candidate_id: String,
+    pub confirmation_token: String,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct PnccRepositoryCandidateRecord {
+    schema: String,
+    state: String,
+    candidate_id: String,
+    confirmation_token_sha256: String,
+    repository_path: String,
+    expected_persona_id: String,
+    expected_human_responsibility_subject: String,
+    expected_head: String,
+    approved_receipt_id: String,
+    issued_at_unix_ms: u128,
+    expires_at_unix_ms: u128,
+    confirmed_mount_id: Option<String>,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PnccRepositoryCandidateReceipt {
+    pub schema: &'static str,
+    pub state: &'static str,
+    pub candidate_id: String,
+    pub confirmation_token: String,
+    pub expires_at_unix_ms: u128,
+    pub inspection: PnccRepositoryInspectionReceipt,
+}
+
 #[derive(Clone, Debug, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct InspectPnccRepositoryInput {
@@ -64,6 +107,51 @@ pub async fn inspect_mounted_pncc_repository(
         .map_err(|error| format!("PNCC_REPOSITORY_MOUNT_JOIN_FAILED: {error}"))?
 }
 
+#[tauri::command]
+pub async fn select_pncc_repository_candidate(
+    app: AppHandle,
+) -> Result<Option<PnccRepositoryCandidateReceipt>, String> {
+    let dialog_app = app.clone();
+    let selected = tauri::async_runtime::spawn_blocking(move || {
+        dialog_app
+            .dialog()
+            .file()
+            .set_title("选择代码通道 Git 仓库")
+            .blocking_pick_folder()
+    })
+    .await
+    .map_err(|error| format!("PNCC_REPOSITORY_PICKER_JOIN_FAILED: {error}"))?;
+    let Some(selected) = selected else {
+        return Ok(None);
+    };
+    let repository = selected
+        .into_path()
+        .map_err(|error| format!("PNCC_REPOSITORY_PICKER_PATH_INVALID: {error}"))?;
+    let inspection =
+        tauri::async_runtime::spawn_blocking(move || inspect_repository_candidate(&repository))
+            .await
+            .map_err(|error| format!("PNCC_REPOSITORY_CANDIDATE_JOIN_FAILED: {error}"))??;
+    let candidate_root = pncc_repository_candidate_root(&app)?;
+    create_candidate_at(&candidate_root, inspection).map(Some)
+}
+
+#[tauri::command]
+pub async fn confirm_pncc_repository_mount(
+    app: AppHandle,
+    input: ConfirmPnccRepositoryMountInput,
+) -> Result<PnccRepositoryMountReceipt, String> {
+    let candidate_root = pncc_repository_candidate_root(&app)?;
+    let mount_root = pncc_repository_mount_root(&app)?;
+    let projection_root = crate::pncc_receipt_projection::pncc_projection_root(&app)?;
+    tauri::async_runtime::spawn_blocking(move || {
+        let receipt = confirm_candidate_at(&candidate_root, &mount_root, input)?;
+        crate::pncc_receipt_projection::append_repository_binding_at(&projection_root, &receipt)?;
+        Ok(receipt)
+    })
+    .await
+    .map_err(|error| format!("PNCC_REPOSITORY_CONFIRM_JOIN_FAILED: {error}"))?
+}
+
 pub(crate) fn pncc_repository_mount_root(app: &AppHandle) -> Result<PathBuf, String> {
     let root = app
         .path()
@@ -77,6 +165,19 @@ pub(crate) fn pncc_repository_mount_root(app: &AppHandle) -> Result<PathBuf, Str
         .map_err(|error| format!("PNCC_REPOSITORY_MOUNT_STORAGE_UNAVAILABLE: {error}"))
 }
 
+fn pncc_repository_candidate_root(app: &AppHandle) -> Result<PathBuf, String> {
+    let root = app
+        .path()
+        .app_data_dir()
+        .map_err(|error| format!("PNCC_APP_DATA_UNAVAILABLE: {error}"))?
+        .join("pncc-stage-one-v1")
+        .join("repository-candidates");
+    fs::create_dir_all(&root)
+        .map_err(|error| format!("PNCC_REPOSITORY_CANDIDATE_STORAGE_UNAVAILABLE: {error}"))?;
+    root.canonicalize()
+        .map_err(|error| format!("PNCC_REPOSITORY_CANDIDATE_STORAGE_UNAVAILABLE: {error}"))
+}
+
 pub(crate) fn mounted_repository_count_at(root: &Path) -> Result<usize, String> {
     let mut count = 0;
     for entry in fs::read_dir(root)
@@ -103,6 +204,151 @@ pub(crate) fn mounted_repository_count_at(root: &Path) -> Result<usize, String>
     Ok(count)
 }
 
