bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

fix(persona): gate runtime projection by repository binding

Browse source
This commit is contained in:
冰朔 2026-08-12 02:42:17 +08:00
commit ebe12763f1
6 changed files with 111 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

6
product-source/hololake-platform/docs/ABSTRACTIONS.md
View file

@ -1262,9 +1262,9 @@ Managed by `useSettings` hook and `SettingsPanel` component. `theme_mode` is ins
- **AI feature visibility** — `ai_features_visibility_changed` records only whether installation-level AI surfaces were enabled or hidden.
- **Automatic update checks** — `automatic_update_checks_changed` records only whether startup/background update checks were enabled or disabled.
- **All Notes visibility** — `all_notes_visibility_changed` records only the toggled category and enabled state.
- **Persona runtime projection** — `persona_runtime_projection_loaded` and `persona_runtime_projection_retry`
record only coarse phase and count fields. Repository paths, persona session ids, event hashes, and runtime
attribution are never sent.
- **Persona runtime projection** — `persona_runtime_projection_gated`, `persona_runtime_projection_loaded`,
and `persona_runtime_projection_retry` record only coarse phase and count fields. Repository paths, persona
session ids, event hashes, and runtime attribution are never sent.
### Tauri Commands
- **`reinit_telemetry`** — Re-reads settings and toggles Rust Sentry on/off. Called from frontend when user changes crash reporting setting.

8
product-source/hololake-platform/docs/ARCHITECTURE.md
View file

@ -125,9 +125,11 @@ shows the exact repository, Git head, checkpoint, pinned model, and B0 evidence.
sovereign repository, register a node, acquire a lease, wake an organ, or run inference. Unbound is never
presented as proof that the persona does not exist, and multiple valid roots are not selected automatically.
The runtime projection independently queries each mounted path for `ICE-P-ZY001` through the native read
model. The renderer validates the receipt identity and required evidence, preserves partial query errors,
and displays the newest verified
The runtime projection repeats the fail-closed discovery boundary and queries the native read model only
after exactly one persona repository is evidence-bound. It passes only that canonical repository path into
the runtime query; unavailable, unbound, and ambiguous discovery states never query ordinary mounted
repositories and never become false runtime-receipt failures. The renderer validates the receipt identity
and required evidence, preserves query errors from the bound repository, and displays the newest verified
session with both a human state label and the raw state, Git and event-chain heads, node, organ, timestamp,
and human responsibility subject. No matching session is reported as absence of matching evidence, never as
proof that the persona is offline. This surface contains no wake, inference, lease, or execution control.