+fn inspect_repository_candidate(
+    repository: &Path,
+) -> Result<PnccRepositoryInspectionReceipt, String> {
+    let repository = exact_repository_root(repository)?;
+    let observed_head = git_text(&repository, &["rev-parse", "HEAD"], "PNCC_GIT_HEAD_READ")?
+        .trim()
+        .to_ascii_lowercase();
+    validate_head(&observed_head)?;
+    let (_, manifest_bytes) = read_committed_regular_blob(
+        &repository,
+        &observed_head,
+        MANIFEST_PATH,
+        MAX_MANIFEST_BYTES,
+    )?;
+    let manifest: PersonaManifestProjection = serde_json::from_slice(&manifest_bytes)
+        .map_err(|error| format!("PNCC_PERSONA_MANIFEST_INVALID: {error}"))?;
+    inspect_repository(InspectPnccRepositoryInput {
+        repository_path: repository.to_string_lossy().into_owned(),
+        expected_persona_id: manifest.persona_id,
+        expected_human_responsibility_subject: manifest.human_responsibility_subject,
+        expected_head: observed_head,
+    })
+}
+
+fn create_candidate_at(
+    root: &Path,
+    inspection: PnccRepositoryInspectionReceipt,
+) -> Result<PnccRepositoryCandidateReceipt, String> {
+    let _lock = lock_candidates(root)?;
+    let issued_at_unix_ms = now_unix_ms()?;
+    let expires_at_unix_ms = issued_at_unix_ms + CANDIDATE_TTL_MS;
+    let candidate_id = format!("candidate-{}", Uuid::new_v4());
+    let confirmation_token = format!("confirm-{}-{}", Uuid::new_v4(), Uuid::new_v4());
+    let record = PnccRepositoryCandidateRecord {
+        schema: CANDIDATE_SCHEMA.into(),
+        state: "PENDING_HUMAN_CONFIRMATION".into(),
+        candidate_id: candidate_id.clone(),
+        confirmation_token_sha256: sha256_hex(confirmation_token.as_bytes()),
+        repository_path: inspection.repository_path.clone(),
+        expected_persona_id: inspection.persona_id.clone(),
+        expected_human_responsibility_subject: inspection.human_responsibility_subject.clone(),
+        expected_head: inspection.git_head.clone(),
+        approved_receipt_id: inspection.receipt_id.clone(),
+        issued_at_unix_ms,
+        expires_at_unix_ms,
+        confirmed_mount_id: None,
+    };
+    write_json_atomic(&candidate_path(root, &candidate_id), &record, "CANDIDATE")?;
+    Ok(PnccRepositoryCandidateReceipt {
+        schema: CANDIDATE_SCHEMA,
+        state: "AWAITING_HUMAN_CONFIRMATION",
+        candidate_id,
+        confirmation_token,
+        expires_at_unix_ms,
+        inspection,
+    })
+}
+
+fn confirm_candidate_at(
+    candidate_root: &Path,
+    mount_root: &Path,
+    input: ConfirmPnccRepositoryMountInput,
+) -> Result<PnccRepositoryMountReceipt, String> {
+    validate_machine_id(&input.candidate_id, "CANDIDATE_ID")?;
+    if input.confirmation_token.len() < 32 || input.confirmation_token.len() > 256 {
+        return Err("PNCC_CONFIRMATION_TOKEN_INVALID".into());
+    }
+    let _lock = lock_candidates(candidate_root)?;
+    let path = candidate_path(candidate_root, &input.candidate_id);
+    let mut record: PnccRepositoryCandidateRecord = read_json_labeled(&path, "CANDIDATE")?;
+    if record.schema != CANDIDATE_SCHEMA || record.candidate_id != input.candidate_id {
+        return Err("PNCC_REPOSITORY_CANDIDATE_INVALID".into());
+    }
+    if record.confirmation_token_sha256 != sha256_hex(input.confirmation_token.as_bytes()) {
+        return Err("PNCC_REPOSITORY_CANDIDATE_NOT_AUTHORIZED".into());
+    }
+    if record.state == "CONFIRMED" {
+        let mount_id = record
+            .confirmed_mount_id
+            .ok_or("PNCC_REPOSITORY_CANDIDATE_INVALID")?;
+        return inspect_mounted_at(mount_root, InspectMountedPnccRepositoryInput { mount_id });
+    }
+    if record.state != "PENDING_HUMAN_CONFIRMATION" || now_unix_ms()? > record.expires_at_unix_ms {
+        return Err("PNCC_REPOSITORY_CANDIDATE_EXPIRED".into());
+    }
+    let binding = inspect_repository(InspectPnccRepositoryInput {
+        repository_path: record.repository_path.clone(),
+        expected_persona_id: record.expected_persona_id.clone(),
+        expected_human_responsibility_subject: record.expected_human_responsibility_subject.clone(),
+        expected_head: record.expected_head.clone(),
+    })?;
+    if binding.receipt_id != record.approved_receipt_id {
+        return Err("PNCC_REPOSITORY_CANDIDATE_EVIDENCE_DRIFT".into());
+    }
+    let mount_id = format!("pncc-{}", &binding.receipt_id[..16]);
+    let mount = PnccRepositoryMountRecord {
+        schema: MOUNT_SCHEMA.into(),
+        mount_id: mount_id.clone(),
+        repository_path: binding.repository_path.clone(),
+        expected_persona_id: binding.persona_id.clone(),
+        expected_human_responsibility_subject: binding.human_responsibility_subject.clone(),
+        expected_head: binding.git_head.clone(),
+        approved_receipt_id: binding.receipt_id.clone(),
+    };
+    let mount_record_path = mount_path(mount_root, &mount_id);
+    if mount_record_path.exists() {
+        let existing: PnccRepositoryMountRecord = read_json(&mount_record_path)?;
+        if existing.repository_path != mount.repository_path
+            || existing.expected_head != mount.expected_head
+            || existing.approved_receipt_id != mount.approved_receipt_id
+        {
+            return Err("PNCC_REPOSITORY_MOUNT_ID_CONFLICT".into());
+        }
+    } else {
+        write_json_atomic(&mount_record_path, &mount, "MOUNT")?;
+    }
+    record.state = "CONFIRMED".into();
+    record.confirmed_mount_id = Some(mount_id.clone());
+    write_json_atomic(&path, &record, "CANDIDATE")?;
+    Ok(PnccRepositoryMountReceipt {
+        schema: MOUNT_SCHEMA,
+        state: "HUMAN_CONFIRMED_READ_ONLY",
+        mount_id,
+        binding,
+    })
+}
+
+fn candidate_path(root: &Path, candidate_id: &str) -> PathBuf {
+    root.join(format!("{candidate_id}.json"))
+}
+
+fn lock_candidates(root: &Path) -> Result<std::fs::File, String> {
+    let lock = OpenOptions::new()
+        .read(true)
+        .write(true)
+        .create(true)
+        .truncate(false)
+        .mode(0o600)
+        .open(root.join("candidates.lock"))
+        .map_err(|error| format!("PNCC_REPOSITORY_CANDIDATE_LOCK_FAILED: {error}"))?;
+    lock.lock_exclusive()
+        .map_err(|error| format!("PNCC_REPOSITORY_CANDIDATE_LOCK_FAILED: {error}"))?;
+    Ok(lock)
+}
+
 pub(crate) fn inspect_mounted_at(
     root: &Path,
     input: InspectMountedPnccRepositoryInput,
@@ -479,20 +725,53 @@ fn validate_machine_id(value: &str, label: &str) -> Result<(), String> {
 }
 
 fn read_json<T: for<'de> Deserialize<'de>>(path: &Path) -> Result<T, String> {
+    read_json_labeled(path, "MOUNT")
+}
+
+fn read_json_labeled<T: for<'de> Deserialize<'de>>(path: &Path, label: &str) -> Result<T, String> {
     let metadata = fs::symlink_metadata(path).map_err(|error| {
         if error.kind() == std::io::ErrorKind::NotFound {
-            "PNCC_REPOSITORY_MOUNT_NOT_FOUND".to_string()
+            format!("PNCC_REPOSITORY_{label}_NOT_FOUND")
         } else {
-            format!("PNCC_REPOSITORY_MOUNT_READ_FAILED: {error}")
+            format!("PNCC_REPOSITORY_{label}_READ_FAILED: {error}")
         }
     })?;
     if metadata.file_type().is_symlink() || !metadata.is_file() {
-        return Err("PNCC_REPOSITORY_MOUNT_RECORD_INVALID".into());
+        return Err(format!("PNCC_REPOSITORY_{label}_RECORD_INVALID"));
     }
     serde_json::from_slice(
-        &fs::read(path).map_err(|error| format!("PNCC_REPOSITORY_MOUNT_READ_FAILED: {error}"))?,
+        &fs::read(path).map_err(|error| format!("PNCC_REPOSITORY_{label}_READ_FAILED: {error}"))?,
     )
-    .map_err(|error| format!("PNCC_REPOSITORY_MOUNT_RECORD_INVALID: {error}"))
+    .map_err(|error| format!("PNCC_REPOSITORY_{label}_RECORD_INVALID: {error}"))
+}
+
+fn write_json_atomic<T: Serialize>(path: &Path, value: &T, label: &str) -> Result<(), String> {
+    let parent = path
+        .parent()
+        .ok_or_else(|| format!("PNCC_REPOSITORY_{label}_PATH_INVALID"))?;
+    fs::create_dir_all(parent)
+        .map_err(|error| format!("PNCC_REPOSITORY_{label}_WRITE_FAILED: {error}"))?;
+    let temporary = parent.join(format!(".{label}-{}.tmp", Uuid::new_v4()));
+    let bytes = serde_json::to_vec_pretty(value)
+        .map_err(|error| format!("PNCC_REPOSITORY_{label}_RECORD_INVALID: {error}"))?;
+    let mut file = OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(0o600)
+        .open(&temporary)
+        .map_err(|error| format!("PNCC_REPOSITORY_{label}_WRITE_FAILED: {error}"))?;
+    file.write_all(&bytes)
+        .and_then(|_| file.sync_all())
+        .map_err(|error| format!("PNCC_REPOSITORY_{label}_WRITE_FAILED: {error}"))?;
+    fs::rename(&temporary, path)
+        .map_err(|error| format!("PNCC_REPOSITORY_{label}_WRITE_FAILED: {error}"))
+}
+
+fn now_unix_ms() -> Result<u128, String> {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|duration| duration.as_millis())
+        .map_err(|error| format!("PNCC_SYSTEM_CLOCK_INVALID: {error}"))
 }
 
 fn trusted_git() -> Command {
@@ -690,4 +969,58 @@ mod tests {
             "PNCC_REPOSITORY_RELATIVE_PATH_INVALID"
         );
     }
+
+    #[test]
+    fn human_confirmation_token_is_required_before_a_mount_is_written() {
+        let (_temp, repository, _head) = fixture();
+        let storage = TempDir::new().unwrap();
+        let candidates = storage.path().join("candidates");
+        let mounts = storage.path().join("mounts");
+        fs::create_dir_all(&candidates).unwrap();
+        fs::create_dir_all(&mounts).unwrap();
+        let candidate = create_candidate_at(
+            &candidates,
+            inspect_repository_candidate(&repository).unwrap(),
+        )
+        .unwrap();
+        assert!(fs::read_dir(&mounts).unwrap().next().is_none());
+
+        let wrong = confirm_candidate_at(
+            &candidates,
+            &mounts,
+            ConfirmPnccRepositoryMountInput {
+                candidate_id: candidate.candidate_id.clone(),
+                confirmation_token: "wrong-confirmation-token-long-enough-123".into(),
+            },
+        )
+        .unwrap_err();
+        assert_eq!(wrong, "PNCC_REPOSITORY_CANDIDATE_NOT_AUTHORIZED");
+        assert!(fs::read_dir(&mounts).unwrap().next().is_none());
+
+        let confirmed = confirm_candidate_at(
+            &candidates,
+            &mounts,
+            ConfirmPnccRepositoryMountInput {
+                candidate_id: candidate.candidate_id.clone(),
+                confirmation_token: candidate.confirmation_token.clone(),
+            },
+        )
+        .unwrap();
+        assert_eq!(confirmed.state, "HUMAN_CONFIRMED_READ_ONLY");
+        assert_eq!(confirmed.binding.persona_id, "ICE-P-ZY001");
+        assert!(!confirmed.binding.model_inference_started);
+        assert!(!confirmed.binding.reality_execution_allowed);
+
+        let retry = confirm_candidate_at(
+            &candidates,
+            &mounts,
+            ConfirmPnccRepositoryMountInput {
+                candidate_id: candidate.candidate_id,
+                confirmation_token: candidate.confirmation_token,
+            },
+        )
+        .unwrap();
+        assert_eq!(retry.mount_id, confirmed.mount_id);
+        assert_eq!(mounted_repository_count_at(&mounts).unwrap(), 1);
+    }
 }

product-source/hololake-native-desktop/src/main.tsx

@@ -43,6 +43,26 @@ interface ReceiptProjection {
   lastSequence: number
 }
 
+interface RepositoryInspection {
+  personaId: string
+  humanResponsibilitySubject: string
+  repositoryPath: string
+  gitHead: string
+  repositoryClean: boolean
+  currentCheckpoint: { relativePath: string; sha256: string }
+  modelInferenceStarted: boolean
+  realityExecutionAllowed: boolean
+}
+
+interface RepositoryCandidate {
+  schema: string
+  state: string
+  candidateId: string
+  confirmationToken: string
+  expiresAtUnixMs: number
+  inspection: RepositoryInspection
+}
+
 const themes: Array<{ id: ThemeId; name: string }> = [
   { id: 'night', name: '夜湖星光' },
   { id: 'dawn', name: '晨湖曦光' },
@@ -88,6 +108,9 @@ function HoloLakeApp() {
   const [panel, setPanel] = useState<Panel>(null)
   const [ticket, setTicket] = useState<DiscoveryTicketReceipt | null>(null)
   const [receipts, setReceipts] = useState<ReceiptEvent[]>([])
+  const [repositoryCandidate, setRepositoryCandidate] = useState<RepositoryCandidate | null>(null)
+  const [repositoryBusy, setRepositoryBusy] = useState(false)
+  const [repositoryMessage, setRepositoryMessage] = useState('')
   const [message, setMessage] = useState('')
 
   const refreshStatus = useCallback(async () => {
@@ -117,6 +140,10 @@ function HoloLakeApp() {
 
   const openReceipts = async () => {
     setPanel('receipts')
+    await loadReceipts()
+  }
+
+  const loadReceipts = async () => {
     try {
       const projection = await invoke<ReceiptProjection>('query_pncc_receipt_projection', { input: { afterSequence: 0, limit: 25 } })
       setReceipts(projection.events)
@@ -125,6 +152,42 @@ function HoloLakeApp() {
     }
   }
 
+  const chooseRepository = async () => {
+    setRepositoryBusy(true)
+    setRepositoryMessage('')
+    try {
+      const candidate = await invoke<RepositoryCandidate | null>('select_pncc_repository_candidate')
+      setRepositoryCandidate(candidate)
+      if (!candidate) setRepositoryMessage('已取消选择，没有写入任何绑定。')
+    } catch (error) {
+      setRepositoryCandidate(null)
+      setRepositoryMessage(`这个文件夹不能作为代码通道：${String(error)}`)
+    } finally {
+      setRepositoryBusy(false)
+    }
+  }
+
+  const confirmRepository = async () => {
+    if (!repositoryCandidate) return
+    setRepositoryBusy(true)
+    setRepositoryMessage('')
+    try {
+      await invoke('confirm_pncc_repository_mount', {
+        input: {
+          candidateId: repositoryCandidate.candidateId,
+          confirmationToken: repositoryCandidate.confirmationToken,
+        },
+      })
+      setRepositoryCandidate(null)
+      setRepositoryMessage('代码仓库已按当前固定提交绑定为只读通道。')
+      await Promise.all([refreshStatus(), loadReceipts()])
+    } catch (error) {
+      setRepositoryMessage(`绑定没有写入：${String(error)}`)
+    } finally {
+      setRepositoryBusy(false)
+    }
+  }
+
   const issueInvitation = async () => {
     setMessage('')
     try {
@@ -238,7 +301,20 @@ function HoloLakeApp() {
             <p className="panel-kicker">可核验的发生</p>
             <h2 id="panel-title">代码通道回执</h2>
             <p className="panel-intro">这里是只读投影，不是权限来源。没有回执，也不代表服务器离线。</p>
-            {receipts.length ? <ol className="receipt-list">{receipts.map((receipt) => <li key={receipt.sequence}><span>{receipt.sequence.toString().padStart(2, '0')}</span><div><b>{receipt.kind === 'REPOSITORY_BINDING_REVALIDATED' ? '仓库绑定已复核' : '远端对象读取已验证'}</b><small>{new Date(Number(receipt.observedAtUnixMs)).toLocaleString('zh-CN')} · {receipt.eventHash.slice(0, 12)}</small></div></li>)}</ol> : <div className="empty-state"><i /><b>湖面还没有新回执</b><span>完成代码仓库绑定或读取后，这里会出现可核验记录。</span></div>}
+            {repositoryCandidate ? <div className="candidate-card">
+              <div className="candidate-heading"><span className="status-light waiting" /><div><b>等待你确认</b><span>HoloLake 已只读检查这个 Git 仓库</span></div></div>
+              <dl className="candidate-facts">
+                <div><dt>人格</dt><dd>{repositoryCandidate.inspection.personaId}</dd></div>
+                <div><dt>责任人</dt><dd>{repositoryCandidate.inspection.humanResponsibilitySubject}</dd></div>
+                <div><dt>固定提交</dt><dd>{repositoryCandidate.inspection.gitHead.slice(0, 12)}</dd></div>
+                <div><dt>工作区</dt><dd>{repositoryCandidate.inspection.repositoryClean ? '干净' : '有未提交变化 · 不读取'}</dd></div>
+                <div><dt>检查点</dt><dd>{repositoryCandidate.inspection.currentCheckpoint.relativePath}</dd></div>
+              </dl>
+              <p>确认后只绑定这一份已提交证据；不会启动模型、不会取得人格租约、不会执行现实动作。</p>
+              <div className="candidate-actions"><button className="primary-action" type="button" disabled={repositoryBusy} onClick={() => void confirmRepository()}>确认只读绑定<Icon name="arrow" /></button><button className="text-action" type="button" disabled={repositoryBusy} onClick={() => setRepositoryCandidate(null)}>重新选择</button></div>
+            </div> : <button className="repository-picker" type="button" disabled={repositoryBusy} onClick={() => void chooseRepository()}><span><b>{status.codeRepositoryMountCount > 0 ? '再绑定一个代码仓库' : '绑定代码通道仓库'}</b><small>从 macOS 原生文件夹选择器进入</small></span><Icon name="arrow" /></button>}
+            {repositoryMessage && <p className="panel-message" aria-live="polite">{repositoryMessage}</p>}
+            {receipts.length ? <ol className="receipt-list">{receipts.map((receipt) => <li key={receipt.sequence}><span>{receipt.sequence.toString().padStart(2, '0')}</span><div><b>{receipt.kind === 'REPOSITORY_BINDING_REVALIDATED' ? '仓库绑定已复核' : '远端对象读取已验证'}</b><small>{new Date(Number(receipt.observedAtUnixMs)).toLocaleString('zh-CN')} · {receipt.eventHash.slice(0, 12)}</small></div></li>)}</ol> : <div className="empty-state compact"><i /><b>湖面还没有新回执</b><span>完成代码仓库绑定或读取后，这里会出现可核验记录。</span></div>}
           </>}
           {panel === 'settings' && <>
             <p className="panel-kicker">湖面设置</p>

product-source/hololake-native-desktop/src/styles.css

@@ -60,6 +60,7 @@ button:focus-visible { outline: 2px solid var(--focus-ring); outline-offset: 3px
 .hero-copy { max-width: 540px; margin: 27px 0 0; color: var(--content-muted); font-size: 14px; line-height: 1.9; letter-spacing: .035em; }
 .hero-actions { display: flex; align-items: center; gap: 14px; margin-top: 37px; }
 .primary-action, .secondary-action { min-height: 46px; border-radius: 999px; padding: 0 22px; display: inline-flex; align-items: center; justify-content: center; gap: 12px; cursor: pointer; transition: transform 180ms ease, background 180ms ease, box-shadow 180ms ease; }
+.primary-action:disabled, .secondary-action:disabled, .repository-picker:disabled, .text-action:disabled { opacity: .55; cursor: wait; transform: none; }
 .primary-action { border: 0; color: var(--button-primary-text); background: var(--button-primary-bg); box-shadow: var(--button-primary-shadow); font-weight: 620; }
 .secondary-action { color: var(--button-secondary-text); border: 1px solid var(--button-secondary-edge); background: var(--button-secondary-bg); backdrop-filter: blur(18px); }
 .primary-action:hover, .secondary-action:hover { transform: translateY(-2px); }
@@ -104,6 +105,27 @@ button:focus-visible { outline: 2px solid var(--focus-ring); outline-offset: 3px
 .empty-state i { width: 7px; height: 7px; margin-bottom: 20px; border-radius: 50%; background: var(--accent-light); box-shadow: 0 0 32px 12px var(--primitive-warm-glow); }
 .empty-state b { color: var(--content-secondary); font-size: 13px; font-weight: 570; }
 .empty-state span { max-width: 260px; margin-top: 10px; color: var(--content-faint); font-size: 11px; line-height: 1.7; }
+.empty-state.compact { min-height: 170px; }
+
+.repository-picker { width: 100%; min-height: 74px; display: flex; align-items: center; justify-content: space-between; gap: 18px; padding: 13px 19px; border: 0; border-radius: 19px; color: var(--content-secondary); background: var(--primitive-glass); box-shadow: inset 0 1px var(--primitive-glass-top); text-align: left; cursor: pointer; }
+.repository-picker:hover { background: var(--primitive-glass-hover); }
+.repository-picker span { display: grid; gap: 6px; }
+.repository-picker b { font-size: 12.5px; font-weight: 590; }
+.repository-picker small { color: var(--content-faint); font-size: 10px; }
+.repository-picker svg { width: 18px; height: 18px; fill: none; stroke: currentColor; stroke-width: 1.45; stroke-linecap: round; stroke-linejoin: round; }
+.candidate-card { margin-top: 26px; padding: 21px; border-radius: 21px; background: var(--primitive-glass); box-shadow: inset 0 1px var(--primitive-glass-top); }
+.candidate-heading { display: flex; align-items: flex-start; gap: 14px; }
+.candidate-heading div { display: grid; gap: 5px; }
+.candidate-heading b { color: var(--content-secondary); font-size: 12.5px; }
+.candidate-heading span { color: var(--content-faint); font-size: 10.5px; }
+.candidate-facts { display: grid; gap: 10px; margin: 20px 0; }
+.candidate-facts div { display: grid; grid-template-columns: 72px minmax(0, 1fr); gap: 12px; }
+.candidate-facts dt { color: var(--content-faint); font-size: 10px; }
+.candidate-facts dd { margin: 0; overflow: hidden; color: var(--content-secondary); font: 10.5px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace; text-overflow: ellipsis; white-space: nowrap; }
+.candidate-card > p { color: var(--content-faint); font-size: 10.5px; line-height: 1.7; }
+.candidate-actions { display: flex; align-items: center; gap: 16px; margin-top: 18px; }
+.candidate-actions .primary-action { min-height: 42px; padding-inline: 18px; font-size: 12px; }
+.text-action { border: 0; color: var(--content-muted); background: transparent; font-size: 11px; cursor: pointer; }
 
 .theme-list { display: grid; gap: 9px; margin-top: 30px; }
 .theme-list button { width: 100%; min-height: 66px; display: grid; grid-template-columns: 40px 1fr auto; align-items: center; gap: 14px; padding: 10px 14px; border: 0; border-radius: 17px; color: var(--content-secondary); background: transparent; text-align: left; cursor: pointer; }